Whitelist

[Glenn Steen]

On 19/12/06, Wayne <wjohns at balita.ph> wrote:
> Hi
>
> Compliments of the season to all on the list.
>
> In logwatch I am seeing many instances where something is show as whitelisted:
>
> For example:
>
> Message kBIBvLqI013726 from 72.130.65.233
> (summerliness at rushcliffedirect.com) is whitelisted : 1 Time(s)
>
> I have very few actual entries in the whitelist file - could it be
> that these items are specifically addressed to a name on the
> whitelist causing it to be highlighted as whitelisted.
>
> - Wayne -

Hi Wayne,

Are you by any chance whitelisting by (envelope) email address only (in MS)?
That is inherently "unsafe", since that can easily be spoofed.
Either use IP address of sender server, a combination of
sender/recipient (limits the effects a bit at least), or move the
whitelisting into SA (or similar, where you can use a couple of
different methods to assign different negative point values).

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se