The Red Hat mailing lists have always been pretty good about filering out spam and viruses. However, this MyDoom thing looking like it is sneaking through. looking at the message headers, it appears to me that Red Hat external sendmail may be set up to accept mail from the outside without filtering if it is from a valid @redhat.com user.
I have not taken a look at these messages except for the last one but it appears that it is faking out the Red Hat sendmail server by telling it the host is redhat.com even if the ip address and reverse lookup do not match.
Besides using lots of bandwidth, this one must be driving all of the ISPs and companies nuts if it is getting through Red Hat's systems given prior history of being able to block this stuff. Lots of aggravation of lots of folks.
BTW, should this stuff be cleaned from (removed from) the archives since it is archiving lots of copies of of this virus which could bite unwary users.
On Sat, 31 Jan 2004 01:21:30 -0500, Gene C. wrote:
The Red Hat mailing lists have always been pretty good about filering out spam and viruses. However, this MyDoom thing looking like it is sneaking through. looking at the message headers, it appears to me that Red Hat external sendmail may be set up to accept mail from the outside without filtering if it is from a valid @redhat.com user.
Nah, I could post to the list using your name and e-mail address any time I wish, because your e-mail address is subscribed (!), and hence messages sent to the list, which appear as coming from a valid subscriber, are accepted and delivered to the other subscribers.
There's nothing trivial that can be done about it. With a clever mailing-list interface, subscribers could post to the list only with password authentication. Even a web interface where they would need to approve their own postings, would suffice. :o)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Saturday 31 January 2004 11:34, Michael Schwendt wrote:
Nah, I could post to the list using your name and e-mail address any time I wish, because your e-mail address is subscribed (!), and hence messages
...
There's nothing trivial that can be done about it. With a clever
If the mailsystem required that messages were signed by a key who public part was previously lodged with the mailsystem, that would do something about it. The load on the mailserver wouldn't be that high since it checks the sig once at the time it accepts the message for broadcast.
- -Andy
- -- Find your answer without waiting for replies.... Searchable list archives at http://marc.theaimsgroup.com/?l=fedora-list&r=1&w=2
On Saturday 31 January 2004 14:04, Andy Green wrote:
On Saturday 31 January 2004 11:34, Michael Schwendt wrote:
Nah, I could post to the list using your name and e-mail address any time I wish, because your e-mail address is subscribed (!), and hence messages
...
There's nothing trivial that can be done about it. With a clever
If the mailsystem required that messages were signed by a key who public part was previously lodged with the mailsystem, that would do something about it. The load on the mailserver wouldn't be that high since it checks the sig once at the time it accepts the message for broadcast.
-Andy
This will make all users of web based mails without PGP support unable to post/subscribe... not good I think. For me clamav does great... but eats too much CPU time (at least 3 times slower than f-prot for example). I don't find MyDoom as a big problem here - all RedHat lists are not related to windows.
-
Andy Green -
Doncho N. Gunchev -
Gene C. -
Michael Schwendt