Re: Sendmail Five Second Greeting Delay

On 4/1/10, Matthew Seaman wrote:

On 02/04/2010 01:51:27, Norbert Papke wrote:
When I connect to sendmail on a local interface, sendmail responds to the
connection with its "220" greeting immediately. If I connect to sendmail
from
another machine on my (home) LAN, sendmail delays five seconds before
sending
the greeting. I would like it to respond immediately.

A quick search turned up a "greet_delay" feature in sendmail that would
cause
this type of behavior. To the best of my knowledge, I do not use this
feature. Just to be sure, I tried to explicitly enable it with both a
default
0 second timeout and an explicit 0 second access rule. This did not the
resolve the issue.

For the sake of the archives, I'd like to note that the `greet_pause'
feature is actually a pretty effective and very cheap to implement
anti-spam measure. You need:

FEATURE(greet_pause, `5000')dnl ## 5 seconds

in your $(hostname).mc file -- this gives you a default 5 second delay.
If you also have

FEATURE(`access_db')

you can override that value for particular IP ranges or domain names.

This is also a handy addition to the .mc file:

LOCAL_RULESETS
SLocal_greet_pause
R$* $: $&{daemon_flags}
R$* a $* $# 0

This turns off greet_pause on network ports where authentication is
required, ie. if you use port 587 for submitting new mail and reserve
port 25 for MTA to MTA mail transfers.

The way this works is that it requires the sending side to wait until
your system prints out the greeting banner. If the sending side starts
speaking before then, sendmail will refuse to accept any mail during
that session. All real MTAs will get this right, as it is part of the
SMTP specification in the RFCs. Many spambots on the other hand, send
e-mail by simply replaying one side of a recorded SMTP conversation
without reguard for what the other side says. This feature weeds out
that sort of spambot with very little effort.

Useful reading. Two questions ...

First, I'm wondering what is logged as a result of using greet_pause when
getting slammed by a bot. Is it something along the lines of "User did
not issue...", "LA LA LA I wasn't listening", or nothing at all?

Secondly, it seems the cause of the OP's problem was a delay associated
with an IDENT query. Specificially

confTO_IDENT Timeout.ident [5s] The timeout waiting for a
response to an IDENT query.

If he had local DNS configured, there would be no query, and therefore no
issue, but setting the timeout to 0 seconds using

define(`confTO_IDENT', 0s)

does remove the delay, but not the underlying problem.

Put another way, I'm wondering why IDENT queries are made? My knowledge
of that protocol is superficial, but my understanding is that running an
identity service is widely considered a security problem. FreeBSD doesn't
run identd by default, for example, but it's possible that some Linux
distros do. The Wikipedia article suggests "It's an IRC thing", but that
doesn't address the default sendmail behavior.

Thanks.
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: sshd boot-time delay
    ... Could somebody please remind me how to get rid of the boot-time delay ... when sshd starts! ... I suspect this is something to do with sshd's relation to DNS, ... sendmail enabled on a network with crappy reverse DNS resolving ...
    (comp.unix.bsd.freebsd.misc)
  • Problems with connect and rcpt delays
    ... I have spent the day investigating settings in my sendmail config due ... to a delay of 15-30 seconds on a RCPT command. ... At first I thought it was milter-ahead that was causing the problem. ... This was mainly because I first discovered this delay ages ago when I ...
    (comp.mail.sendmail)
  • Re: very slow boot (newbie)
    ... message in response to every suggestion, but they have all helped - ... It turns out it was sendmail causing the delay, ... but it turned up the following response: ...
    (freebsd-questions)
  • Re: SMTP connection very slow
    ... We will not be able to remove the delay ... we do not mean for this sendmail to serve as a public ... connections to the sendmail SMTP port is very ... Is there any way we can disable the reverse/ forward lookup on ...
    (comp.mail.sendmail)
  • Re: Suggestions for networking book
    ... Sendmail isn't the best way to start learning how to setup an MTA, ... > tru64, HP-UX, IRIX and Linux, but my knowledge of bind, sendmail, dhcp ... Once you've understood how DNS servers and caches ... > I guess if I wanted my own MTA I'd probably not choose sendmail, ...
    (comp.unix.admin)