Peter Hansen's questions

I've run Postfix to host my domain's email for years now, and generally I've reduced spam to an acceptable level (including use of greylisting, SpamAssassin, and DNSBL).

One thing I've never figured out is why so many spammers attempt to send email to non-existent "hexadecimal" addresses, of the form xxxxxxxx.xxxxxxxx@mydomain or sometimes just xxxxxxxx@mydomain, where the xxxx are hexadecimal numbers.

Examples from just now:

• to=<8ac2e485@mydomain>
• to=<3b905d2d.5d0078fa@mydomain>

Since no such addresses are likely to exist, what's the point? My server refuses them with a 550 error so it's no big deal, but it seems pointless.

It's also, oddly, impossible for me to find search results indicating this affects anyone else though fairly obviously it must.

I have an Ubuntu 9.04 server running libvirt/kvm and fail2ban (for SSH attacks).

Both libvirt and fail2ban integrate with iptables in different ways. Libvirt uses (I think) some XML config and during startup (?) configures forwarding to the VM subnet. Fail2ban installs a custom chain (probably at init) and periodically modifies it to ban/unban probable attackers.

I also need to install my own rules to forward various ports to servers running in VMs and on other machines, and set up rudimentary security (e.g. drop all INPUT traffic except the few ports I want open), and of course I'd like the ability to add/remove rules safely without restarting.

It seems to me iptables is a powerful tool that's sorely lacking some sort of standardized way of juggling all this stuff. Every project, and every sysadmin, seems to do it differently! (And I think there's lots of "cargo cult" admin going on here, with people cloning crude approaches like "use iptables-save like so".)

Short of figuring out the gory details of exactly how both of these (and potentially other) tools manipulate the netfilter tables, and developing my own scripts or just manually executing iptables commands, is there any way to safely work with iptables while not breaking the functionality of these other tools? Any nascent standards or projects defined to bring sanity to this area? Even a helpful web page I missed that might cover at least these two packages together?