Evgeniy
evgeniy@riscom.net
Thu May 15 12:59:03 UTC 2003
Hi,
i have DCCM latest version (1.1.36),
after 24 hour testing i see that dccm rejecting mailing list,
example securityfocus.com
in file whitecommon i have records
# BUGTRAQ
ok substitute mail_host securityfocus.com
substitute Sender: focus-linux@securityfocus.com
ok substitute mail_host outgoing2.securityfocus.com
ok substitute mail_host lists.securityfocus.com
example message:
VERSION: 3
DATE: 05/14/03 18:30:43 EEST
IP: ns.riscom.net ::ffff:195.138.96.90
HELO: ns.riscom.net
env_From: <focus-linux-return-1861-web=riscom.net@securityfocus.com>
mail_host=securityfocus.com.
env_To: <ameoba32@[195.138.96.154]> addr=ameoba32 dir=
Received: from outgoing2.securityfocus.com (outgoing2.securityfocus.com
[205.206.231.26])
by ns.riscom.net (8.12.9/8.12.9) with ESMTP id h4EFWOil002152
for <web@riscom.net>; Wed, 14 May 2003 18:32:26 +0300 (EEST)
Received: from lists.securityfocus.com (lists.securityfocus.com
[205.206.231.19])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 0CCD48F342; Wed, 14 May 2003 09:03:06 -0600 (MDT)
Mailing-List: contact focus-linux-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <focus-linux.list-id.securityfocus.com>
List-Post: <mailto:focus-linux@securityfocus.com>
List-Help: <mailto:focus-linux-help@securityfocus.com>
List-Unsubscribe: <mailto:focus-linux-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:focus-linux-subscribe@securityfocus.com>
Delivered-To: mailing list focus-linux@securityfocus.com
Delivered-To: moderator for focus-linux@securityfocus.com
Received: (qmail 22027 invoked from network); 13 May 2003 03:37:46 -0000
From: Glynn Clements <glynn.clements@virgin.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <16064.26997.958174.256022@cerise.nosuchdomain.co.uk>
Date: Tue, 13 May 2003 04:41:41 +0100
To: Sebastian Muniz <seba@mtss.dnsalias.org>
Cc: Bill Tihen <bill@tasis.ch>, focus-linux@securityfocus.com
Subject: Re: IPChains Question (compatibility mode on kernel 2.4.x)
In-Reply-To: <20030512211700.124775f5.seba@mtss.dnsalias.org>
References: <3E43EB34.80504@travelamericas.com>
<61945.195.15.127.161.1052481045.squirrel@cgi.tasis.ch>
<20030512211700.124775f5.seba@mtss.dnsalias.org>
X-Mailer: VM 7.07 under 21.4 (patch 12) "Portable Code" XEmacs Lucid
Sebastian Muniz wrote:
> Hi!
> You are missing the point.
>
> ddp 37 DDP # Datagram Delivery Protocol
> Seems you are trying to block ddp, that is a protocol that runs
> _over_ tcp or udp
DDP is on the same layer as TCP, UDP, ICMP etc:
icmp 1 ICMP # internet control message protocol
igmp 2 IGMP # Internet Group Management
tcp 6 TCP # transmission control protocol
udp 17 UDP # user datagram protocol
ddp 37 DDP # Datagram Delivery Protocol
> Firewall can decide on the port but examining
> the port source/address of tcp and udp.
> For instance if you want to deny or accept ddp you should block/accept
> tcp/udp arriving on port 37.
TCP/UDP port 37 is the "time" protocol. DDP is IP protocol 37.
--
Glynn Clements <glynn.clements@virgin.net>
### end of message body ########################
X-DCC-Etherboy-Metrics: setcom.riscom.net 1002; bulk Body=116 Fuz1=116
Fuz2=116
checksum server
IP: 3e7e139e f6504a8c bc4e9b73 5d1440bc
env_From: e9a921a6 386b9f30 0d8504c4 3566c63a
From: ae31e18d a48ef900 4868ad3f 0fc3ed40
Message-ID: 21efb874 fe794d26 2809637d 96d69da6
Received: 152f2eb9 fb30ae43 f936581b 028c7c01
Body: 76c56ecd f51959fa c9ea1e8c d4486eda 115
Fuz1: 4dc07bf3 100b36e8 a8f2698d f8b10bad 115
Fuz2: a7ef1239 80f64288 98b01984 bf489482 115
rejection message: 550 5.7.1 mail h4EFUht8006998 from ::ffff:195.138.96.90
rejected by Etherboy DCC
result: reject
my config
#! /bin/sh
# set parameters for DCC start and cron scripts
# from Rhyolite Software DCC 1.1.36-1.29 $Revision$
DCC_CONF_VERSION=3
# don't set DCC_HOMEDIR since if we got here, it must be set
DCC_LIBEXEC=/var/dcc/libexec
DCC_RUNDIR=/var/run/dcc
DCCUID=root
# SRVR_ID must be set to run dccd. Do not set it if you do not
# want to run the DCC server. DCC server-IDS must be globally unique
# in a network of cooperating DCC servers.
SRVR_ID=
BRAND=
# optionally set to something like "local5" or "local5.notice" for
# dccd, dbclean, and dccm
DCC_INFO_LOG_FACILITY=local5
DCC_ERROR_LOG_FACILITY=local5
# used to start dccm
DCCM_ENABLE=on
# a common value is
# DCCM_ARGS="-SHELO -SX-Habeas-SWE-3 -Smail_host -SSender -SList-ID"
DCCM_ARGS="-a REJECT -t CMN,5,15"
DCCM_LOGDIR=log
DCCM_WHITECLNT=whiteclnt
DCCM_USERDIRS=userdirs
# set DCCM_LOG_AT to a number that determines "bulk mail" for your situation.
# 50 is a typical value.
# Leave DCCM_REJECT_AT blank until you are confident that most sourced of
# solicited bulk mail have been white-listed. Then set it to the number
# that defines "bulk mail" for your site. Note that this rejection
# or "bulk" threshold does not affect the blacklisting effects of the
# DCCM_WHITECLNT white list file.
# Add '-aIGNORE' to DCCM_ARGS to ignore the bulkiness of mail except to
# add X-DCC headers.
DCCM_LOG_AT=200
DCCM_REJECT_AT=200
# override basic list of checksums controlling rejections or logging
DCCM_CKSUMS=
# additional checksums worthy of rejections or logging
DCCM_XTRA_CKSUMS=
# used to start dccd
DCCD_ENABLE=on
# A value for `dccd -t` computed from DCCM_REJECT_AT is assumed to set
# default flooding threshold.
DCCD_ARGS=
# used to start dccifd
DCCIFD_ENABLE=on
# a common value is
# DCCIFD_ARGS="-SHELO -SX-Habeas-SWE-3 -Smail_host -SSender -SList-ID"
DCCIFD_ARGS=
DCCIFD_LOGDIR="$DCCM_LOGDIR"
DCCIFD_WHITECLNT="$DCCM_WHITECLNT"
DCCIFD_USERDIRS="$DCCM_USERDIRS"
DCCIFD_LOG_AT="$DCCM_LOG_AT"
DCCIFD_REJECT_AT="$DCCM_REJECT_AT"
# override basic list of checksums controlling rejections or logging
DCCIFD_CKSUMS="$DCCM_CKSUMS"
# additional checksums worthy of rejections or logging
DCCIFD_XTRA_CKSUMS="$DCCM_XTRA_CKSUMS"
# days to keep files in DCC log directories
DBCLEAN_LOGDAYS=14
# used to start dbclean, including -e and -E
DBCLEAN_ARGS=
# ensure that the log facilities include levels and that $DCC_LOGGER
# has a default.
if test ! -z "$DCC_INFO_LOG_FACILITY"; then
if expr "$DCC_INFO_LOG_FACILITY" : '.*\..*' >/dev/null; then
:
else
DCC_INFO_LOG_FACILITY="$DCC_INFO_LOG_FACILITY.notice"
fi
DCC_LOG_ARGS="$DCC_LOG_ARGS -Linfo,$DCC_INFO_LOG_FACILITY"
fi
if test -z "$DCC_ERROR_LOG_FACILITY"; then
# for $DCC_LOGGER
DCC_ERROR_LOG_FACILITY=mail.err
else
if expr "$DCC_ERROR_LOG_FACILITY" : '.*\..*' >/dev/null; then
:
else
DCC_ERROR_LOG_FACILITY="$DCC_ERROR_LOG_FACILITY.err"
fi
DCC_LOG_ARGS="$DCC_LOG_ARGS -Lerror,$DCC_ERROR_LOG_FACILITY"
fi
DCC_LOGGER="logger -s -p ${DCC_ERROR_LOG_FACILITY-mail.err} -t DCC"
More information about the DCC
mailing list
