thomas-lists at nybeta
Aug 9, 2013, 5:46 AM
Post #7 of 7
(29 views)
Permalink
|
On 8/8/2013 5:32 AM, Steve Freegard wrote:
>
> Sure - I wrote both rules.
>
> It's to identify hosts that HELO with a 'raw' IP e.g.
>
> HELO 1.2.3.4
>
> Which is not syntactically correct as per the RFC. IP addresses used in
> the HELO should be in a IP literal format:
>
> HELO [1.2.3.4]
>
> FSL_HELO_BARE_IP_1 looks at only the last external IP address, whereas
> FSL_HELO_BARE_IP_2 looks at all external received hops.
>
> These were supposed just to be sandbox rules, but they've been
> autopromoted by the masschecker and I hadn't noticed until now.
>
> FSL_HELO_BARE_IP_2 should probably be meta'd to only hit if
> FSL_HELO_IP_1 doesn't hit to prevent a double hit if the last external
> is a raw IP.
>
> I'll create an FSL_HELO_BARE_IP_3 rule as a meta and see what the
> results are tomorrow, and then I'll remove FSL_HELO_BARE_IP_2 provided
> the results are satisfactory.
>
We have a client who is hitting these (yes we're working with them to
try and fix it). I haven't seen the _1 rule hit, but it is hitting the
following rules:
X-Spam-Status: Yes, score=6.904 tagged_above=-999 required=4.5
tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_2=2.699,
RCVD_IN_BRBL_LASTEXT=1.449, RCVD_NUMERIC_HELO=1.164, RDNS_NONE=0.793,
SPF_PASS=-0.001] autolearn=no
Hop #1 in their mailing output is emitting a HELO with a bare IP address
of the style "1.2.3.4". Hop #2 has a valid HELO, but they don't have a
reverse DNS record.
|
