Help Understanding how this is getting through

MiamiJack · Nov 29, 2022

Hello All,

I'm not able to stop this spammer who has been sending message via a minimum of 2 providers each time, and then we accept it never looking at the recipients SPF etc.
Any ideas on how I can stop this?

Information has been obfuscated on the MGW & Client Side info.
Client recipient side does have reject SPF settings if not from Clients IP's.

Thanks!!

Headers from Outlook

Code:

From: Client Name <Client@Client.com>
To: Client Name <Client@Client.com>
Subject: How did you feel after trying 'Dollar General'?
Thread-Topic: How did you feel after trying 'Dollar General'?
Thread-Index: AQHZBDDABwz29OlVxkm7FZTCVdkV0A==
Date: Wed, 29 Nov 2023 19:46:26 +0000
Message-ID: <GSaZUcg_k41V0ZO7owyKqkWq05NEjzbgWHE8Z8HxWorXoLJBSjz@mail.gmail.com>
Content-Language: en-US
received-spf: pass (domain of gmail.com designates 209.85.214.180 as permitted
 sender)
Content-Type: multipart/related;
    boundary="_005_GSaZUcgk41V0ZO7owyKqkWq05NEjzbgWHE8Z8HxWorXoLJBSjzmailg_";
    type="multipart/alternative"
MIME-Version: 1.0

kalachev_89 · Nov 29, 2022

Hi.
SPF records check Return-Path record, not field From. We don't see original message, so i think in return-path we can see not Client@Client.com address.
If i correct understand your situation, you want block selfsend-messages, from Client@Client.com to Client@Client.com. In my case, i created Who object with list of my domains, and created rule to block messages with this list object.

MiamiJack · Nov 30, 2022

Agreed that the from is only visual per say, and the return will have
I'm not sure that would work, because the client.com does send through our MGW for outbound, and of course receives through the gateway, I believe doing what your saying would block legit email.
Looking for something to try to tighten this up.

MiamiJack · Nov 30, 2022

My biggest issue is this gateway is the smart host per say, and sends mail for the client.com domain, so why does it accept the external imposter?

Stoiko Ivanov · Nov 30, 2022

MiamiJack said:
Spam detection results: 15

this mail has a spam-level of 15 iirc? - why not just block it based on that?

MiamiJack · Nov 30, 2022

Thanks @Stoiko Ivanov , but I'm not sure why its not blocking or quarantining...
My first question is, would be block that at the Postfix level, or simply somewhere to Quarantine do I need to change/create a rule/policy?

poetry · Nov 30, 2022

MiamiJack said:
Thanks @Stoiko Ivanov , but I'm not sure why its not blocking or quarantining...
My first question is, would be block that at the Postfix level, or simply somewhere to Quarantine do I need to change/create a rule/policy?

Can you post the log from proxmox mail gateway. It's unclear here why it's not blocking we need logs from pmg to understand that. I am guessing that is because you have too many rules and some of the rules whitelist something on this email. At least in my opinion you should try simplify your configuration instead of just adding 999x rules it will make it much easier to debug when something is not working but whatever float your boat.

MiamiJack · Nov 30, 2022

I will try to dig up the logs from mail.log.

In respect to the rules, we added the rule to match the object so we can tell which rules are providing us better results and are more effective.
We aren't whitelisting the source.

MiamiJack · Nov 30, 2022

Without trying to obfuscate everything, the message
(8F11780BB9) (rule: default-accept)

And then

Nov 29 15:25:39 mgw pmg-smtp-filter[796704]: A4F6463866ABECC2E9: sender in user (client@client.com) whitelist
Nov 29 15:25:39 mgw pmg-smtp-filter[796704]: A4F6463866ABECC2E9: accept mail to <client@client.com> (8F11780BB9) (rule: default-accept)

There is NO rule to whitelist client@client.com under mail proxy, who or what.

Of course it is under relay domains.

dcsapak · Dec 1, 2022

can you post your rule-system with 'pmgdb dump' ?
anonymized if necessary, but please in a unique manner.
such that mail "aaa" always is replaced by the same anonymized email and different from the others. same for domains, etc. please

Stoiko Ivanov · Dec 1, 2022

MiamiJack said:
Nov 29 15:25:39 mgw pmg-smtp-filter[796704]: A4F6463866ABECC2E9: sender in user (client@client.com) whitelist
Nov 29 15:25:39 mgw pmg-smtp-filter[796704]: A4F6463866ABECC2E9: accept mail to <client@client.com> (8F11780BB9) (rule: default-accept)

There is NO rule to whitelist client@client.com under mail proxy, who or what.

yes - there is no rule - but he address is listed in client@client.com user whitelist...
see https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_whitelist_overview

MiamiJack · Dec 1, 2022

Yes, the rules/objects had no reference but you were right it was in a users whitelist.
Is there something in the log that tells me it was a users whitelist or is whitelist simply all users and proxy->whitelist what is reflected when it says "whitelist"

Lastly, I know I can see the individual users whitelists from the whitelists option and then pick a user, but is there a way to see all of the emails in everyone's whitelist, command line or otherwise?

Thanks!!!

poetry · Dec 1, 2022

MiamiJack said:
Yes, the rules/objects had no reference but you were right it was in a users whitelist.
Is there something in the log that tells me it was a users whitelist or is whitelist simply all users and proxy->whitelist what is reflected when it says "whitelist"

Lastly, I know I can see the individual users whitelists from the whitelists option and then pick a user, but is there a way to see all of the emails in everyone's whitelist, command line or otherwise?

Thanks!!!

Yes from the log
Nov 29 15:25:39 mgw pmg-smtp-filter[796704]: A4F6463866ABECC2E9: sender in user (client@client.com) whitelist

I have no user whitelist so I usually see in the log only the rule that I use for whitelist:
Nov 28 10:51:16 pmg-smtp-filter[46231]: 12141763848493C9C8D: accept mail to <receiver@example.com> (CF3E7121411) (rule: AcceptList)

For Configuration - Mail proxy - Whitelist as far as I know you cannot see that some sender is whitelisted in the logs.

Administration - User Whitelist will only show you for each user I can't see how to show for all. Maybe someone else knows.
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#_quarantine_2

Stoiko Ivanov · Dec 2, 2022

MiamiJack said:
Lastly, I know I can see the individual users whitelists from the whitelists option and then pick a user, but is there a way to see all of the emails in everyone's whitelist, command line or otherwise?

you can use the API or `pmgsh` for that - get all users with entries in the lists via:
https://pmg.proxmox.com/pmg-docs/api-viewer/index.html#/quarantine/quarusers
and then the entries for that user:
https://pmg.proxmox.com/pmg-docs/api-viewer/index.html#/quarantine/blacklist
https://pmg.proxmox.com/pmg-docs/api-viewer/index.html#/quarantine/whitelist

I hope this helps!

Search

Search

Help Understanding how this is getting through

MiamiJack

Active Member

kalachev_89

Member

MiamiJack

Active Member

MiamiJack

Active Member

Stoiko Ivanov

Proxmox Staff Member

MiamiJack

Active Member

poetry

Active Member

MiamiJack

Active Member

MiamiJack

Active Member

dcsapak

Proxmox Staff Member

Stoiko Ivanov

Proxmox Staff Member

MiamiJack

Active Member

poetry

Active Member

Stoiko Ivanov

Proxmox Staff Member