Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Moving SF as second layer anti spam
  FAQ FAQ  Forum Search   Register Register  Login Login

Moving SF as second layer anti spam

 Post Reply Post Reply
Author
tckoay View Drop Down
Newbie
Newbie


Joined: 02 April 2007
Status: Offline
Points: 15
Post Options Post Options   Thanks (0) Thanks(0)   Quote tckoay Quote  Post ReplyReply Direct Link To This Post Topic: Moving SF as second layer anti spam
    Posted: 31 July 2007 at 9:43am

I would like to install another anti spam on top of the SF box. Then turn SF as the second layer of anti spam.

My first anti spam listen on port 25, then SF listen on port 26. Incoming email will go to 1st AS then SF.

How do I configure SF don't blacklist it own IP meantime still enjoy anti virus, bayensian filtering & so on. Meaning, I just want to turn off SF network layer filtering & blacklist function?

Now see SF seem to be treat it own IP as We Are Sender then ignore all the filter.

Thank you.

 

Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2007 at 1:13pm

In spamfilter.ini add your IP's separated by commas:

DoNotAddIPToHoneypot=xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx

This will stop your primary SF from getting blacklisted.



Edited by WebGuyz
http://www.webguyz.net
Back to Top
sgeorge View Drop Down
Senior Member
Senior Member


Joined: 23 August 2005
Status: Offline
Points: 178
Post Options Post Options   Thanks (0) Thanks(0)   Quote sgeorge Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2007 at 1:54pm
WebGuyz is right, you will definitely want to add your mail server's ip to that list so that it is not blacklisted.

Also, as you mentioned, your SpamFilter is now whitelisting everything it receives, because all the mail it sees now is coming from the same i.p. address on a different port.  In order to configure SpamFilter to not trust all mail originating from its own ip, you need to change the following setting to "1":
;by default SpamFilter will not allow any IP to relay thru it except for 127.0.0.1 (localhost). Change DoNotTrustSelfByDefault to 1 if you do not want localhost to be able to relay
DoNotTrustSelfByDefault=1


In addition, you would be wise to turn off the following filters in SpamFilter, as they are only effective when SpamFilter is located at the "edge" of your incoming mail gateway:
  • Reject if no Reverse DNS
  • MAPS
  • IPs
  • Country
  • Honeypots
  • SPF
  • SFDB
-Stephen

EDIT: You could also disable "Enable cached IP blocking", as it only works on the edge; but you don't have to, since using the setting that WebGuys mentioned will prevent your local mail server from being blocked.


Edited by sgeorge
Back to Top
atifghaffar View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 May 2006
Location: Switzerland
Status: Offline
Points: 104
Post Options Post Options   Thanks (0) Thanks(0)   Quote atifghaffar Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2007 at 5:52pm
tckoay,

What are you using as your primary filter?

Note: if your primary filter is going to flush messages in batch, then the logstat spamfilter might tag all message in that batch as spam if one of them is considered spam.

We have this issue when using SFI as out-going spamfilter.

best regards

Atif
Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2007 at 11:29pm

Just out of idle curiosity, what type of anti-spam are you running as a primary? I like the speed that SFE has and the only thing that I would consider putting in front of SFE would be a greylisting system. SA filter takes way too much in the way of CPU resources and we use it as a secondary only. But always looking for a better way to fight spam.

Thanks!

http://www.webguyz.net
Back to Top
tckoay View Drop Down
Newbie
Newbie


Joined: 02 April 2007
Status: Offline
Points: 15
Post Options Post Options   Thanks (0) Thanks(0)   Quote tckoay Quote  Post ReplyReply Direct Link To This Post Posted: 01 August 2007 at 1:03am

 I tried many anti spam solution & spent lots of $$$ to own it. If you looking for speed & min resources plus reasonable price, SF is your choice.

 I'm using Vircom ModusLite as my first layer. (ModusGate is a very powerful AS but it cost a bomb to me) So I choose ModusLite which is unlimited user license. It have powerful network layer filtering features but it doesn't have SF's limbo & SFDB function. For my env, my customers are KING, they don't accept SF's Limbo & SFDB features as they always said I can receive the email in yahoo or google. Why your AS keep on blocking my incoming email.

 Another reason that I'm using Modus sitting as first layer because it can communicate with my internal mail server to validate the recipient email address. As SF doesn't support SMTP vrfy so that currently it just accept whatever@mydomain.com, which I don't like to waste my bandwidth by receiving junk email in.

  BTW, ModusGate is very powerful anti spam but costly. SF is chasing up too. The rest product like well know Bxxxxx, Txxxxx, Mxxxxx. It really wasted my investment. MailCleaner also not bad, IF you can effort to invest on hardware resources. I tested it but give up due to resources limitation.

  For greylisting, my 2 cents is .... our lovely customer won't like it. It create more problem & cause email delay only. It not solve the problem but just delay it.



Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 01 August 2007 at 1:31am

I feel your pain about spending money trying out different AS methods. Been there, done that, and got the empty wallet to prove it.

You can use SF and the AuthorizedTo list to only accept valid users. We have a script that polls our control panel for any new email inserts/deletes and updates our list (in our case sql tables since we are now on SFE) every 10 minutes. We have been able to do this with 2 different mail servers (merak & smartermail) and if a better mail server comes along tomorrow I'm confident we can do it for that mailserver as well as long as it has an API of some sort. Using modusgate in your AS solution your kinda stuck using that mail server and can't quickly jump to other mail platforms without totally redoing your AS solution. Not trying to talk you out of using it, just giving you more things to consider in your quest for the best solution.

I shudder when I think of how much time (years)  I've spent on perfecting our spam filtering and getting it to the point where we are happy with it. Luckily Roberto and his team have been responsive and listened to our suggestions and SFE is coming along just great!!!



Edited by WebGuyz
http://www.webguyz.net
Back to Top
tckoay View Drop Down
Newbie
Newbie


Joined: 02 April 2007
Status: Offline
Points: 15
Post Options Post Options   Thanks (0) Thanks(0)   Quote tckoay Quote  Post ReplyReply Direct Link To This Post Posted: 01 August 2007 at 2:50am

Yes. I agree with you. Roberto team giving me very good support. I rate their support 10 out of 10.

I aware of AuthorizedTo features. Can you share with me how you can make it integrate with 3rd party mail server. Lets' take Merak for example, as the customer may add & remove user anytime. You script/API will able to "Sync" with merak users list? Can you share the secret of it?

 Thank you.


Back to Top
WebGuyz View Drop Down
Senior Member
Senior Member


Joined: 09 May 2005
Location: United States
Status: Offline
Points: 348
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebGuyz Quote  Post ReplyReply Direct Link To This Post Posted: 01 August 2007 at 8:09am
Its not a matter of syncing as it is using the Merak API and re-creating the AuthorizedTo.txt list every 10 minutes (or 30 or more on a less busy system). Will send you the asp & vbs scripts in a PM in a day or so after I find them. With current SFE setup all our customers enter email inserts/deletes thru our Helm control panel and we have triggers set in the Helm SQL db for the control panel to automatically insert/delete entries in SFE database so we no longer have to re-create a text file list like we did with SFI every 10 minutes.
http://www.webguyz.net
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.225 seconds.