Spammers forging addresses for subscribe/unsubscribe

Greetings,
we used to have a situation where a spammer would do the following with qmail:
(1) spammer send a message FROM someone (forging their address) TO an invalid address on our server CONTAINING spam (2) our server sees the address is invalid (3) our server BOUNCES error message CONTAINING original message (including spam) FROM us TO the forged address (which was the apparent from address) thus making us a spam source. (Ingenious.)
Since we have moved to postfix/mailman, we are now encountering a different situation, also probably arising from spam
(1) spammer sends a message FROM someone (forged) TO a range of addresses which include the -subscribe and/or -unsubscribe address (2) mailman BOUNCES confirmation message TO forged address FOR -subscribe/unsubscribe, this may include the spam (as part of the notification) (3) sometimes, if the address is invalid (dead address), we get a bounce back saying the address is no good, which gets caught in the "uncaught bounce" cycle. (4) sometimes, if the address is valid and its to the -subscribe address, the person gets spammed.
Is there a way in mailman to do the following - and if not, I'd like to submit these ideas for implementation or adjustment (1) bounces from subscribe requests should not include the original message (2) unsubscribe requests should be dropped if they come from an address which is not a member
You can't really tell if a subscribe request is valid or not, but at least the attachments could be stripped out...
Cordially, Justin Long
-- Never retreat. Never surrender. Never cut a deal with a dragon.
Justin Long / justinlong@gmail.com http://www.strategicnetwork.org - 120,000 subscribers, 16,000 articles http://www.momentum-mag.org - bi-monthly magazine on unreached peoples http://www.momentum-mag.org/wiki - Missiopedia of Christian missions MSNIM justinlong@strategicnetwork.org / Skype nsmjustinlong
We help people build 6 things: Drive, Energy, Effort, Inspiration, Power, Strength
No armor? Unclean life? Then do not mess in the affairs of dragons, for you are crunchy and taste good with ketchup.

Justin Long wrote:
I can pretty much promise that this and other measures will be in the initial Mailman 2.2 release, but it isn't in Mailman 2.1
(2) unsubscribe requests should be dropped if they come from an address which is not a member
Interesting idea, but I can see some installations would want to send some kind of response in case it is really from a subscribe who just doesn't happen to know what their correct subscribed address is.
You can't really tell if a subscribe request is valid or not, but at least the attachments could be stripped out...
Yes, we definitely plan to not echo the message body, at least by default. However, many people feel there should be no response at all. See for example the thread beginning at <http://mail.python.org/pipermail/mailman-developers/2008-March/019804.html> and continuing into April.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Maybe some of these ideas should be controlled by configuration options to give the most flexibility?
Unsubscribe from non-member address: (1) Reply (2) Bounce to moderator (3) Discard
On Sat, Apr 19, 2008 at 11:38 AM, Mark Sapiro <mark@msapiro.net> wrote:
-- Never retreat. Never surrender. Never cut a deal with a dragon.
Justin Long / justinlong@gmail.com http://www.strategicnetwork.org - 120,000 subscribers, 16,000 articles http://www.momentum-mag.org - bi-monthly magazine on unreached peoples http://www.momentum-mag.org/wiki - Missiopedia of Christian missions MSNIM justinlong@strategicnetwork.org / Skype nsmjustinlong
We help people build 6 things: Drive, Energy, Effort, Inspiration, Power, Strength
No armor? Unclean life? Then do not mess in the affairs of dragons, for you are crunchy and taste good with ketchup.

Justin Long wrote:
I can pretty much promise that this and other measures will be in the initial Mailman 2.2 release, but it isn't in Mailman 2.1
(2) unsubscribe requests should be dropped if they come from an address which is not a member
Interesting idea, but I can see some installations would want to send some kind of response in case it is really from a subscribe who just doesn't happen to know what their correct subscribed address is.
You can't really tell if a subscribe request is valid or not, but at least the attachments could be stripped out...
Yes, we definitely plan to not echo the message body, at least by default. However, many people feel there should be no response at all. See for example the thread beginning at <http://mail.python.org/pipermail/mailman-developers/2008-March/019804.html> and continuing into April.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Maybe some of these ideas should be controlled by configuration options to give the most flexibility?
Unsubscribe from non-member address: (1) Reply (2) Bounce to moderator (3) Discard
On Sat, Apr 19, 2008 at 11:38 AM, Mark Sapiro <mark@msapiro.net> wrote:
-- Never retreat. Never surrender. Never cut a deal with a dragon.
Justin Long / justinlong@gmail.com http://www.strategicnetwork.org - 120,000 subscribers, 16,000 articles http://www.momentum-mag.org - bi-monthly magazine on unreached peoples http://www.momentum-mag.org/wiki - Missiopedia of Christian missions MSNIM justinlong@strategicnetwork.org / Skype nsmjustinlong
We help people build 6 things: Drive, Energy, Effort, Inspiration, Power, Strength
No armor? Unclean life? Then do not mess in the affairs of dragons, for you are crunchy and taste good with ketchup.
participants (2)
-
Justin Long
-
Mark Sapiro