[speex-dev] Re: mail bounces

[Ralph Giles]

On Sun 21 Mar 2004 - 02:58:46 EST - James Couzens wrote:

> Mail coming from motherfish-II.xiph.org is likely getting dropped due to
> the following (which I pulled out of the headers of a piece of mail
> after wondering where all my speex email suddenly disappeared off to:
> 
> 2.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server -
> [198.136.36.245 listed in dnsbl.sorbs.net]
> - this isn't any good either

This is the only entry in the database. The appear to have found an ftp 
server on port 8021 and concluded we were compromised. This is the port 
used by zope(.org) for ftp access. We were running zope in the past, but 
aren't using it actively and it's not currently listening on that port.

Since the helo string they quote lists a zope component, that's probably 
what we saw, though it's always possible we've been compromised. 
Certainly their test is broken if running a private ftp server is enough 
to get you on the list. More collateral damage in the email wars.

I've requested a retest, which should get us off the list.

> and of less importance, but to raise awareness to those of you who
> aren't aware of SPF (SMTP Anti-Forgery - http://spf.pobox.com) xiph
> isn't publishing SPF records, which I would advise perhaps looking in
> to.

Sometimes forgery is useful. Otherwise it's a nice idea.

 -r


--
Ralph Giles
Xiph.org sysadmin
--- >8 ----
List archives:  http://www.xiph.org/archives/
Ogg project homepage: http://www.xiph.org/ogg/
To unsubscribe from this list, send a message to 'speex-dev-request at xiph.org'
containing only the word 'unsubscribe' in the body.  No subject is needed.
Unsubscribe messages sent to the list will be ignored/filtered.