🚀 go-pugleaf

"Ben" <bjblackmore@mailhot.com> wrote in message
news:ds7fjv$qnq$1@nwrdmz02.dmz.ncs.ea.ibs-infra.bt.com...
> Hi,
>
> Does anyone know any free white/black list software, that I can install in
> our local LAN to allow our users to add email address to a white/black
list?
>
> Cheers
>
> Ben

I think that would depend on the existing software on your "local LAN". When
you say local LAN, should it be assumed that you're talking about software
you can install on a local server (possibly mail server)? or do you mean
software you can install on the individual workstations (possibly
integrating with your client software)?

-Dr.X

Hi Dr. X

Thanks for the reply.

We currently have a spam filter, on our firewall. As well as using it's own 
rules to filter mail, it can also check against a white/black list server. 
So what I'd like is a bit of software that can be installed on a server 
somewhere (preferably NT, but Linux would do) so people can connect to it, 
maybe via web page, and add their own entries.

We did test a product from McAfee, that would install on IIS, you could open 
a web page, and configure it with mailboxs, then you could add black/white 
list entries against each mailbox. But it had an issue with adding mailbox 
entries, where it wouldn't recognise a period in the email address, and 
according to McAfee it won't be fixed until the next release of their 
software.

If an existing product doesn't exist, I may just write my own web page, that 
can read/write XML, looking at the McAfee product, it just reads a file with 
the format:

  <?xml version="1.0" encoding="UTF-8" ?>
- <MailboxUpdate>
- <Mailbox name="user.one@DOMAIN" owner="user.one@DOMAIN" 
lastUpdate="1139234841" Delete="0">
  <DenySender>spam@spam.com</DenySender>
  <AllowSender>allow.email@DOMAIN.com</AllowSender>
  </Mailbox>
- <Mailbox name="user.two@DOMAIN" owner="user.two@DOMAIN" 
lastUpdate="1139234869" Delete="0">
  <DenySender>spam@spam.com</DenySender>
  <AllowSender>allow.email@DOMAIN.com</AllowSender>
  </Mailbox>
  </MailboxUpdate>

If you need anymore info please let me know

Ben

"Dr.X" <Dr.X@NOSPAMnull.com> wrote in message 
news:JfIFf.15306$Fw6.14407@tornado.tampabay.rr.com...
> "Ben" <bjblackmore@mailhot.com> wrote in message
> news:ds7fjv$qnq$1@nwrdmz02.dmz.ncs.ea.ibs-infra.bt.com...
>> Hi,
>>
>> Does anyone know any free white/black list software, that I can install 
>> in
>> our local LAN to allow our users to add email address to a white/black
> list?
>>
>> Cheers
>>
>> Ben
>
> I think that would depend on the existing software on your "local LAN". 
> When
> you say local LAN, should it be assumed that you're talking about software
> you can install on a local server (possibly mail server)? or do you mean
> software you can install on the individual workstations (possibly
> integrating with your client software)?
>
> -Dr.X
>
> 

"Ben" <bjblackmore@mailhot.com> wrote in message
news:ds7la0$l97$1@nwrdmz01.dmz.ncs.ea.ibs-infra.bt.com...
[chronology fix. Please don't top post. See below.]
>
> "Dr.X" <Dr.X@NOSPAMnull.com> wrote in message
> news:JfIFf.15306$Fw6.14407@tornado.tampabay.rr.com...
> > "Ben" <bjblackmore@mailhot.com> wrote in message
> > news:ds7fjv$qnq$1@nwrdmz02.dmz.ncs.ea.ibs-infra.bt.com...
> >> Hi,
> >>
> >> Does anyone know any free white/black list software, that I can install
> >> in
> >> our local LAN to allow our users to add email address to a white/black
> > list?
> >>
> >> Cheers
> >>
> >> Ben
> >
> > I think that would depend on the existing software on your "local LAN".
> > When
> > you say local LAN, should it be assumed that you're talking about
software
> > you can install on a local server (possibly mail server)? or do you mean
> > software you can install on the individual workstations (possibly
> > integrating with your client software)?
> >
> > -Dr.X

> Hi Dr. X
>
> Thanks for the reply.
>
> We currently have a spam filter, on our firewall. As well as using it's
own
> rules to filter mail, it can also check against a white/black list server.
> So what I'd like is a bit of software that can be installed on a server
> somewhere (preferably NT, but Linux would do) so people can connect to it,
> maybe via web page, and add their own entries.
>
> We did test a product from McAfee, that would install on IIS, you could
open
> a web page, and configure it with mailboxs, then you could add black/white
> list entries against each mailbox. But it had an issue with adding mailbox
> entries, where it wouldn't recognise a period in the email address, and
> according to McAfee it won't be fixed until the next release of their
> software.
>
> If an existing product doesn't exist, I may just write my own web page,
that
> can read/write XML, looking at the McAfee product, it just reads a file
with
> the format:
>
>   <?xml version="1.0" encoding="UTF-8" ?>
> - <MailboxUpdate>
> - <Mailbox name="user.one@DOMAIN" owner="user.one@DOMAIN"
> lastUpdate="1139234841" Delete="0">
>   <DenySender>spam@spam.com</DenySender>
>   <AllowSender>allow.email@DOMAIN.com</AllowSender>
>   </Mailbox>
> - <Mailbox name="user.two@DOMAIN" owner="user.two@DOMAIN"
> lastUpdate="1139234869" Delete="0">
>   <DenySender>spam@spam.com</DenySender>
>   <AllowSender>allow.email@DOMAIN.com</AllowSender>
>   </Mailbox>
>   </MailboxUpdate>
>
> If you need anymore info please let me know
>
> Ben

Hi Ben.

    If I understand you correctly, your McAfee product generated a XML file
that your firewall/filter understood. I can't think of a product that
generates that file format, but like you said, it's only XML and therefore
easily reproducible. Is XML the only format your firewall/filter
understands? Can it also import regular old everyday lists of email
addresses?

    Also, what do you do about email addresses that are forged? Do you just
assume that the victims of the forgery will never send an email to you/your
co.? Do you also assume that the spammer will continue to use that forged
email address? I'm not badgering your method of filtering. I'm just trying
to understand the goal.

    Anyways, I think you're gonna be stuck making your own. I have a
suggestion though. If you're willing to make a web page that users will log
on to add the addresses, then maybe you can bypass that part and make a
script or program that reads a mailbox. Have your users send the email
addresses in an email to that box. The script checks the box periodically
and generates the list from that.

for example (per your example), the user can send an email to
BLOCKthisBASTARD@domain with a list of just the email addresses to block or
allow like this:

B badperson@baddomain
B anotherbaduser@anotherbaddomain
A agooduser@anicedomian
B someScume@aCreepyDomain

    Then your script would read B for block and A for allow. If I understand
the xml you provided, then Mailbox name refers to the local user that wants
to do the blocking. In that case, just have them send the list from that
mailbox and your script will know what box to apply the rule to.

    Now, depending on whether your filter can take just plain lists, you can
easily parse this into straight lists. Or, if your filter can only
understand the xml, then you can still supply that from this input. Still
that all depends on if my assumptions about your setup is correct.

    You mentioned that your firewall/filter can "check against a white/black
list server". Are you meaning a dns type server?

lemme know.
-Dr.X
PS: Please don't top post your replies. It makes it difficult to follow a
conversation if one of us posts at the top and the other posts at the
bottom. The general rule is to bottom post and/or insert where appropriate.
Thanks.

> Hi Ben.
>
>    If I understand you correctly, your McAfee product generated a XML file
> that your firewall/filter understood. I can't think of a product that
> generates that file format, but like you said, it's only XML and therefore
> easily reproducible. Is XML the only format your firewall/filter
> understands? Can it also import regular old everyday lists of email
> addresses?
>
>    Also, what do you do about email addresses that are forged? Do you just
> assume that the victims of the forgery will never send an email to 
> you/your
> co.? Do you also assume that the spammer will continue to use that forged
> email address? I'm not badgering your method of filtering. I'm just trying
> to understand the goal.
>
>    Anyways, I think you're gonna be stuck making your own. I have a
> suggestion though. If you're willing to make a web page that users will 
> log
> on to add the addresses, then maybe you can bypass that part and make a
> script or program that reads a mailbox. Have your users send the email
> addresses in an email to that box. The script checks the box periodically
> and generates the list from that.
>
> for example (per your example), the user can send an email to
> BLOCKthisBASTARD@domain with a list of just the email addresses to block 
> or
> allow like this:
>
> B badperson@baddomain
> B anotherbaduser@anotherbaddomain
> A agooduser@anicedomian
> B someScume@aCreepyDomain
>
>    Then your script would read B for block and A for allow. If I 
> understand
> the xml you provided, then Mailbox name refers to the local user that 
> wants
> to do the blocking. In that case, just have them send the list from that
> mailbox and your script will know what box to apply the rule to.
>
>    Now, depending on whether your filter can take just plain lists, you 
> can
> easily parse this into straight lists. Or, if your filter can only
> understand the xml, then you can still supply that from this input. Still
> that all depends on if my assumptions about your setup is correct.
>
>    You mentioned that your firewall/filter can "check against a 
> white/black
> list server". Are you meaning a dns type server?
>
> lemme know.
> -Dr.X
> PS: Please don't top post your replies. It makes it difficult to follow a
> conversation if one of us posts at the top and the other posts at the
> bottom. The general rule is to bottom post and/or insert where 
> appropriate.
> Thanks.
>

Hi Dr. X,

I was looking more into the McAfee product yesterday after my reply.  I was 
only partly correct about the XML file, what appears to happen, is the 
firewall reads a url, in this case an internal server hosting the mcafee 
list server, what it reads is a .dll file, that creates the XML document. 
Now each mailbox has a directory under the McAfee product program files 
folder, i.e. joe.bloggs@DOMAIN under this directory are a few files, config 
(contains mailbox owner & email address), allowRecipient, AllowSender, 
denyRecipient, and denySender (no file extensions). What happens it it opens 
each file, and creates the XML output based on the contents of these files.

If this is the case, then it still shouldn't be too difficult to write some 
code that will create/edit these files based on the users mailbox. I like 
your idea of having a specific mailbox that people can send email address to 
and have a script that process those emails. If I can't get McAfee working I 
will definatly look into setting up a system like that, I could even have 2 
address whitelist@ourdomain.com and blacklist@ourdomain.com or allow@... and 
block@... (if you only have one you just know that one user is going to 
forget to add the A or B in from of the addresses, or end up blocking people 
they want to allow).

What most people in our company want is not so much a blacklist but just a 
whitelist, mainly because our spam filter catches some false positives, so 
people (especially sales & marketing) just want to be able to add email 
addresses that never get filtered out. A blacklist may be used a bit, but 
only from persistant spammer (i.e. I get 3 or 4 emails every day from some 
guy called Stephen Cooper offering trade stocks, no matter how much I try 
and unsubscribe).

I looked more at the McAfee product code yesterday, to see if I could find 
what the problem was (McAfee support have been working on this for 8 weeks). 
When I add a mailbox in the form of "joe.bloggs@DOMAIN" it says the owner is 
in valid. Now tracing the code through I found a file called 
mailboxpicker.js that appears to validate the mailbox owner & email address 
format. In that validate function is a line that reads "var rx = 
/^[\-_a-zA-Z0-9]+(\\|\@)[\-_a-zA-Z0-9]+$/" it seems that this would only 
validat a mailbox owner if the username contains alphanumerical characters, 
hyphens & underscores, but not periods. However by adding a period to the 
allowed strings, it should mean that a mailbox owner with a period in the 
username is now valid too.

I have added the period, and just need to test the product again. I have 
emailed McAfee support with the possible solution, so we'll see what they 
say. (Can't believe it's taken them over 8 weeks, when I managed to find a 
possible solution in under 8 hours!).

If this fix works great, if not I'll setup a mailbox like you suggested, and 
have a script process emails people send to it!

Ben

P.S. Sorry about the TP, I usually don't but forgot yesterday, damn outlook 
express! 

"Ben" <bjblackmore@mailhot.com> wrote in message
news:ds9oq1$hm0$1@nwrdmz02.dmz.ncs.ea.ibs-infra.bt.com...
> > Hi Ben.
...snip...
>
> Hi Dr. X,
>
> I was looking more into the McAfee .....
...
> If this is the case, then it still shouldn't be too difficult to write
some
> code that will create/edit these files based on the users mailbox.

This should actually be simpler than coding something to output the XML
format. Carefull you don't try to edit the config files while the system is
trying to read/write them. You could cause the server to vomit up an error.
Or at the very least you could end up with partial addresses in the list.
You'll have to figure out some kind of trigger that lets you know that the
system is not trying to access those files. Maybe have your script test to
see if the file is locked before it attempts an edit.

> I like
> your idea of having a specific mailbox that people can send email address
to
> and have a script that process those emails. If I can't get McAfee working
I
> will definatly look into setting up a system like that, I could even have
2
> address whitelist@ourdomain.com and blacklist@ourdomain.com or allow@...
and
> block@... (if you only have one you just know that one user is going to
> forget to add the A or B in from of the addresses, or end up blocking
people
> they want to allow).

Yes, I thought of that too but figured you would realize that on your own
anywayz. :-)
I also figured you would relize that you can have your users just forward
spam to your script and have the script find the address of the spammer in
the forwarded spam. The less work you impose on your users, the more willing
they will be to participate in your anti spam efforts.

> .....A blacklist may be used a bit, but
> only from persistant spammer (i.e. I get 3 or 4 emails every day from some
> guy called Stephen Cooper offering trade stocks, no matter how much I try
> and unsubscribe).

Never 'unsubscribe' from spam. It only confirms to them that there's a real
human at your address.

...
> I have added the period, and just need to test the product again. I have
> emailed McAfee support with the possible solution, so we'll see what they
> say. (Can't believe it's taken them over 8 weeks, when I managed to find a
> possible solution in under 8 hours!).
>
> If this fix works great, if not I'll setup a mailbox like you suggested,
and
> have a script process emails people send to it!
>
> Ben

Cool.
Meantime, think about other anti-spam methods. I'm guessing you'll get very
tired of the spammer just switching addresses.

Good luck. Post back your results.

-Dr.X