Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - whitelist issues
  FAQ FAQ  Forum Search   Register Register  Login Login

whitelist issues

 Post Reply Post Reply
Author
Terry View Drop Down
Senior Member
Senior Member


Joined: 06 February 2005
Status: Offline
Points: 155
Post Options Post Options   Thanks (0) Thanks(0)   Quote Terry Quote  Post ReplyReply Direct Link To This Post Topic: whitelist issues
    Posted: 30 March 2011 at 4:13pm

I read where the whitelist is no longer the first filter being checked by spamfilter...this appears to be causing some issues with our users....please tell me if this is true...

sender "a" is whitelisted (from same mailserver as "sender b"
sender "b" is not whitelisted (but uses the same mailserver as "sender a")
 
sender "b" sends an email to my account but the ip address he is sending from is blacklisted by "SpamCop" for example...does this add an entry to the "Cached IP blacklist"?  Because if it does this would explain to me why we are finding that sender "a" is now being blocked even though they are whitelisted....
 
if this is the case....this is causing a real problem for us
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2011 at 9:00pm
Terry,

We keep a list of the order in which SpamFilter's filters are processed at:
http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6726
Please note that this order has never changed, and that the "Cached IP blacklist" has always taken precedence over all other whitelists since its inception. This is because this filter (along with the greylist filter) work at a TCP level even before any SMTP sessions get established. Without an SMTP session, SpamFilter cannot know the email address of the recipient and thus can't apply the whitelists.

I've added a note at the bottom of those postings today to highlight a workaround that allows to have some remote sender's IP addresses bypass those two filters as well.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Terry View Drop Down
Senior Member
Senior Member


Joined: 06 February 2005
Status: Offline
Points: 155
Post Options Post Options   Thanks (0) Thanks(0)   Quote Terry Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2011 at 2:38pm
Roberto, what clear the blacklist ip cache then...does a server reboot reset it?  How do things get off this list?
Back to Top
Terry View Drop Down
Senior Member
Senior Member


Joined: 06 February 2005
Status: Offline
Points: 155
Post Options Post Options   Thanks (0) Thanks(0)   Quote Terry Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2011 at 4:10pm
Another followup..is the cache you reference as first to check the same as the file HoneypotBlockedIPS.txt.....is this what you check first....I am thinking that my file is about 5 years old and maybe I should flush it and start again?
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2011 at 9:08pm
Originally posted by Terry Terry wrote:

Roberto, what clear the blacklist ip cache then...does a server reboot reset it?  How do things get off this list?
SpamFilter maintains the blacklist cache in memory only - nothing is cached to files. To reset it, you can simply stop/restart SpamFilter. You can also use SpamFilter to see the list of IPs that are currently being blacklisted by following the screenshot below.

As an FYI, SpamFilter uses the following parameters to determine when an IP is added to this blacklist cache, and for how long it remains there (by default only one hour):

;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted)

IPCacheLimboCountTrigger=3

 

;If an IP sends more than a certain number of spams (default 3 from above) during this number of minutes then it is temporarily banned (blacklisted)

IPCacheLimboTimeTrigger=10

 

;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes

IPCacheBlacklistDuration=60





Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 31 March 2011 at 9:13pm
Originally posted by Terry Terry wrote:

Another followup..is the cache you reference as first to check the same as the file HoneypotBlockedIPS.txt.....is this what you check first....I am thinking that my file is about 5 years old and maybe I should flush it and start again?

The "HoneypotBlockedIPS.txt" is a file that is used if you enable the honeypot filter (which is likely disabled in your case - this is the default setting). This file is semi-unrelated to the "DoNotAddIPToHoneypot" setting in the SpamFilter.ini file. This latter .ini setting is used to, in addition to avoiding IPs to be blacklisted by the honeypot filter (which you probably have disabled), also used to prevent IPs from being blocked by blacklist cache and the greylist filters.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.062 seconds.