Parallels Forums
> More Products Discussion > Parallels Pro Control Panel > Parallels Pro Control Panel X for Linux > Services configuration  
Spam RBL´s & stuff  
  

Spam RBL´s & stuff

Dec 26, 2007, 11:51 AM
#1  

rodo
Member


Join: Nov 2007
Posts: 32
Spam RBL´s & stuff
Hi everyone!

I´m wondering which RBL´s are you using or recomend? While surfing on the issue I found some threads regarding this topic, but they are quite old.

And besides RBL, SPF and Spamassasin, are there any other tools to lower the spam?

Thanks in advance!
Dec 27, 2007, 04:10 AM
#2  
Penguin-uk's Avatar

Penguin-uk
Senior Member


Join: Nov 2007
Posts: 309
Spamcop & Spamhaus are very reliable. You can implement this as follows:

pico -w /usr/lib/opcenter/sendmail/install/sendmail.mc

Look for the following line: FEATURE(`blacklist_recipients')dnl

Add the following above it:

FEATURE(dnsbl, `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?" $&{client_addr}')dnl
FEATURE(dnsbl, `sbl-xbl.spamhaus.org', `"Spam blocked see: http://www.spamhaus.org/query/bl?ip=" $&{client_addr}')dnl

ie:

Code:
FEATURE(dnsbl, `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?" $&{client_addr}')dnl FEATURE(dnsbl, `sbl-xbl.spamhaus.org', `"Spam blocked see: http://www.spamhaus.org/query/bl?ip=" $&{client_addr}')dnl FEATURE(`blacklist_recipients')dnl
Then, rebuild your sendmail.cf with this RBL filtering now added:

m4 /usr/lib/opcenter/sendmail/install/sendmail.mc > /etc/mail/sendmail.cf

Restart sendmail to make this effective:

service sendmail restart

NB: after posting this the forum is wrapping the lines of code - the FEATURE commands are the start of the lines. I've uploaded a text file as well with the code as wrapped lines will cause an issue.
Attached Files
File Type: txt rbl.txt (222 Bytes, 234 views)


__________________
Penguin Internet Ltd - http://www.penguin-uk.com

Web Design, UK Web Hosting, Dedicated Servers. Ensim/Parallels Pro Server Specialists - Upgrades & Migrations, Ensim/Parallels Pro Licences & Server Management
Jan 5, 2008, 07:29 PM
#3  

rodo
Member


Join: Nov 2007
Posts: 32
Thanks! Works like a charm!
Jan 8, 2008, 02:31 AM
#4  

Fishstick
Member


Join: Nov 2007
Posts: 86
(Long post ahead.)

Other than RBL's, there some more things you can do to block spam at the sendmail level:

Connection Rate control
This will enable a simple ruleset to do connection rate control checking. You can set a window (45s in this case) and then define the maximum amount of connections and connection attempts in that window’s time.

Code:
FEATURE(`ratecontrol') define(`confCONNECTION_RATE_WINDOW_SIZE',`45s')dnl
Now, in access.db (/etc/mail/access, then hash it) you can add whitelists or exceptions:

ClientRate: 10
ClientRate:127.0.0.1 0
ClientRate:69.69.69.69 2

In this case, the default limit is 10 connections / 45s. Localhost (for webmail, for example) has no limit. A ficticious IP adress of a spammer or an odd domain is limited to 2 connections every 45s.


BAD_RCPT_THROTTLE will drop the connection if the sender specified more than 5 nonexisting recipients.

greet_pause will introduce a small pause before displaying your SMTP server’s banner. Any mailserver that tries to input commands or data before the banner is displayed should be disconnected, as any half-decent RFC compliant server should wait for the banner. We’re also not accepting any mail from domains that don’t resolve (why would you?).

Greetpause is a minimal setting that will cause virtually no issue for your users and will eliminate an amazing amount of spam. Like ClientRate you can whitelist hosts/IP’s for greetpause as well in access.db
Code:
define(`confBAD_RCPT_THROTTLE', `5') dnl FEATURE(`accept_unresolvable_domains')dnl FEATURE(`greet_pause', `1000')dnl
TimeOut values
Additionally, I tweaked a few timeout settings. The defaults for some of these values are ridiculously high, resulting in a lot of stale connections. This is nice in combination with DNSBL’s as killed connections will get freed up fairly soon.
Code:
define(`confTO_ICONNECT', `15s')dnl define(`confTO_CONNECT', `3m')dnl define(`confTO_HELO', `2m')dnl define(`confTO_MAIL', `1m')dnl define(`confTO_RCPT', `1m')dnl define(`confTO_DATAINIT', `1m')dnl define(`confTO_DATABLOCK', `1m')dnl define(`confTO_DATAFINAL', `1m')dnl define(`confTO_RSET', `1m')dnl define(`confTO_QUIT', `1m')dnl define(`confTO_MISC', `1m')dnl define(`confTO_COMMAND', `1m')dnl define(`confTO_STARTTLS', `2m')dnl
For RBLS I use these in my sendmail.mc:
Code:
dnl ## DNS BLACKLISTS dnl # Vanilla Spamhaus blocklist FEATURE(enhdnsbl,`zen.spamhaus.org', `"550 Rejected: IP in SpamHaus SBL, see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}', `127.0.0.2.')dnl dnl # Spamhaus Policy block (SBL): 10-11 FEATURE(enhdnsbl,`zen.spamhaus.org', `"550 Rejected: IP blocked for Policy Reasons, see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}', ,`127.0.0.10.', `127.0.0.11.')dnl dnl # Spamhaus Exploit block (XBL): 4-8 LOCAL_CONFIG C{45678}4 5 6 7 8 FEATURE(enhdnsbl,`zen.spamhaus.org', `"550 Rejected: IP in SpamHaus XBL, see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}', ,`127.0.0.$={45678}.') dnl # Spamcop BL FEATURE(`dnsbl', `bl.spamcop.net',`"554 Rejected: IP in SpamCop blacklist, see http://tuxspam.in.nl/blocked.php?ip=" $&{client_addr} "."')dnl dnl # njabl open proxies FEATURE(enhdnsbl,`dnsbl.njabl.org', `"550 Rejected: IP in NJABL (Open Proxy/Relay), see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}', ,`127.0.0.2.', `127.0.0.9.')dnl dnl # njabl formmail exploits FEATURE(enhdnsbl,`dnsbl.njabl.org', `"550 Rejected: IP in NJABL (FormMail), see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}', ,`127.0.0.8.')dnl dnl #njabl spam FEATURE(enhdnsbl,`dnsbl.njabl.org', `"550 Rejected: IP in NJABL (Spam), see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}', ,`127.0.0.4.')dnl
And finally, a long list of spammer domains that I keep a local blacklist of. This is the end result of a day:

Quote:
SpamCop : 2503
-
SpamHaus: 276437
O - Exploits: 1
O - Spam/UBE: 276436
O - Policy : 0
-
NJABL: 137
O - Proxies : 134
O - FormMail: 0
O - Spam : 3
-
LOCAL: 65547
O - RFC : 149495
O - DNSBL : 65547
O - DNames : 2
=====================
Total Blocked: 494119
Total Mails actually processed: 13108


__________________
---
[url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS
[url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon)

AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email]
Jan 10, 2008, 03:18 PM
#5  

rodo
Member


Join: Nov 2007
Posts: 32
Thanks! I´ll try those things.
Feb 12, 2008, 10:04 PM
#6  

herbertjoei
Junior Member


Join: Jan 2008
Posts: 17
oh wow! this is very very helpful. I will try this out now but.. how will I know if this is effective? Where can i get to see stats like you posted?
Feb 12, 2008, 10:37 PM
#7  

herbertjoei
Junior Member


Join: Jan 2008
Posts: 17
By the way, I read this http://www.technoids.org/dossed.html#1.1. should i add terminate on the ratecontrol feature?
Feb 14, 2008, 04:04 AM
#8  

Fishstick
Member


Join: Nov 2007
Posts: 86
Yeah, i forgot to add that here. If you don't add terminate, it's essentially up to the connecting server to close. The extra timeout options however should gracefully close mailservers that keep spamming bad commands or try and keep "empty" connections open.

The stats is a ghetto shellscript I run daily, based on the logged error messages.

If you use the exact same RBL config like above (though I hope you don't refer to the same page!) you can get base stats just doing "grep Rejected /var/log/maillog | wc -l" which will show the number of DNSBL based rejects, and "grep pre-greeting /var/log/maillog | wc -l" will show you the GreetPause rejects.

__________________
---
[url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS
[url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon)

AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email]
Feb 17, 2008, 06:47 PM
#9  

herbertjoei
Junior Member


Join: Jan 2008
Posts: 17
Hi,

I was hoping I could use the same page hahaha.. anyway, i'll make one for my own then. The stats you posted though i thought was a script or something you used to come up with it.. did you do that from just grep?

Thanks!
Feb 17, 2008, 09:32 PM
#10  

herbertjoei
Junior Member


Join: Jan 2008
Posts: 17
I'm getting several of this error when I use the RBL posted by fishstick but if i use the one posted by pengiun it's working:

/usr/share/sendmail-cf/feature/enhdnsbl.m4:33: m4: Warning: Excess arguments to built-in `len' ignored

I'm on Enxim X 10.3 RHEL 4
Feb 18, 2008, 01:58 AM
#11  

Fishstick
Member


Join: Nov 2007
Posts: 86
That's a warning, not an error.
You're getting that because you probably didn't change the return string (ie: "550 Rejected: IP blocked for Policy Reasons, see http://tuxspam.in.nl/blocked.php?ip="$&{client_addr}',). which is "too long" for m4. However even with that warning everything will be rejected fine and they will get the right error message

__________________
---
[url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS
[url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon)

AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email]
Feb 18, 2008, 03:31 AM
#12  

herbertjoei
Junior Member


Join: Jan 2008
Posts: 17
I jsut noticed that the DNSBL server are basically just three... zen.spamhaus, njabl and spamcop.. why do you have different entries for them? because of the error/result codes?
Feb 19, 2008, 01:53 AM
#13  

Fishstick
Member


Join: Nov 2007
Posts: 86
Yes, because I'm anal about returning useful error messages. You can just use zen.spamhaus.org with dnsbl instead of enhdnsbl, but I like returning different messages depending on the reason of blocking.

__________________
---
[url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS
[url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon)

AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email]
Feb 28, 2008, 01:33 PM
#14  

skywalllker
Member


Join: Mar 2002
Posts: 41
Thanks for the useful tips Fishstick! Will implement it to my server :-)
Mar 5, 2008, 05:29 AM
#15  

Fishstick
Member


Join: Nov 2007
Posts: 86
I got some response about this post, as some ensim's sendmail.mc won't work out of the box with all the additions posted above.
For those wanting a simple ensimfriendly setup, I just used this on a fresh box (since the .mc above is taken from a sendmail based spamfilter relay):

Code:
## added # remove sendmail version from banner define(`confSMTP_LOGIN_MSG', `SERVERNAME MTA, local time is $b')dnl # disable VRFY and other paranoid options define(`confPRIVACY_FLAGS', `goaway,needmailhelo')dnl # optional, I like cleaner maillogs define(`confLOG_LEVEL', `5')dnl # The odds of getting more than two bad recipients in one legit mail is pretty low define(`confBAD_RCPT_THROTTLE', `2')dnl # Not adding this can cause some formmail type scripts to get your server listed on some blacklists # due to sendmail HELO-ing with 127.0.0.1 or the sitename, instead of your servername. define(`confDOMAIN_NAME', `SERVERNAME')dnl # Port 2025 as alternative SMTP port DAEMON_OPTIONS(`Port=smtp,Port=2025, Name=MTA')dnl # Port 25 needs to be open still DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl # Accept local mail LOCAL_DOMAIN(`localhost.localdomain')dnl # Put our servername in the headers MASQUERADE_AS(`SERVERNAME')dnl dnl # timeouts define(`confTO_CONNECT', `1m')dnl define(`confTO_IDENT', `45s')dnl define(`confTO_ICONNECT', `15s')dnl define(`confTO_HELO', `1m')dnl define(`confTO_MAIL', `1m')dnl define(`confTO_RCPT', `1m')dnl define(`confTO_DATAINIT', `1m')dnl define(`confTO_DATABLOCK', `1m')dnl define(`confTO_DATAFINAL', `1m')dnl define(`confTO_RSET', `1m')dnl define(`confTO_QUIT', `30s')dnl define(`confTO_MISC', `1m')dnl define(`confTO_COMMAND', `1m')dnl define(`confTO_STARTTLS', `2m')dnl # rate control (8.12 or higher!) FEATURE(`ratecontrol') define(`confCONNECTION_RATE_THROTTLE', `100')dnl # blacklists # Greetpause. 2seconds filters out most of the chaff with little false positives FEATURE(`greet_pause', `2000')dnl # Don't allow people to SEND to blacklisted people as well FEATURE(`blacklist_recipients')dnl # vanilla errors for DNSBL FEATURE(`enhdnsbl',`zen.spamhaus.org',`"550 Rejected: " $&{client_addr} " found in SpamHaus Zen blacklist"')dnl FEATURE(`enhdnsbl',`bl.spamcop.net',`"550 Rejected: " $&{client_addr} " found in SpamCop blacklist"')dnl # we're just using NJABL for formmail and third party exploits FEATURE(`enhdnsbl',`dnsbl.njabl.org',`"550 Rejected: "$&{client_addr}' " found in NJABL blacklist",,`127.0.0.8.')dnl
While it's not recommended, I add these to /usr/lib/opcenter/sendmail/install/sendmail.mc, which is the mc ensim used to rebuild, as opposed to /etc/mail/sendmail.mc. Be sure to make a backup before you edit anything in there. Add the above block AFTER:
Quote:
FEATURE(`access_db',`hash -T<TMPF> -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
You will need to find the line:
Quote:
include(`/usr/lib/opcenter/sendmail/install/popauth.m4')
and move it to the top - or at least above this block - else you will get an "readcf: map popauth: class dnsbl " error. If you're feeling fancy or have some load issues, you might also want to change this:
Quote:
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
and remove the -t. This will cause mail sent to over-quota mailboxes to be bounced, instead of queued for 3 - 5 days.

You can blacklist domains in /etc/mail/access . There's a couple of domains I always have in there, that cut down on a buttload of spam:
Code:
## #older static-ip.oleane.fr dynamic.seed.net.tw dynamic.hinet.net pppoe.mtu-net.ru go.evo.bg dsl-w.verizon.net watf.cable.ntl.com 195.18.49 89.222 iam.net.ma tpnet.pl adsl.inetia.pl chello.pl telecomitalia.it dialup.itte.kz dial-up.telesp.net.br ttnet.net.tr 88.229 airtelbroadband.in iasi.fiberlink.ro dsl.telepac.pt ny.adsl asianet.co.th ocn.ne.jp cm.vtr.net clientes.euskaltel.es 218.95 cust.bluewin.ch dclient.lsne.ch
YMMV with what domains you wish to block, of course. I would suggest leaving ttnet.net.tr, telecomitalia, and tpnet.pl in there though.

Add them in this format:
Code:
pptp.mtu-net.ru ERROR:"571 Too many spam complaints about IP or ISP"
You can whitelist them in the same way, just replace ERROR with "OK" to make them pass checks.

Last, but not least, you can also block backscatter.
While there are dnsbl's that list backscatterers, most of them also block a lot of legit networks. I do subject matching to filter out any and all DSN (Delivery status notifications) that don't originate locally, or are - for example - Barracuda type spam bounces (eg. "Mail sent by you blocked by our bulk email filter").

BE AWARE HOWEVER, that this can break return and read-receipts, and you are technically breaking RFCs since DSN's should always be delivered. However, like batch SMTP and open relay, this is being exploited by spammers to the point of near-non-usability.

Code:
dnl # Subject check LOCAL_RULESETS F{DiscardSubs} /etc/mail/discardsubs HSubject: $>Check_Subject SCheck_Subject R$* $={DiscardSubs} $* $#discard
/etc/mail/discardsubs is a plaintext file, with the subject you wish to check for on each line. They'll be silently discarded (=dropped):
Quote:
[28894]: m25BG882028894: ruleset=Check_Subject, arg1=failure notice, relay=www2.triasite.net [66.139.79.218] (may be forged), discard
[29410]: m25BINpx029410: ruleset=Check_Subject, arg1=Returned mail: see transcript for details, relay=dutch27.digitalus.nl [193.138.157.27], discard
[29406]: m25BJ119029406: ruleset=Check_Subject, arg1=Delivery Status Notification (Failure), relay=bay0-omc2-s1.bay0.hotmail.com [65.54.246.137], discard
[30519]: m25BO880030519: ruleset=Check_Subject, arg1=Returned mail: see transcript for details, relay=mx02.anchor.net.au [202.4.234.229], discard
[30621]: m25BOXHb030621: ruleset=Check_Subject, arg1=Delivery Status Notification (Delay), relay=py-out-1112.google.com [64.233.166.180], discard
[32600]: m25BaoFi032600: ruleset=Check_Subject, arg1=Return receipt, relay=smtp-vbr6.xs4all.nl [194.109.24.26], discard
Hope this helps. I hate spam, you see

__________________
---
[url=http://pixelfish.be]PixelFish[/url] - Practical guides to Ensim and CentOS
[url=http://fuxpam.be]fuxpam[/url] - A guide to the free, alternative spamfilter relay aimed at ISPs and hosting providers. (coming soon)

AIM: breadedfishstrip | MSN: [email]fishstick_@hotmail.com[/email]
Mar 6, 2008, 06:35 PM
#16  

TheVampmaster
Junior Member


Join: Mar 2008
Posts: 1
thanks.
It was a great solution.

thanks
Mar 21, 2008, 08:37 AM
#17  

axelko
Junior Member


Join: Feb 2008
Posts: 22
Fishstick,

Thank you for your recommadations, I just implemented then. I only had a problem with sending emails via a domain on the server. I just did trial & error (yes commented every line and rebuild sendmail.cf, restarted sendmail and checked sending mail from a clien computer) and figured out that spamhaus and confTO_IDENT gave problems for me sending mail.
So just left out the following lines and now smtp via a domain on my server works ok.
Quote:
define(`confTO_IDENT', `45s')dnl

FEATURE(`enhdnsbl',`zen.spamhaus.org',`"550 Rejected: " $&{client_addr} " found in SpamHaus Zen blacklist"')dnl
BTW I use the dutch cablefirm chello.nl (upc) to connect to the internet.

Greetz,

Axel
Jan 8, 2009, 04:05 AM
#18  

cepheid
Senior Member


Join: Nov 2008
Posts: 247
I'm interested in trying to implement this on my Ensim 10.3.0, CentOS 5.0 box... but I notice that when I run m4 on /usr/lib/opcenter/sendmail/install/sendmail.mc, it's not the same as the existing /etc/mail/sendmail.cf ... specifically, the new file is missing all of the KsiteN_a, KsiteN_u, and KsiteN_g lines (one for each virtual host on the server).

I presume that Ensim adds these lines to /etc/mail/sendmail.cf during site maintenance or site creation, but since they are not in the new file that m4 outputs, how do I ensure that the lines are put back into the new file I create?

(I receive over 500 spam emails per day in my personal box alone, and while SpamAssassin is pretty good at identifying the spam, I'd rather just keep from having it even delivered, so the solution in this thread seems perfect... as long as I know what I'm doing, which I'm not sure I do!)
Jan 16, 2009, 04:35 PM
#19  

nims
Member


Join: Aug 2008
Posts: 35
Love this post! Quite easy to install, and killing a lot of spam.

Any ideas if it gets killed when the box is updated with a new PPCP release?
Jan 16, 2009, 05:28 PM
#20  

cepheid
Senior Member


Join: Nov 2008
Posts: 247
Quote:
Originally Posted by cepheid View Post
I presume that Ensim adds these lines to /etc/mail/sendmail.cf during site maintenance or site creation, but since they are not in the new file that m4 outputs, how do I ensure that the lines are put back into the new file I create?
Anyone? I'd love to implement this but I don't want to move ahead unless I know what I'm doing.


12>

Thread tools Display modes
Linear Mode