Greylisting fails when from-String empty

[Flachzange]

I have the following problem with enabled greylisting and Plesk 9.5.2. Spammers massively use this issue to get their mails delivered. The problem occurs when the "from" string is empty. The greylisting filter assumes that this is a bounce message and skips it without performing the actual greylisting.

I hope that the Parallels development team can provide a hotfix for this issue.

Thanks and best regards,
Christoph

Jun 24 13:58:00 servername /var/qmail/bin/relaylock[1337]: /var/qmail/bin/relaylock: mail from 59.20.208.128:50486 (not defined)
Jun 24 13:58:02 servername qmail-queue-handlers[1341]: Handlers Filter before-queue for qmail started ...
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: from=
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: [email protected]
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: hook_dir = '/opt/psa/handlers/before-queue'
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: call_handlers: call executable = '/opt/psa/handlers/info/05-grey-6It4LH/executable'
Jun 24 13:58:04 servername greylisting filter[1342]: Starting greylisting filter...
Jun 24 13:58:04 servername greylisting filter[1342]: Bounce message. SKIP
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: handlers_stderr: SKIP
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: call_handlers: SKIP during call '/opt/psa/handlers/info/05-grey-6It4LH/executable' handler
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: call_handlers: call executable = '/opt/psa/handlers/info/20-kav-muaWOA/executable'
Jun 24 13:58:04 servername kav-mail-handler[1343]: kav-mail-handler start
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: handlers_stderr: PASS
Jun 24 13:58:04 servername kav-mail-handler[1343]: scanner: kav4ms-qmail-queue[1344] exited normally
Jun 24 13:58:04 servername kav-mail-handler[1343]: kav-mail-handler end
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: call_handlers: PASS during call '/opt/psa/handlers/info/20-kav-muaWOA/executable' handler
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: recipient[3] = '[email protected]'
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: handlers dir = '/opt/psa/handlers/before-queue/recipient/[email protected]'
Jun 24 13:58:04 servername qmail: 1277380684.555685 new msg 57049479
Jun 24 13:58:04 servername qmail: 1277380684.555921 info msg 57049479: bytes 8235 from <> qp 1346 uid 2020
Jun 24 13:58:04 servername qmail-queue-handlers[1341]: starter: submitter[1346] exited normally
Jun 24 13:58:04 servername qmail-local-handlers[1347]: Handlers Filter before-local for qmail started ...
Jun 24 13:58:04 servername qmail-local-handlers[1347]: from=
Jun 24 13:58:04 servername qmail-local-handlers[1347]: [email protected]
Jun 24 13:58:04 servername qmail-local-handlers[1347]: mailbox: /var/qmail/mailnames/my-domain.com/mail
Jun 24 13:58:04 servername qmail-local-handlers[1347]: hook_dir = '/opt/psa/handlers/before-local'
Jun 24 13:58:04 servername qmail-local-handlers[1347]: recipient[3] = '[email protected]'
Jun 24 13:58:04 servername qmail-local-handlers[1347]: handlers dir = '/opt/psa/handlers/before-local/recipient/[email protected]'
Jun 24 13:58:04 servername qmail-local-handlers[1347]: call_handlers: call executable = '/opt/psa/handlers/info/10-spam-gghyAM/executable'
Jun 24 13:58:04 servername qmail: 1277380684.568734 starting delivery 3750: msg 57049479 to local [email protected]

 

[IgorG]

It is not GL related issue. If it is necessary to lock such emails - it should be done by MTA. For example, Postfix has following parameter:

smtpd_sender_restrictions= reject_non_fqdn_sender

which is disabled by default. It is restrict empty From: field but pass 'From: <>' fields. It is correct behaviour because according to RFC 2822 such emails are used for notification messages.
Qmail uses more ancient RFC 822. There is defined that the From: field can be empty. And similarly for 'From: <>' fields.

 

[Flachzange]

Hi Igor,

thanks for your answer. I am using qmail. Is it possible to set this option also for qmail?

Regards,
Christoph

 

[IgorG]

Qmail should be patched for it. I think that switching to Postfix would be better solution - http://kb.odin.com/en/5801

 

[Flachzange]

hmm. I had issues with previous postfix installs on Plesk, so currently I won't give it a try in my productive system. But thanks anyway.