Root on Sendmail

[adrenaline]

Hey sendmail admins. I need a suggestion on what to do with the root account. I am getting spammed hard on the root account. It is hard to defend this because once they figure out it is a Linux server then they know there is a root account. I get so many spams it is hard to pick out the logwatch mails.

What do you do?

Mike

[richiefrich]

Install a spam filter

I use Spambayes
but theres also the other favorite
Spamassassin

then dont forget you'll need a mail sorter I use procmail

Hope that help.

Or make alias then your root won't be getting the mail

[adrenaline]

I do use spamassassin, but it isn't enough. How would the alias work the same mail would now come to an alias account right?

I was hoping I could filter by subject to the root account that would only accept email with a certain subject line. Is there any way to do that in sendmail?

Then have all other email /null

[Roxoff]

The way I do it is to use real time black lists - this is a bit severe though. You could always remove (or rename) the root account and let em all bounce.

[adrenaline]

The way I do it is to use real time black lists

Can you explain more on this? How do I set this up?

[Roxoff]

Yeah, I added these lines to my M4 config file for sendmail:

FEATURE(`blacklist_recipients')dnl
FEATURE(dnsbl,`cbl.abuseat.org',` Mail from $&(client_addr) rejected: see http://cbl.abuseat.org')dnl
FEATURE(dnsbl,`relays.mail-abuse.org',` Mail from $&(client_addr) rejected; see http://www.mail-abuse.org/rss/')dnl

There are other real-time black hole references you could use, too.