SpamBlocker-Powered exim.conf, Version 4

Dnmax said:
been using this mode last 2 months and results are good, apart from the aggressive rules pointed out by @derevko rest of it is pretty safe. Removing aggressive rules and adding custom rules for ISP's that send spam will avoid false positives.
Click to expand...
I'm not sure if I want to be bothered with separate ISP custom rules; ISPs can change over time. How about just leaving out those aggressive rules completely? Will the remainder help?

Jeff
 
just to mention that njabl.org doesn't exist anymore and should be removed from then default spamblocker.
like said here...

March 1, 2013: NJABL is in the process of being shut down. The DNSBL zones have been emptied. After "the Internet" has had some time to remove NJABL from server configs, the NS's will be pointed off into unallocated space (192.0.2.0/24 TEST-NET-1) to hopefully make the shutdown obvious to those who were slower to notice.
Click to expand...

http://www.njabl.org/
 
Just a little question, since I'm not that good in Exim acl's.
Code: 
       domains = +use_rbl_domains
       domains = !+skip_rbl_domains
What's the difference between those two lines?
Or better... what does the ! mean?
 
Aren't both lines contradictory then?
Or is the second line even needed? I would like to understand the working and why there are two lines, because in the standard exim.conf (spamblocker 2.0), the second line isn't present in any rbl list statement. Which makes me curious why.
 
Traditionally /etc/virtual/use_rbl_domains is a symlink to /etc/virtual/domains, thus you can not disable RBL checks for a single domain (if you still want to handle MX records for it on directadmin powered server), if you are using spamblocker 2.x.

In SB 4, the issue is solved, so you can add any domain in skip_rbl_domains list, and that's it.
 
Nerigal said:
just to mention that njabl.org doesn't exist anymore and should be removed from then default spamblocker.
Click to expand...
Thanks for bringing this to my attention; I'll remove it from my masters and from the servers for which I have a monthly maintenance contract within the next day or two. And to any servers I've installed as a one-time service within the last month.

Jeff
 
Hi, it's me again. Spamblocker is doing its thing pretty nicely in the past week. There are only a few .ru spam messages coming through, and the log messages I receive from my NAS are actually blocked. I have black-/whitelisted them in spamassassin, but since I've been running Spamblocker, it seems like spamassassin has become a bit useless. Is there a way to use the spamassassins lists in DA (and maybe connect spamassassin tot spamblocker?

I've already uncommented the spamblocker option:
#EDIT#50:
spamcheck_director:
driver = accept
condition = "${if and { \
{!def:authenticated_id} \
{!def:h_X-Spam-Flag:} \
{!eq {$received_protocol}{spam-scanned}} \
{!eq {$received_protocol}{local}} \
{exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
{<{$message_size}{100k}} \
} {1}{0}}"
retry_use_local_part
transport = spamcheck
no_verify

Eric
 
I was going to implement your exim config file, and had it loaded in a tab in my browser. I got to my computer today and reloaded my browser, and those exim config pages are now all gone. I am unable to find a new link to them. Did you discontinue this? :(
 
I'm encountering a big problem. One of my user accounts is being HAMMERED with "Mail delivery failed:" email messages. I'm 99.9% certain that the original messages that are causing these "Mail delivery failed" notifications are NOT originating from my client's network or from my DA server. Instead, I think the messages are being kicked to my client's account because his email address is being used as the originating "from" user. Here's a snippet of my mainlog file:

2013-06-03 12:06:14 1UjXGv-0003Ls-MC <= <> H=host002.host.iteam.ua (hosting.iteam.lg.ua) [194.146.134.2] P=esmtps X=TLSv1:AES256-SHA:256 S=6634 [email protected] T="Mail delivery failed: returning message to sender" from <> for [email protected]
2013-06-03 12:06:14 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGv-0003Ls-MC
2013-06-03 12:06:14 1UjXGv-0003Ls-MC => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=6731
2013-06-03 12:06:14 1UjXGv-0003Ls-MC Completed
2013-06-03 12:06:14 1UjXGv-0003Lg-Vu <= <> H=(serverhosting109.godo.co.kr) [211.233.51.109] P=esmtps X=TLSv1:AES256-SHA:256 S=6950 [email protected] T="Returned mail: see transcript for details" from <> for [email protected]
2013-06-03 12:06:14 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGv-0003Lg-Vu
2013-06-03 12:06:14 1UjXGv-0003Lg-Vu => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=7047
2013-06-03 12:06:14 1UjXGw-0003Lw-3Y <= <> H=server11.arneks.com [88.255.124.14] P=esmtps X=TLSv1:AES256-SHA:256 S=6438 [email protected] T="Mail delivery failed: returning message to sender" from <> for [email protected]
2013-06-03 12:06:14 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGw-0003Lw-3Y
2013-06-03 12:06:14 1UjXGv-0003Lg-Vu Completed
2013-06-03 12:06:14 1UjXGw-0003Lw-3Y => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=6535
2013-06-03 12:06:14 1UjXGw-0003Lw-3Y Completed
2013-06-03 12:06:15 1UjXGw-0003M3-Ug <= <> H=host002.host.iteam.ua (hosting.iteam.lg.ua) [194.146.134.2] P=esmtps X=TLSv1:AES256-SHA:256 S=6667 [email protected] T="Mail delivery failed: returning message to sender" from <> for [email protected]
2013-06-03 12:06:15 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGw-0003M3-Ug
2013-06-03 12:06:15 1UjXGx-0003M7-00 <= <> H=webmail1.posta.tim.it (fep01-svc.tim.it) [213.230.128.226] P=esmtp S=7440 id=20130603160614.BIHN6437.fep01-svc.tim.it@fep01-svc T="Mail System Error - Returned Mail" from <> for [email protected]
2013-06-03 12:06:15 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGx-0003M7-00
2013-06-03 12:06:15 1UjXGw-0003M3-Ug => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=6764
2013-06-03 12:06:15 1UjXGw-0003M3-Ug Completed
2013-06-03 12:06:15 1UjXGx-0003M7-00 => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=7537
2013-06-03 12:06:15 1UjXGx-0003M7-00 Completed
2013-06-03 12:06:15 1UjXGx-0003M9-Dm <= <> H=host002.host.iteam.ua (hosting.iteam.lg.ua) [194.146.134.2] P=esmtps X=TLSv1:AES256-SHA:256 S=6616 [email protected] T="Mail delivery failed: returning message to sender" from <> for [email protected]
2013-06-03 12:06:15 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGx-0003M9-Dm
2013-06-03 12:06:15 1UjXGx-0003M9-Dm => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=6713
2013-06-03 12:06:15 1UjXGx-0003M9-Dm Completed
2013-06-03 12:06:16 1UjXGx-0003MF-Sj <= <> H=ms.nktv.mk.ua [81.24.208.2] P=esmtps X=TLSv1:AES256-SHA:256 S=6173 [email protected] T="Mail delivery failed: returning message to sender" from <> for [email protected]
2013-06-03 12:06:16 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1UjXGx-0003MF-Sj
2013-06-03 12:06:16 1UjXGx-0003MF-Sj => kirby <[email protected]
> F=<> R=virtual_user T=virtual_localdelivery S=6270
2013-06-03 12:06:16 1UjXGx-0003MF-Sj Completed
Click to expand...

I've picked out the offending IPs and hostnames from which these messages are being received an populated them in the bad_sender_hosts and bad_sender_hosts_ip lists of SB4, but the messages just keep flowing in.

I've also cross-referenced the IP addresses from which these messages are originating and find them all listed as abusive on the RBLs.

I'm really at a loss to know how to block these messages from flowing to my server.

Help me please?
 
ericovk said:
but since I've been running Spamblocker, it seems like spamassassin has become a bit useless. Is there a way to use the spamassassins lists in DA (and maybe connect spamassassin tot spamblocker?
Click to expand...
No, because SpamBlocker blocks before even seeing the email body, and SpamAssassin doesn't work until after the email body is read.

SpamBlocker has it's own whitelists and blacklists.

If SpamAssassin is using Blocklists that SpamBlocker doesn't use, you can implement them in SpamBlocker for more efficiency in receiving email but remember if you do that SpamBlocker will block on them, not just score them.

Jeff
 
northtones said:
I was going to implement your exim config file, and had it loaded in a tab in my browser. I got to my computer today and reloaded my browser, and those exim config pages are now all gone. I am unable to find a new link to them. Did you discontinue this? :(
Click to expand...
Version 4.1 was replaced by Version 4.2. Always follow my link, as shown by SeLLeRoNe in post 334 to this thread.

Jeff
 
Peter Laws said:
Any news on the Edit #40 yet (Paypal), for other TLD checks?
Click to expand...
I no longer like the feature at all; it results in all email from PayPal being blocked if the recipeint address is a forwarder. I'm probably going to make it optional in my next full version. Too many people these days using IMAP stores, where all incoming addresses go to one mailbox (especially if you're using a commercial service where you pay by the mailbox) and then later filter using Sieve.

Jeff
 
jlpeifer said:
I'm really at a loss to know how to block these messages from flowing to my server.

Help me please?
Click to expand...
If you believe mail is being received from an IP# even after you've entered it into bad_sender_hosts_ip, then either you're misunderstanding and doing something wrong, or you've somehow really messed up your exim.configuration file.

It's possible you're the victim of a joe job (look it up) and badly configured servers are sending emails back to you even if you didn't send the email. The only thing you really can do then is block those servers. If you're saying you're getting these from many, many servers, then either you're the victim of a very sophisticated targed attack designed to DOS your server, or you're wrong, and your server really is sending out those messages (perhaps running a rogue email server so the outgoing emails aren't ending up in your logs.

Scan your server for malware.

Turn of the php mail function.

Hire someone to investigate the problem.

Jeff
 
You must log in or register to reply here.
Back
Top