[Mailman-Users] Preventing spam to list owners

[Mark Sapiro]

Gary Spivey wrote:

>My lists are locked down to only allow posts from members, so my members
>are not getting any SPAM. However, as list owner, every one of my lists
>is getting a large amount of SPAM - generally sent to the listname-owner
>or to mailman-owner. My maillog entry looks like this:
>
> 
>
>Sep 23 10:39:34 hostname sendmail[17245]: l8NHdYwF017244:
>to="|/usr/lib/mailman/mail
>
>/mailman owner mailman", ctladdr=<mailman-owner at my.domain.com> (8/0),
>delay
>
>=00:00:00, xdelay=00:00:00, mailer=prog, pri=140071, dsn=2.0.0,
>stat=Sent


This message was sent to the mailman-owner address. It could have been
sent directly there or it could be a Mailman generated notice. If the
latter, it will look like a notice, I.e. it will have a subject like
"listname post from a at example.com requires approval" or "Uncaught
bounce notification" and will be a multipart message with the original
spam in a separate part.

If this is just a straight spam, it was sent by the spammer to the
mailman-owner address. It could also be the result of spam sent to
some remote address which spoofed the mailman-owner address as the
sender and got bounced back to mailman-owner by the remote server.


>Sep 23 10:39:35 hostname sendmail[17247]: l8NHdZV9017247:
>from=<mailman-bounces at my
>
>.domain.com>, size=2069, class=-60, nrcpts=1,
>msgid=<mailman.23.1190569172.40
>
>86.mailman at my.domain.com>, proto=ESMTP, daemon=Daemon0,
>relay=localhost.loc
>
>aldomain [127.0.0.1]


This is a Mailman generated message-id for a notice from the 'mailman'
list, so it is a Mailman notice, but I don't think it is the same
message as the first one because it has a different sendmail id.


>Does anyone know how to best stop these? Are these SPAM's coming from
>the outside direct to the e-mail address,


If they just look like spam, then yes, they are coming directly to the
-owner address.



>or are they somehow going
>through mailman? If the latter, can I stop it in mailman somehow? If the
>former, does somebody have a recommended way to stop them? I have a SPAM
>filter running on my end system, but I am just tired of the constant
>flow of SPAM. 


I use spamassassin with a pretty low threshold, but there is so much
volume that the 5% that gets through is a bunch. I wish I had a better
solution.

-- 
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan