On Sun 21 Mar 2004 - 02:58:46 EST - James Couzens wrote:
> Mail coming from motherfish-II.xiph.org is likely getting dropped due to
> the following (which I pulled out of the headers of a piece of mail
> after wondering where all my speex email suddenly disappeared off to:
>
> 2.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server -
> [198.136.36.245 listed in dnsbl.sorbs.net]
> - this isn't any good either
This is the only entry in the database. The appear to have found an ftp
server on port 8021 and concluded we were compromised. This is the port
used by zope(.org) for ftp access. We were running zope in the past, but
aren't using it actively and it's not currently listening on that port.
Since the helo string they quote lists a zope component, that's probably
what we saw, though it's always possible we've been compromised.
Certainly their test is broken if running a private ftp server is enough
to get you on the list. More collateral damage in the email wars.
I've requested a retest, which should get us off the list.
> and of less importance, but to raise awareness to those of you who
> aren't aware of SPF (SMTP Anti-Forgery - http://spf.pobox.com) xiph
> isn't publishing SPF records, which I would advise perhaps looking in
> to.
Sometimes forgery is useful. Otherwise it's a nice idea.
-r
--
Ralph Giles
Xiph.org sysadmin
--- >8 ----
List archives: http://www.xiph.org/archives/
Ogg project homepage: http://www.xiph.org/ogg/
To unsubscribe from this list, send a message to
'speex-dev-request@xiph.org'
containing only the word 'unsubscribe' in the body. No subject is
needed.
Unsubscribe messages sent to the list will be ignored/filtered.
