Tips wanted on weeding out name spam

audiodef · Last edited by audiodef on Sun Jul 22, 2018 3:23 pm; edited 2 times in total

I run my own mail server on a Gentoo-based server. Anyone have any tips for weeding out that spam with people's names in the subject line?
_________________
Gentoo Studio: A Gentoo-based, professional digital audio workstation OS.

bunder · Bodhisattva Joined: 10 Apr 2004 Posts: 5801

You could write a custom spamassassin rule if you're okay with perl regex. :wink:

https://wiki.apache.org/spamassassin/WritingRules#Header_rules
_________________
overlay | patches

audiodef · Posted: Thu Jul 12, 2018 2:49 am Post subject:

I was wondering if I could do something like that. I mean, who IRL actually puts their name and only their name in the subject line anyway?

EDIT: Being the usual idiot I am, I forgot I already had sufficient measures in place. I just needed to run sa-update and restart spamd.
_________________
Gentoo Studio: A Gentoo-based, professional digital audio workstation OS.

audiodef · Posted: Sun Jul 22, 2018 3:24 pm Post subject:

Not solved.

I know it's not a bad mail server config because it's only affecting two accounts that have been used online over time. I'm hoping to figure out how to strengthen my spam filter. I could del these accounts, but I'd have to go around updating a lot of places that use these emails as logins and stuff.
_________________
Gentoo Studio: A Gentoo-based, professional digital audio workstation OS.

NeddySeagoon · Posted: Sun Jul 22, 2018 3:30 pm Post subject:

audiodef,

I greylist everything. That means nothing gets through at the first attempt from anywhere.
Spammers rarely do a retry :)

I check RDNS too but that drops some mail that I do want due to oddly configured mail systems.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

audiodef · Posted: Mon Jul 23, 2018 8:35 pm Post subject:

Thanks, Neddy. Great idea.

EDIT:

Trying Postgrey. It seemed to block all mail until I found in my logs that postfix was unable to connect to postgrey. This was because

https://wiki.gentoo.org/wiki/Postfix/Greylisting

gives a specific port which is not the actual port used in my instance. Checking ps aux | grep postgrey, I used the port from that output and now postgrey appears to be working, with expected log output.
_________________
Gentoo Studio: A Gentoo-based, professional digital audio workstation OS.

figueroa · Guru Joined: 14 Aug 2005 Posts: 401 Location: GA-USA

I've begun to just redirect all mail from selected top level domains that appear to only send spam using a procmail rule: