Date: Wed, 24 Sep 2003 17:15:27 -0500 From: Kirk Strauser <kirk@strauser.com> To: freebsd-stable@freebsd.org Subject: I've had enough. I'm starting a DNS blackhole list. Message-ID: <8765jhg7eo.fsf@strauser.com>
next in thread | raw e-mail | index | archive | help
--=-=-=
Content-Transfer-Encoding: quoted-printable
Yep, I really am. From now on, any system that relays a virus-laden email
to my system is going into a DNS blackhole list serving all of the systems I
administer. In a fit of "had it up to here"-ness, I've written the
following programs today:
dnsbl:
Adds authorized users to a PostgreSQL database.
Allows authed users to add virus/worm/trojan categories.
Allows authed users to add a specified host to the PostgreSQL
database, along with the offending category that it falls into and an
expiration time. Also pushes updates to a BIND 9 server supporting
dynamic updates via TSIG authentication.
Supports a "cleanup" mechanism (run via cron) that deletes expired
entries from the PostgreSQL database and the BIND 9 server.
searchreceived:
Scans a mail on STDIN for the first Received: header that isn't a
machine on my network or on of my relays.
slurpworms:
Calls "fetchmail" to grab all new messages from my "viruses" folder,
pipes them through "searchreceived", and dumps the results into "dnsbl".
Really, I can't take it anymore. I've received over 40,000 emails from
infected machines, and I'm fighting back. Once I've verified correct
functionality, I'll start allowing zone ixfrs from anyone who wants to chip
in, and I'm setting up a web form to accept new submissions from authorized
users (see the "auther users" entries under "dnsbl").
This is ridiculous. I'm about "this close" to setting Sendmail to bouncing
all blackholed emails to "abuse@microsoft.com".
=2D-=20
Kirk Strauser
"94 outdated ports on the box,
94 outdated ports.
Portupgrade one, an hour 'til done,
82 outdated ports on the box."
--=-=-=
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQA/cheE5sRg+Y0CpvERApvoAKCClMsARS7EmEH8HcSLikKopYLpYgCcDIrU
M+C3wocypdp+2xQwN4X4k8E=
=V23l
-----END PGP SIGNATURE-----
--=-=-=--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8765jhg7eo.fsf>