Spam RBL´s & stuff
|
Dec 26, 2007, 11:51 AM
|
|
|---|---|
rodo Member Join: Nov 2007 Posts: 32 |
Spam RBL´s & stuff Hi everyone! I´m wondering which RBL´s are you using or recomend? While surfing on the issue I found some threads regarding this topic, but they are quite old. And besides RBL, SPF and Spamassasin, are there any other tools to lower the spam? Thanks in advance! |
|
Dec 27, 2007, 04:10 AM
|
|
|---|---|
Penguin-uk Senior Member Join: Nov 2007 Posts: 309 |
Spamcop & Spamhaus are very reliable. You can implement this as follows: pico -w /usr/lib/opcenter/sendmail/install/sendmail.mc Look for the following line: FEATURE(`blacklist_recipients')dnl Add the following above it: FEATURE(dnsbl, `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?" $&{client_addr}')dnl FEATURE(dnsbl, `sbl-xbl.spamhaus.org', `"Spam blocked see: http://www.spamhaus.org/query/bl?ip=" $&{client_addr}')dnl ie: Code:
m4 /usr/lib/opcenter/sendmail/install/sendmail.mc > /etc/mail/sendmail.cf Restart sendmail to make this effective: service sendmail restart NB: after posting this the forum is wrapping the lines of code - the FEATURE commands are the start of the lines. I've uploaded a text file as well with the code as wrapped lines will cause an issue. __________________ Penguin Internet Ltd - http://www.penguin-uk.com Web Design, UK Web Hosting, Dedicated Servers. Ensim/Parallels Pro Server Specialists - Upgrades & Migrations, Ensim/Parallels Pro Licences & Server Management |
|
Jan 8, 2008, 02:31 AM
|
||
|---|---|---|
Fishstick Member Join: Nov 2007 Posts: 86 |
(Long post ahead.) Other than RBL's, there some more things you can do to block spam at the sendmail level: Connection Rate control This will enable a simple ruleset to do connection rate control checking. You can set a window (45s in this case) and then define the maximum amount of connections and connection attempts in that window’s time. Code:
ClientRate: 10 ClientRate:127.0.0.1 0 ClientRate:69.69.69.69 2 In this case, the default limit is 10 connections / 45s. Localhost (for webmail, for example) has no limit. A ficticious IP adress of a spammer or an odd domain is limited to 2 connections every 45s. BAD_RCPT_THROTTLE will drop the connection if the sender specified more than 5 nonexisting recipients. greet_pause will introduce a small pause before displaying your SMTP server’s banner. Any mailserver that tries to input commands or data before the banner is displayed should be disconnected, as any half-decent RFC compliant server should wait for the banner. We’re also not accepting any mail from domains that don’t resolve (why would you?). Greetpause is a minimal setting that will cause virtually no issue for your users and will eliminate an amazing amount of spam. Like ClientRate you can whitelist hosts/IP’s for greetpause as well in access.db Code:
Additionally, I tweaked a few timeout settings. The defaults for some of these values are ridiculously high, resulting in a lot of stale connections. This is nice in combination with DNSBL’s as killed connections will get freed up fairly soon. Code:
Code:
Quote:
__________________ --- [url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS [url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon) AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email] |
|
|
Feb 12, 2008, 10:04 PM
|
|
|---|---|
herbertjoei Junior Member Join: Jan 2008 Posts: 17 |
oh wow! this is very very helpful. I will try this out now but.. how will I know if this is effective? Where can i get to see stats like you posted? |
|
Feb 12, 2008, 10:37 PM
|
|
|---|---|
herbertjoei Junior Member Join: Jan 2008 Posts: 17 |
By the way, I read this http://www.technoids.org/dossed.html#1.1. should i add terminate on the ratecontrol feature? |
|
Feb 14, 2008, 04:04 AM
|
|
|---|---|
Fishstick Member Join: Nov 2007 Posts: 86 |
Yeah, i forgot to add that here. If you don't add terminate, it's essentially up to the connecting server to close. The extra timeout options however should gracefully close mailservers that keep spamming bad commands or try and keep "empty" connections open. The stats is a ghetto shellscript I run daily, based on the logged error messages. If you use the exact same RBL config like above (though I hope you don't refer to the same page!) you can get base stats just doing "grep Rejected /var/log/maillog | wc -l" which will show the number of DNSBL based rejects, and "grep pre-greeting /var/log/maillog | wc -l" will show you the GreetPause rejects. __________________ --- [url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS [url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon) AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email] |
|
Feb 17, 2008, 06:47 PM
|
|
|---|---|
herbertjoei Junior Member Join: Jan 2008 Posts: 17 |
Hi, I was hoping I could use the same page hahaha.. anyway, i'll make one for my own then. The stats you posted though i thought was a script or something you used to come up with it.. did you do that from just grep? Thanks! |
|
Feb 17, 2008, 09:32 PM
|
|
|---|---|
herbertjoei Junior Member Join: Jan 2008 Posts: 17 |
I'm getting several of this error when I use the RBL posted by fishstick but if i use the one posted by pengiun it's working: /usr/share/sendmail-cf/feature/enhdnsbl.m4:33: m4: Warning: Excess arguments to built-in `len' ignored I'm on Enxim X 10.3 RHEL 4 |
|
Feb 18, 2008, 01:58 AM
|
|
|---|---|
Fishstick Member Join: Nov 2007 Posts: 86 |
That's a warning, not an error. You're getting that because you probably didn't change the return string (ie: "550 Rejected: IP blocked for Policy Reasons, see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}',). which is "too long" for m4. However even with that warning everything will be rejected fine and they will get the right error message __________________ --- [url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS [url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon) AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email] |
|
Feb 18, 2008, 03:31 AM
|
|
|---|---|
herbertjoei Junior Member Join: Jan 2008 Posts: 17 |
I jsut noticed that the DNSBL server are basically just three... zen.spamhaus, njabl and spamcop.. why do you have different entries for them? because of the error/result codes? |
|
Feb 19, 2008, 01:53 AM
|
|
|---|---|
Fishstick Member Join: Nov 2007 Posts: 86 |
Yes, because I'm anal about returning useful error messages. You can just use zen.spamhaus.org with dnsbl instead of enhdnsbl, but I like returning different messages depending on the reason of blocking.
__________________ --- [url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS [url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon) AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email] |
|
Feb 28, 2008, 01:33 PM
|
|
|---|---|
skywalllker Member Join: Mar 2002 Posts: 41 |
Thanks for the useful tips Fishstick! Will implement it to my server :-) |
|
Mar 5, 2008, 05:29 AM
|
|||||
|---|---|---|---|---|---|
Fishstick Member Join: Nov 2007 Posts: 86 |
I got some response about this post, as some ensim's sendmail.mc won't work out of the box with all the additions posted above. For those wanting a simple ensimfriendly setup, I just used this on a fresh box (since the .mc above is taken from a sendmail based spamfilter relay): Code:
Quote:
Quote:
Quote:
You can blacklist domains in /etc/mail/access . There's a couple of domains I always have in there, that cut down on a buttload of spam: Code:
Add them in this format: Code:
Last, but not least, you can also block backscatter. While there are dnsbl's that list backscatterers, most of them also block a lot of legit networks. I do subject matching to filter out any and all DSN (Delivery status notifications) that don't originate locally, or are - for example - Barracuda type spam bounces (eg. "Mail sent by you blocked by our bulk email filter"). BE AWARE HOWEVER, that this can break return and read-receipts, and you are technically breaking RFCs since DSN's should always be delivered. However, like batch SMTP and open relay, this is being exploited by spammers to the point of near-non-usability. Code:
Quote:
__________________ --- [url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS [url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon) AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email] |
||||
|
Mar 6, 2008, 06:35 PM
|
|
|---|---|
TheVampmaster Junior Member Join: Mar 2008 Posts: 1 |
thanks. It was a great solution. thanks |
|
Mar 21, 2008, 08:37 AM
|
||
|---|---|---|
axelko Junior Member Join: Feb 2008 Posts: 22 |
Fishstick, Thank you for your recommadations, I just implemented then. I only had a problem with sending emails via a domain on the server. I just did trial & error (yes commented every line and rebuild sendmail.cf, restarted sendmail and checked sending mail from a clien computer) and figured out that spamhaus and confTO_IDENT gave problems for me sending mail. So just left out the following lines and now smtp via a domain on my server works ok. Quote:
Greetz, Axel |
|
|
Jan 8, 2009, 04:05 AM
|
|
|---|---|
cepheid Senior Member Join: Nov 2008 Posts: 247 |
I'm interested in trying to implement this on my Ensim 10.3.0, CentOS 5.0 box... but I notice that when I run m4 on /usr/lib/opcenter/sendmail/install/sendmail.mc, it's not the same as the existing /etc/mail/sendmail.cf ... specifically, the new file is missing all of the KsiteN_a, KsiteN_u, and KsiteN_g lines (one for each virtual host on the server). I presume that Ensim adds these lines to /etc/mail/sendmail.cf during site maintenance or site creation, but since they are not in the new file that m4 outputs, how do I ensure that the lines are put back into the new file I create? (I receive over 500 spam emails per day in my personal box alone, and while SpamAssassin is pretty good at identifying the spam, I'd rather just keep from having it even delivered, so the solution in this thread seems perfect... as long as I know what I'm doing, which I'm not sure I do!) |
|
Jan 16, 2009, 05:28 PM
|
|
|---|---|
cepheid Senior Member Join: Nov 2008 Posts: 247 |
Anyone? I'd love to implement this but I don't want to move ahead unless I know what I'm doing. |
« Previous Thread | Next Thread »
| Search this thread | Forum jump |
|---|---|
| Thread tools | Display modes |
|---|---|
|
Linear Mode
|
