I can't post on mailing lists

[Péter Gábor]

Hi!

Some days ago I wrote message to the Lazarus mailing list, then I
received mails from both with the following text:

> Your mail to 'Lazarus' with the subject
>    fppkgPackageManager - paths of configuration files and packages
> Is being held until the list moderator can review it for approval.
> The reason it is being held:
>    The message headers matched a filter rule

First I wrote to lazarus@lists.lazarus.freepascal.org and after the
above answer I wrote to lazarus@lists.lazarus-ide.org.

The mails were sent from Thunderbird. On some anti-spam lists UPC
network (UPC is my internet provider) is marked as dangerous because UPC
allows the users to open the port (25) without control, that allows them
to create a lot of smtp (mail send) servers... and some users do so...
But I'm not sure about that this is the cause of my problem.

My mail was about FppkgPackageManager problems. I tried to start a
discussion before creating bugreport(s) if it is needed...
I hope that the moderator(s) of mailing list will allow my mail to be
posted and me to use the list without problems as before.
I use thunderbird more than 10 years ago and there was no problem before
... however my previous post (before the mentioned) to the mailing list
was sent at 2017.may.13. Maybe the filters were updated/changed since then.

This is a very annoying situation because some spammers was able to post on the
list using the names of real users. Using various names (Gabor Boros and
John Landmesser) of real members but the email address is
<Sascha.Hestermann@gmx.de>
Gabor Boros (the real one) was reporting this issue but the spammer
email address was not blocked yet.
Also José Mejuto was reporting the related IP (14.169.188.113). See
details in the archive of the list: "SPAM - Postfix master" thread.

Sapm-mail titles in the last months are for example: "☯pure joy"   and
"✈Re: amazing news!".  These spam mails sometimes have attached images.

Also I tried to connect you via #lazarus-ide IRC channel but I had no luck.
Also I wrote to mailman but I've got no answer

Maybe the issue applies to FPC lists (but I did not test to avoid
ranking me as a robotic spammer  )

Admins! Please fix the filters and/or allow me (white list) to post again!

Thanks for your help!

[Ñuño_Martínez]

I think you should move this thread to one of the Miscelaneous/Suggestions or Miscelaneous/Other forums.

[Thaddy]

This is a very annoying situation because some spammers was able to post on the
list using the names of real users.

Spammers are blocked by more than just a name..... Afaik they are blocked by source IP. Which means that if you are blocked you were probably either the spammer or you were hacked.

[taazz]

This is a very annoying situation because some spammers was able to post on the
list using the names of real users.

Spammers are blocked by more than just a name..... Afaik they are blocked by source IP. Which means that if you are blocked you were probably either the spammer or you were hacked.

Not if hes ISP uses dynamic IP.

[Thaddy]

Not if hes ISP uses dynamic IP.

Not many ISP's - except in Trump country - do, although they advertise it. If you get hit a second time (as a spammer) YOU most likely did something wrong.
Also note most spam on this forum has fake email addresses and are easy to spot. In that case that IP gets blocked. But if that fake email resolves to an IP that is yours, you will be blocked again...

Maybe you are running a Tor exit? Don't! on your daily machines. Use a spare one, dedicated.

[Marc]

As a result of spammers spamming in the name of real users, I've installed spamassasin on the mailinglist server. When you reach a score of 5 you get this message (it is the filter rule the message is talking about)
You get high scores if you're mailing from an known spam server,  open relay server or post a message with links to known spam sites
Each of the scores is not high enough to get marked as spam. So your mail must have more issues.

Can you give me the message id of the response you got, and a timestamp ?

Did your message et to the list ? If not, it has probably been discarded.

[Péter Gábor]

Here is the answer I've got for my 'teszt' mail (unfortunately the first one is already deleted, because of the rules here in thunderbird):

Code: [Select]

From - Fri Jun 16 15:10:51 2017
X-Account-Key: account3
X-UIDL: 1497618642.84617.fmx05.freemail.hu
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-Path: <lazarus-bounces@lists.lazarus-ide.org>
Delivered-To: ptrg@freemail.hu
Received: (qmail 84614 invoked from network); 16 Jun 2017 15:10:42 +0200
Received: from unknown (HELO fmx.freemail.hu) (10.6.145.240)
  by 172.27.78.105 with SMTP; 16 Jun 2017 15:10:42 +0200
X-fm-smtp-source: yes
Received: from server.lazarus-ide.org (server.lazarus-ide.org [37.97.187.115])
by fmx.freemail.hu (Postfix) with ESMTP id 3wq12T5hV5z6Zg
for <ptrg@freemail.hu>; Fri, 16 Jun 2017 15:10:41 +0200 (CEST)
Received: from server.lazarus-ide.org (localhost [IPv6:::1])
by server.lazarus-ide.org (Postfix) with ESMTP id 1709425240
for <ptrg@freemail.hu>; Fri, 16 Jun 2017 15:10:41 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=lists.lazarus-ide.org; s=list; t=1497618641;
bh=iHLfmtk3EQOhwm0nRqvSxSYDJlrvQcMszoiJytopUT0=;
h=Subject:From:To:Date:List-Id:From;
b=lr/QFLB4xyWFc9wMX7TRCWUtOLOjR8hakEUfayrUSLy/9IuoOrhxHccLSnJD7GVWc
SDpkEFrc59+9EpAftnULTUZcf7mXIJPptS+t3bD4FsJN9RlJern5Efn0jLNB+wNwiz
Q16o3aub+t8CZR9J5wVo1pfHwM/9yvnuV2+jJEKc=
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Subject: =?utf-8?q?Your_message_to_Lazarus_awaits_moderator_approval?=
From: lazarus-owner@lists.lazarus-ide.org
To: ptrg@freemail.hu
Message-ID: <mailman.9550.1497618640.22345.lazarus@lists.lazarus-ide.org>
Date: Fri, 16 Jun 2017 15:10:40 +0200
Precedence: bulk
X-BeenThere: lazarus@lists.lazarus-ide.org
X-Mailman-Version: 2.1.20
List-Id: Lazarus mailing list <lazarus.lists.lazarus-ide.org>
X-List-Administrivia: yes
Errors-To: lazarus-bounces@lists.lazarus-ide.org
Sender: "Lazarus" <lazarus-bounces@lists.lazarus-ide.org>
X-VR-SPAMSTATE: BOUNCE
X-VR-SPAMSCORE: 10170
X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeeljedrjeelgdeiudcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvpdcuhfftgffgofetkffnnecuuegrihhlohhuthemuceftddtnecupfhothhifhhitggrthhiohhnucdluddtudejtddmnecujfgurhepgggtgffuhffvkfffphejvghssehtsgertddttdejnecuhfhrohhmpehlrgiirghruhhsqdhofihnvghrsehlihhsthhsrdhlrgiirghruhhsqdhiuggvrdhorhhgnecuffhomhgrihhnpehlrgiirghruhhsqdhiuggvrdhorhhgnecukfhppeefjedrleejrddukeejrdduudehnecurfgrrhgrmhephhgvlhhopehsvghrvhgvrhdrlhgriigrrhhushdqihguvgdrohhrghdpihhnvghtpeefjedrleejrddukeejrdduudehpdhmrghilhhfrhhomheplhgriigrrhhushdqsghouhhntggvsheslhhishhtshdrlhgriigrrhhushdqihguvgdrohhrghdprhgtphhtthhopehpthhrghesfhhrvggvmhgrihhlrdhhuh
X-FM-Milter: Processed

WW91ciBtYWlsIHRvICdMYXphcnVzJyB3aXRoIHRoZSBzdWJqZWN0CgogICAgdGVzenQKCklzIGJl
aW5nIGhlbGQgdW50aWwgdGhlIGxpc3QgbW9kZXJhdG9yIGNhbiByZXZpZXcgaXQgZm9yIGFwcHJv
dmFsLgoKVGhlIHJlYXNvbiBpdCBpcyBiZWluZyBoZWxkOgoKICAgIFRoZSBtZXNzYWdlIGhlYWRl
cnMgbWF0Y2hlZCBhIGZpbHRlciBydWxlCgpFaXRoZXIgdGhlIG1lc3NhZ2Ugd2lsbCBnZXQgcG9z
dGVkIHRvIHRoZSBsaXN0LCBvciB5b3Ugd2lsbCByZWNlaXZlCm5vdGlmaWNhdGlvbiBvZiB0aGUg
bW9kZXJhdG9yJ3MgZGVjaXNpb24uICBJZiB5b3Ugd291bGQgbGlrZSB0byBjYW5jZWwKdGhpcyBw
b3N0aW5nLCBwbGVhc2UgdmlzaXQgdGhlIGZvbGxvd2luZyBVUkw6CgogICAgaHR0cDovL2xpc3Rz
LmxhemFydXMtaWRlLm9yZy9jb25maXJtL2xhemFydXMvZTMzNTI0NGVlMjZiZGE5YWJlMjA4N2M0
Mzg1OGFjOTYxM2ZlZjgzZQoK


[taazz]

Not if hes ISP uses dynamic IP.

Not many ISP's - except in Trump country - do, although they advertise it. If you get hit a second time (as a spammer) YOU most likely did something wrong.
Also note most spam on this forum has fake email addresses and are easy to spot. In that case that IP gets blocked. But if that fake email resolves to an IP that is yours, you will be blocked again...

Maybe you are running a Tor exit? Don't! on your daily machines. Use a spare one, dedicated.

sorry I'm under dynamic IP and I'm in Europe. IP filtering does not work you need header parsers and even then it is impossible to catch spammers, think spoofing, it is extremely easy to spoof emails with what ever you like.

[Thaddy]

@taazz
It is easy to detect spoofed emails even if you are under a dynamic IP. E.g. SpamAssassin uses the techniques I am referring to. That's because the mailserver is known, at least the outgoing last IP. And that is a real IP. Unless run your own mailserver under dynamic IP which has several other security related issues and is even not very easy to do.
Dynamic IP itself should be taken with a pinch of salt: usually it just means that your IP MAY change if the ISP feels it needs to. Normally it is stable for several months or in my case at home: years. Exception: some US providers change it a lot, but monthly, not weekly. The referring header is usually only a small part of serious anti-spam tools and works just indicative.
If you get blocked by spamassissin, your emailserver is in an IP block that is known to be used for spam. Your RH doesn't say much in such a case....

For running a mailserver under dynamic IP you need a dedicated service like http://ip.thaddy.com (this example running  by me for the last 10 years) to keep your mailserver configured properly. That's just to show you I know what I am talking about, but its use is free...

[taazz]

@taazz
It is easy to detect spoofed emails even if you are under a dynamic IP. E.g. SpamAssassin uses the techniques I am referring to. That's because the mailserver is known, at least the outgoing last IP. And that is a real IP. Unless run your own mailserver under dynamic IP which has several other security related issues and is even not very easy to do.
Dynamic IP itself should be taken with a pinch of salt: usually it just means that your IP MAY change if the ISP feels it needs to. Normally it is stable for several months or in my case at home: years. Exception: some US providers change it a lot, but monthly, not weekly. The referring header is usually only a small part of serious anti-spam tools and works just indicative.
If you get blocked by spamassissin, your emailserver is in an IP block that is known to be used for spam. Your RH doesn't say much in such a case....

For running a mailserver under dynamic IP you need a dedicated service like http://ip.thaddy.com (this example running  by me for the last 10 years) to keep your mailserver configured properly. That's just to show you I know what I am talking about, but its use is free...

you are going to deep on detection and ignore the spam mailer (aka the source). A spam mailer (a good one that is) usually has an smtp server included it spoofs the server not the client IP.

[Thaddy]

it spoofs the server not the client IP.

I am talking about the server. Nothing to spoof. Just ignore anything about referral headers. You can't spoof a real IP on the IP stack level. Otherwise there would be no connection at all.
What you describe is not spoofing, but running a mailserver (or a relay switch) on a hacked machine. Spoofing means faking. Really. Back to school.
My link is to keep a server properly configured....It returns the current exposed IP for the dynamic ip address as a clean string, w/o html, so you can run a script to keep the server working properly.

[Marc]

Blocking solely on sender IP doesn't work. The current dns based server reputation lists work better and together with content scanning on urls give a pretty clean list.

Anyway, we are drifting... back to the OP.

The scoring rules were
 RCVD_IN_BRBL_LASTEXT    1.6
 RCVD_IN_PBL                     2.0
 RDNS_NONE                       1.27
 SPF_NEUTRAL                     0.65

so that tips the 5 required points

The RCVD_IN_PBL score is a bit strange, this means that the upc mailserver was on this list (usually only dynamic IPS). it isn't listed now anymore.

Anyway, I lowered the RCVD_IN_PBL score too. IMO everyone capable should be allowed to run a mailserver (upc IPs are pretty static, at least mine is)

[Thaddy]

Correct. You should never rely on just one measure (which I already wrote).

And:
My Ziggo IP (assigned by UPC) hasn't changed since I moved to Wormerveer 3 years ago. Officially that is also a "dynamic" IP.
But anything serious is run by dedicated servers with fixed IP's.

[Péter Gábor]

Blocking solely on sender IP doesn't work. The current dns based server reputation lists work better and together with content scanning on urls give a pretty clean list.
IMO everyone capable should be allowed to run a mailserver (upc IPs are pretty static, at least mine is)

Some minutes ago I wrote another very simple testing mail to lazarus@lists.lazarus-ide.org:

Code: [Select]

From - Tue Jun 20 20:27:27 2017
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00800000
X-Mozilla-Keys:                                                                                 
To: Lazarus mailing list <lazarus@lists.lazarus-ide.org>
From: =?UTF-8?B?UMOpdGVyIEfDoWJvcg==?= <ptrg@freemail.hu>
Subject: teszt 2
Openpgp: id=E02A02075257DA899F28D5D84D58A3612010C0A8
Message-ID: <3a2c5a8d-1048-7e72-d01c-afe17269ed96@freemail.hu>
Date: Tue, 20 Jun 2017 20:27:25 +0200
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; hu; rv:1.8.1.19)
 Gecko/20081209 Thunderbird/2.0.0.19 Mnenhy/0.7.6.666
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-2
Content-Language: en-US
Content-Transfer-Encoding: 8bit

Testing rules on the list... do not reply!
--
Péter Gábor
The answer is as before:

Code: [Select]

From - Tue Jun 20 20:27:51 2017
X-Account-Key: account3
X-UIDL: 1497983258.34541.fmx07.freemail.hu
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-Path: <lazarus-bounces@lists.lazarus-ide.org>
Delivered-To: ptrg@freemail.hu
Received: (qmail 34530 invoked from network); 20 Jun 2017 20:27:38 +0200
Received: from unknown (HELO fmx.freemail.hu) (10.6.145.198)
  by 172.27.78.107 with SMTP; 20 Jun 2017 20:27:38 +0200
X-fm-smtp-source: yes
Received: from server.lazarus-ide.org (server.lazarus-ide.org [37.97.187.115])
by fmx.freemail.hu (Postfix) with ESMTP id 3wsbtL1vFlzBsh
for <ptrg@freemail.hu>; Tue, 20 Jun 2017 20:27:38 +0200 (CEST)
Received: from server.lazarus-ide.org (localhost [IPv6:::1])
by server.lazarus-ide.org (Postfix) with ESMTP id 4B75620475
for <ptrg@freemail.hu>; Tue, 20 Jun 2017 20:27:32 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=lists.lazarus-ide.org; s=list; t=1497983252;
bh=lBglNREQqTrQY5e+e53VBSr+yZ8HC69+L0vP1I/NTTY=;
h=Subject:From:To:Date:List-Id:From;
b=VwfZoil/7tNMD/gGhxaCbinq7VfDLDUm2ACMmz6l+ckRhn/ktHxvI34V9tp6QkgzI
IYcAzZw9nmUwd8aQTXSdgaPsTcLq7ug3I3rs1OKWTLlPididE5r6XVB6VoHtjbHM/g
6ToUdz/SXEXU4TnxGtAT/g2ZO5wPRgbMQBX6NLWE=
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Subject: =?utf-8?q?Your_message_to_Lazarus_awaits_moderator_approval?=
From: lazarus-owner@lists.lazarus-ide.org
To: ptrg@freemail.hu
Message-ID: <mailman.9807.1497983251.22345.lazarus@lists.lazarus-ide.org>
Date: Tue, 20 Jun 2017 20:27:31 +0200
Precedence: bulk
X-BeenThere: lazarus@lists.lazarus-ide.org
X-Mailman-Version: 2.1.20
List-Id: Lazarus mailing list <lazarus.lists.lazarus-ide.org>
X-List-Administrivia: yes
Errors-To: lazarus-bounces@lists.lazarus-ide.org
Sender: "Lazarus" <lazarus-bounces@lists.lazarus-ide.org>
X-VR-SPAMSTATE: BOUNCE
X-VR-SPAMSCORE: 10170
X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeeljedrkeekgdduudduucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuggftfghnshhusghstghrihgsvgdpucfhtffggffotefknfenuceurghilhhouhhtmecufedttdenucfpohhtihhfihgtrghtihhonhculddutddujedtmdenucfjughrpeggtgfguffhvffkffhpjegvshesthgsredttddtjeenucfhrhhomheplhgriigrrhhushdqohifnhgvrheslhhishhtshdrlhgriigrrhhushdqihguvgdrohhrghenucffohhmrghinheplhgriigrrhhushdqihguvgdrohhrghenucfkphepfeejrdeljedrudekjedrudduheenucfrrghrrghmpehhvghlohepshgvrhhvvghrrdhlrgiirghruhhsqdhiuggvrdhorhhgpdhinhgvthepfeejrdeljedrudekjedrudduhedpmhgrihhlfhhrohhmpehlrgiirghruhhsqdgsohhunhgtvghssehlihhsthhsrdhlrgiirghruhhsqdhiuggvrdhorhhgpdhrtghpthhtohepphhtrhhgsehfrhgvvghmrghilhdrhhhu
X-FM-Milter: Processed

WW91ciBtYWlsIHRvICdMYXphcnVzJyB3aXRoIHRoZSBzdWJqZWN0CgogICAgdGVzenQgMgoKSXMg
YmVpbmcgaGVsZCB1bnRpbCB0aGUgbGlzdCBtb2RlcmF0b3IgY2FuIHJldmlldyBpdCBmb3IgYXBw
cm92YWwuCgpUaGUgcmVhc29uIGl0IGlzIGJlaW5nIGhlbGQ6CgogICAgVGhlIG1lc3NhZ2UgaGVh
ZGVycyBtYXRjaGVkIGEgZmlsdGVyIHJ1bGUKCkVpdGhlciB0aGUgbWVzc2FnZSB3aWxsIGdldCBw
b3N0ZWQgdG8gdGhlIGxpc3QsIG9yIHlvdSB3aWxsIHJlY2VpdmUKbm90aWZpY2F0aW9uIG9mIHRo
ZSBtb2RlcmF0b3IncyBkZWNpc2lvbi4gIElmIHlvdSB3b3VsZCBsaWtlIHRvIGNhbmNlbAp0aGlz
IHBvc3RpbmcsIHBsZWFzZSB2aXNpdCB0aGUgZm9sbG93aW5nIFVSTDoKCiAgICBodHRwOi8vbGlz
dHMubGF6YXJ1cy1pZGUub3JnL2NvbmZpcm0vbGF6YXJ1cy8zOGFmNmE3ODc2OWQzYmI0N2IxYThl
NjFjMDgwMzExNzlmZDFjMWQwCgo=
Note: I do not and did not run any mail-server...

[Marc]

 I noticed.

*  4.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
   *      [176.63.29.7 listed in zen.spamhaus.org]
   
this is worse than the other. The server this morning was clean.

Maybe you can use a different cleaner upc server