Brute force attacks 192.168.2.33 reject from exim.conf how to?

[wgsmedia]

You can use exim.conf SB 4.1 and exim.pl provided by directadmin.com with the current version of 10. That's OK.

Thanks for reply,
so , I can use the SB 4.1 with the exim.pl found here http://files.directadmin.com/services/exim.pl, with my exim 4.67

Thanks
Sal

 

[benzema]

I spoke too soon. I had to revert back to the original exim.conf as people had bounces and I stopped receiving emails. It was doing a fantastic job stopping bad HELOs but I didn't receive emails either. I see some error messages in exim logs.

such as

2013-03-02 17:14:55 failed to open /etc/virtual/whitelist_hosts_ip when checking "/etc/virtual/whitelist_hosts_ip": No such file or directory

and

2013-03-02 18:11:00 H=(37.151.4.90) [37.151.4.90] rejected EHLO or HELO 37.151.4.90: HELO is an IP address (See RFC2821 4.1.3)

just because of the whitelist file error, can it be bouncing all emails? I have Exim version 4.76 #1 built 19-Jul-2011.

 

[zEitEr]

It's said here http://www.nobaloney.net/downloads/...1/ReadMe-SpamBlockerVersion-4.1.exim.conf.txt :

WARNING: The following files must exist and have the same ownership
and permisssions as your /etc/virtual/domains file.

/etc/virtual/bad_sender_hosts
/etc/virtual/bad_sender_hosts_ip
/etc/virtual/blacklist_domains
/etc/virtual/blacklist_senders
/etc/virtual/whitelist_domains
/etc/virtual/whitelist_hosts
/etc/virtual/whitelist_hosts_ip
/etc/virtual/whitelist_senders
/etc/virtual/use_rbl_domains
/etc/virtual/skip_av_domains
/etc/virtual/skip_rbl_domains

Some of the above files may already exist and be populated.
If you have a prepopulated bad_sender_hosts file and if
it's populated with listings which consist of IP#s, then those
listings must be moved out of the bad_sender_hosts file and
into the bad_sender_hosts_ip file.

 

[jonn]

It's said here http://www.nobaloney.net/downloads/...1/ReadMe-SpamBlockerVersion-4.1.exim.conf.txt :

WARNING: The following files must exist and have the same ownership
and permisssions as your /etc/virtual/domains file.

/etc/virtual/bad_sender_hosts
/etc/virtual/bad_sender_hosts_ip
/etc/virtual/blacklist_domains
/etc/virtual/blacklist_senders
/etc/virtual/whitelist_domains
/etc/virtual/whitelist_hosts
/etc/virtual/whitelist_hosts_ip
/etc/virtual/whitelist_senders
/etc/virtual/use_rbl_domains
/etc/virtual/skip_av_domains
/etc/virtual/skip_rbl_domains

Some of the above files may already exist and be populated.
If you have a prepopulated bad_sender_hosts file and if
it's populated with listings which consist of IP#s, then those
listings must be moved out of the bad_sender_hosts file and
into the bad_sender_hosts_ip file.

Never expected this subject to go 2 pages, anyway.

Check ownership/permissions of files in folder:

[B]cd /etc/virtual[/B]
[B]ls -alh
[/B]

Change owner/permissions

[B]chown mail:mail [/B]bad_sender_hosts_ip
[B]chmod 644 [/B]bad_sender_hosts_ip

and so on..

fairly certain this is the correct way to set these files. Correct me if I am wrong
.
.

 

[zEitEr]

Though it's correct, I prefer more strict permissions on files (for which directadmin docs suggest and set another ones):

-r--r-----. mail mail bad_sender_hosts
-r--r----- mail mail bad_sender_hosts_ip
-r--r-----. mail mail blacklist_domains
-r--r-----. mail mail blacklist_senders
-r--r----- mail mail domainips
-r--r----- mail mail skip_av_domains
-r--r----- mail mail skip_rbl_domains
-r--r----- mail mail smtp_active_hostnames
-r--r-----. mail mail whitelist_domains
-r--r-----. mail mail whitelist_from
-r--r-----. mail mail whitelist_hosts
-r--r----- mail mail whitelist_hosts_ip
-r--r-----. mail mail whitelist_senders

Specially for those into which no directadmin has to write.

 

[nobaloney]

In our case, we allow DirectAdmin to write to them by using the admin level file editor. That way they can be edited without requiring shell access, by any DirectAdmin administrator.

For a test I just changed whitelist_hosts_ip to chmod 644, chown root:root.

I was still able to modify it through DirectAdmin's file editor. Afterwards the settings had changed to chmod 644, chown mail:mail.

I'm not sure how, since DirectAdmin seems to run as user nobody:

$ ps waux | grep directadmin
root      9408  0.0  0.0  23508 10276 ?        Ss   Feb23   0:03 /usr/local/directadmin/da-popb4smtp
nobody    9421  0.0  0.0  49452  2104 ?        Ss   Feb23   0:01 /usr/local/directadmin/directadmin d
nobody   15574  0.0  0.0  49452   868 ?        S    13:13   0:00 /usr/local/directadmin/directadmin d
nobody   15601  0.0  0.0  49452   868 ?        S    13:13   0:00 /usr/local/directadmin/directadmin d
nobody   15678  0.0  0.0  49452   868 ?        S    13:13   0:00 /usr/local/directadmin/directadmin d
nobody   15680  0.0  0.0  49452   868 ?        S    13:13   0:00 /usr/local/directadmin/directadmin d
nobody   15699  0.0  0.0  49452   868 ?        S    13:14   0:00 /usr/local/directadmin/directadmin d
jlasman  17225  0.0  0.0  61352   792 pts/0    S+   13:20   0:00 grep directadmin
$

Jeff