[RELEASE] SpamBlocker released

oh and yeah i just chose the ones from the majority of the mail i got like from folder drugs and loans or what ever it was!
 
vincenzobar said:
the bolded From: Hot Flashes Be Gone <[email protected]> Is this what you are taling about!
Part of it.
do I enter this into blacklist_domains or use_rbl_domains and do i type it in the file like this:

[email protected]
or
[email protected]
You enter just the domain part of the from address, to /etc/virtual/blacklist_domains.

In other words, to block emails sent from this sender you'd add:

4oh5.com

into /etc/virtual/blacklist_domains.

use_rbl_domains is for something completely different... it's for the list of domains hosted on your server which should use SpamBlocked features.

For example, if you want all your domains to use SpamBlocked features (we don't recommend this; we recommend making it a domain-owner's option), you could make it a link to /etc/virtual/domains.

Otherwise you can copy and past domains from /etc/virtual/domains to /etc/virtual/use_rbl_domains so these domains will use SpamBlocked features. Any domains on your server not listed in /etc/virtual/use_rbl_domains will NOT use SpamBlocked features.
All i have read on the net is all this perl code like S=amazon;hotmail to be entered into files. I have spent 3 days researching on the net and have found nothing useful and im the only computer geek of all the people i know in person. this sux :-(
I don't know what you're looking for so I can't make sense of this paragraph.
I see in this thread it talks about enabling SpamBlock in conf but all i did was copy paste and according to my header it seems to be working, i think, but i still get a butt load of spam and SpamAssassin is catching it all. I have read through all the code but can't understand it well enough to figure out what to do exactly ( i need my hand held- *what a b!tch i am when it comes to this stuff*)
If you're still getting lots of spam, then it's probably not working. Did you have the same exim.conf file as that downloadable at http://www.nobaloney.net/downloads? If so, did you check to make sure all the required files have been added to the /etc/virtual directory? Have you created the website for the redirect, and changed the exim.conf code to redirect to your own website?

If you've done all of the above and restarted exim, then you shouldn't be getting too much spam caught by SpamAssassin at all.
Also in reading this post - what do you mean enter domains in use_rbl_domains. My domains like www.underwater-design.com or the ones i don't want coming through. if its for non wanted then whats the black list for? I am so confused, I think my brain is fried!
I answered this above. Only thing I'll add here is that we want the domains as people address email to them; in other words example.com, not www.example.com.
BTW i have aol IM and am vincenzobar if you think IM would be easier to solve this and clarify my questions!
I don't use any kind of IM; though I type at over 100 wpm, I think about a hundred times faster than that, and I find IM just a waste of time for me.

The best place to get help from me at no charge is here on the forum. Of course my business is working for webhosting companies, and we can do administration work, or even install software (such as SpamBlocker) for you if you wish. However, for that there is a charge.

Jeff
 
Thank you for your responses and trust me i wish i could pay you. But i got 33 dollars to my name until next friday!! lol.

I replaced the example.com with my address but never set up an actual page I will get to that..... Aww DAMN just noticed i must of written over it it wasn't changed... grrrrrrr

Everthing else is created, chmod, and chown.

Thanks for the clarification on the three files that helped alot and as far as the "S=amazon;hotmail" crap... Me either!!!!!!!

Ive been so busy on this server and websites i haven't had time for my own so eventually i will get around to updating it, lol. Ill let you know how it turns out!!

i can't thank you enough!!!!

-vin
 
jlasman said:
I presume you read the comments in the SpamBlocker exim.conf file and created the necessary directories. I also presume you restarted exim after you installed the new exim.conf file and after each change you made.

That depends what you want me to help you with :) . In my last post I gave you information on what needs to be in the blocklist, and where to find it. Do you need any other information or help from me?

I was wondering how you implemented it because I'm working on my implementation. However my implmentation will working during data time, so I most likely won't use MailScanner.

Jeff

Jeff,
Actually if you read the post that got me back into this it was simply about what part of the header do you add to the blacklist_domains file. Everything is working great on my server with Mailscanner running spamassassin and clamav. When I started using your exim.conf file (with some small mods listed above) I received way less spam. But now I am getting lots of it. So my main issue is how to continue to make it better.

I guess I've misunderstood this whole time about what should go in the blacklist_domains file. I thought that it had to be a mailserver name not just a domain name. That sure simplifies things if all that is needed is the domain name.

I'll give it a shot.
 
I think you got it working!!!!!!! with my hands of course (i type at like 30 words an hour!!)

this is a stat from rejectlog
Code:
2004-08-20 20:26:24 H=(65.182.143.151) [65.182.143.151] F=<[email protected]> 
rejected RCPT <[email protected]>: 
to unblock  see [url]http://www.underwaterdesign.com/[/url]

most of the others are old email address that don't exist any more. But that is my first valid email address turn away!!!!

Thanks alot!!!!!!!!!!!!:D :o ;) :) :cool: :D
 
vincenzobar said:
Thank you for your responses and trust me i wish i could pay you. But i got 33 dollars to my name until next friday!! lol.
You're about $33 ahead of me.

We have a lot of cashflow, but how much I can spend is a different story.

My car broke down two weeks ago, and in the So. Cal. desert you can't really get by without one, so now I have a car rental bill on top of everything else (I'm scheduled to get a car on Monday; I can't wait). The only good news is that this weekend I'm renting a Chrysler PT Cruiser... I always wanted to try that one out :) .

So instead of buying a new high-end desktop system two weeks ago, I'm buying a car. Oh well.

Jeff
 
motobrandt said:
I guess I've misunderstood this whole time about what should go in the blacklist_domains file. I thought that it had to be a mailserver name not just a domain name. That sure simplifies things if all that is needed is the domain name.
I'm beta testing now with another file for hostnames. However I don't like frequent changes so I probably won't bring that out until I have the AV stuff.

Jeff
 
vincenzobar said:
I think you got it working!!!!!!! with my hands of course (i type at like 30 words an hour!!)

this is a stat from rejectlog
Code:
2004-08-20 20:26:24 H=(65.182.143.151) [65.182.143.151] F=<[email protected]> 
rejected RCPT <[email protected]>: 
to unblock  see [url]http://www.underwaterdesign.com/[/url]
You might want to direct people to a specific page; I doubt you'll want to put unblocking information on your main site page.

Jeff
 
Yeah i know but i haven't had the time yet. I plan on getting one up within the next couple of days that sent to my error@ account!

I have to cut and format a 400,000 item database then insert it into MySQL by tonight so as you cab=n see im a little busy for my personal site. and if you have visited my site you will see there isn't much there. becuase i did all that in one day!!

work gotta love it!!!!!!!!!!!!!
 
Let's say I have supadupa.com as a main domain name ans supadupa.ws, supadupa.cc as aliases.

Is there a way to add only the main domain name to use_rbl_domains and have all the invalid emails sent to the both the main domain name and the aliases rejected?
 
interfasys said:
Let's say I have supadupa.com as a main domain name ans supadupa.ws, supadupa.cc as aliases.

Is there a way to add only the main domain name to use_rbl_domains and have all the invalid emails sent to the both the main domain name and the aliases rejected?
I'm quite confused as to what you want to do.

However I can say that since the tests all occur at rcpt time, each domain is handled separately, whether it's a real domain or just an alias.

All domains entered in any of the added control files will be handled individually.

Jeff
 
Blocking a domain

OK After trying to figure out if this is really working for me or not. I find that it is not completely working. It is blocking those that it can't get a return rcpt from but I'm not sure that any of the blacklisting stuff is working at all.

I tried to block a domain on another one of my servers by adding the
IP address - no luck
server name - no luck
domain name - no luck
email address - no luck.

So there must be something wrong with the way that I'm implementing this or something because it doesn't even appear to be looking in the /etc/virtual/blacklist_domains file that I created.

I am using the da_exim-4.34-1.tgz that uses the spamblocker exim.conf file. All I have done is to comment out the spamassassin stuff near the bottom.

Ideas?
 
OK, you've answered my question. I wish we could just include a domain name and that would be a rule for the aliases too.
 
bump

bump

Can someone explain how this thing looks at the blacklist_domains file? Mine is not working or if it is then it isn't blocking domains that are in there. See above post.

basically I set up the /etc/virtual/blacklist_domains file with information on a domain that I have on another server but I can't block it no matter what I try. Does this even work?

thanks!
brandt
 
motor --
The format for the blacklist is:
host.tld: spam. Don't add @'s or it wont work. Just domain names.
 
Hey Jeff,

I just installed your exim.conf and Its rejecting all my emails with a spamd error.

2004-08-24 13:23:15 SMTP connection from mail lost while reading message data (header)
spamcheck transport output: An error was detected while processing a file of BSMTP input.
spamcheck_director T=spamcheck: Child process of spamcheck transport returned 2 from command: /usr/sbin/exim

config:

## EXIM CONFIGURATION

# primary_hostname =
# qualify_domain =
# qualify_recipient =
perl_startup = do '/etc/exim.pl'
system_filter = /etc/system_filter.exim
message_size_limit = 10M
smtp_receive_timeout = 5m
smtp_accept_max = 100
smtp_accept_queue = 35
smtp_accept_max_per_host = 5
smtp_accept_max_nonmail = 10
smtp_banner = "$primary_hostname ESMTP Exim $version_number $tod_full"
#received_header_text = "Received: ${if def:sender_rcvhost {from ${sender_rcvhost}\n\t} {${if def:sender_ident {from ${sender_ident} }} ${if def:sender_helo_name {(helo=${sender_helo_name})\n\t}}}} by ${primary_hostname} ${if def:received_protocol {with ${received_protocol}}} ${if def:tls_cipher {${tls_cipher}}}\n\t (Exim ${version_number} id ${message_id}) ${if def:received_for {\n\tfor <$received_for>}}"
helo_allow_chars = _

# define what to log:
# define the => log lines
# +delivery_size
# +sender_on_delivery
#
# define the <= log lines:
# +received_recipients
# +received_sender
# +smtp_confirmation
# +subject
#
# define other non '<= =>' log lines:
# +smtp_incomplete_transaction
###################################
# define what to not log:
# define other non "<= =>' log lines:
# -dnslist_defer
# -host_lookup_failed
# -queue_run
# -rejected_header
# -retry_defer
# -skip_delivery
###################################

log_selector = \
+delivery_size \
+sender_on_delivery \
+received_recipients \
+received_sender \
+smtp_confirmation \
+subject \
+smtp_incomplete_transaction \
-dnslist_defer \
-host_lookup_failed \
-queue_run \
-rejected_header \
-retry_defer \
-skip_delivery

syslog_duplication = false
acl_smtp_rcpt = check_recipient
acl_smtp_data = check_message

# define local lists

domainlist blacklist_domains = lsearch;/etc/virtual/blacklist_domains
domainlist whitelist_from = lsearch;/etc/virtual/whitelist_from
domainlist local_domains = lsearch;/etc/virtual/domains
domainlist relay_domains = lsearch;/etc/virtual/domains : localhost
domainlist use_rbl_domains = lsearch;/etc/virtual/use_rbl_domains
hostlist relay_hosts = net-lsearch;/etc/virtual/pophosts : 127.0.0.1
hostlist auth_relay_hosts = *

# local_domains_include_host_literals
allow_domain_literals = false
never_users = root
host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 0s
auto_thaw = 1h
ignore_bounce_errors_after = 2h
timeout_frozen_after = 14h
trusted_users = mail:majordomo:www
tls_certificate = /etc/exim.cert
tls_privatekey = /etc/exim.key
tls_advertise_hosts = *
#auth_over_tls_hosts = *

begin acl

check_recipient:
accept hosts = :
deny domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
deny domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
accept domains = +whitelist_from
accept local_parts = postmaster
domains = +local_domains
accept local_parts = abuse
domains = +local_domains
accept local_parts = hostmaster
domains =+local_domains
accept local_parts = dns
domains = tentric.com
deny message = Go play with your self
domains = +use_rbl_domains
sender_domains = +blacklist_domains
require verify = sender
deny message = Mail from $sender_host_name rejected; see http://rss.mail-abuse.com/cgi-bin/nph-rss?query=$sender_ip_address
domains = +use_rbl_domains
dnslists = relays.mail-abuse.org
deny message = Mail from $sender_host_name rejected; see http://njabl.org/cgi-bin/lookup.cgi?query=$sender_ip_address
domains = +use_rbl_domains
dnslists = dnsbl.njabl.org
deny message = Mail from $sender_host_name rejected; see http://ordb.org/lookup/?host=$sender_ip_address
domains = +use_rbl_domains
dnslists = relays.ordb.org
deny message = Mail from $sender_host_name rejected; see http://www.spamhaus.org/query/bl?ip=$sender_ip_address
domains = +use_rbl_domains
dnslists = sbl.spamhaus.org
deny message = Mail from $sender_host_name rejected; youre domain may be hacked or infected as per http://opm.blitzed.org/proxy?ip=$sender_ip_address
domains = +use_rbl_domains
dnslists = opm.blitzed.org
deny message = Mail from $sender_host_name rejected; youre domain may be hacked or infected as per http://www.dnsbl.us.sorbs.net/lookup.shtml
domains = +use_rbl_domains
dnslists = dnsbl.sorbs.net=127.0.0.5
deny message = Mail from $sender_host_name rejected; youre domain may be hacked or infected as per http://www.dnsbl.us.sorbs.net/lookup.shtml
hosts = !+relay_hosts
domains = +use_rbl_domains
!authenticated = *
dnslists = dnsbl.sorbs.net!=127.0.0.6
deny message = Mail from $sender_host_name rejected.
hosts = !+relay_hosts
domains =+use_rbl_domains
!authenticated = *
dnslists = bl.spamcop.net : cbl.abuseat.org
deny message = Mail from $sender_host_name rejected.
domains =+use_rbl_domains
dnslists = rhsbl.sorbs.net/$sender_address_domain
accept domains = +local_domains
endpass
verify = recipient
accept domains = +relay_domains
endpass
verify=recipient
accept hosts = +relay_hosts
accept hosts = +auth_relay_hosts
endpass
message = authentication required
authenticated = *
deny message = relay not permitted
deny message = relay not permitted

check_message:
accept

begin authenticators

plain:
driver = plaintext
public_name = PLAIN
server_condition = "${perl{smtpauth}}"
server_set_id = $2

login:
driver = plaintext
public_name = LOGIN
server_prompts = "Username:: : Password::"
server_condition = "${perl{smtpauth}}"
server_set_id = $1


begin routers

lookuphost:
driver = dnslookup
domains = ! +local_domains
ignore_target_hosts = 127.0.0.0/8
transport = remote_smtp
no_more

# domain_literal:
# driver = ipliteral
# transport = remote_smtp

#spamcheck_director:
# driver = accept
#condition = "${if and { {!def:h_X-Spam-Flag:} {!eq {$received_protocol}{spam-scanned}} {!eq {$received_protocol}{local}} } {1}{0}}"
# retry_use_local_part
#transport = spamcheck
#no_verify

majordomo_aliases:
driver = redirect
allow_defer
allow_fail
data = ${if exists{/etc/virtual/${domain}/majordomo/list.aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/majordomo/list.aliases}}}}
domains = lsearch;/etc/virtual/domainowners
file_transport = address_file
group = daemon
pipe_transport = majordomo_pipe
retry_use_local_part
no_rewrite
user = majordomo

majordomo_private:
driver = redirect
allow_defer
allow_fail
condition = "${if eq {$received_protocol} {local} \
{true} {false} }"
data = ${if exists{/etc/virtual/${domain}/majordomo/private.aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/majordomo/private.aliases}}}}
domains = lsearch;/etc/virtual/domainowners
file_transport = address_file
group = daemon
pipe_transport = majordomo_pipe
retry_use_local_part
user = majordomo

domain_filter:
driver = redirect
allow_filter
no_check_local_user
user = "mail"
file = /etc/virtual/${domain}/filter
file_transport = address_file
pipe_transport = virtual_address_pipe
retry_use_local_part
no_verify

uservacation:
driver = accept
condition = ${lookup{$local_part} lsearch {/etc/virtual/${domain}/vacation.conf}{yes}{no}}
require_files = /etc/virtual/${domain}/reply/${local_part}.msg
transport = uservacation
unseen

userautoreply:
driver = accept
condition = ${lookup{$local_part} lsearch {/etc/virtual/${domain}/autoresponder.conf}{yes}{no}}
require_files = /etc/virtual/${domain}/reply/${local_part}.msg
transport = userautoreply

virtual_aliases_nostar:
driver = redirect
allow_defer
allow_fail
data = ${if exists{/etc/virtual/${domain}/aliases}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/aliases}}}}
file_transport = address_file
group = mail
pipe_transport = virtual_address_pipe
retry_use_local_part
unseen
#include_domain = true

virtual_user:
driver = accept
condition = ${if eq {}{${if exists{/etc/virtual/${domain}/passwd}{${lookup{$local_part}lsearch{/etc/virtual/${domain}/passwd}}}}}{no}{yes}}
domains = lsearch;/etc/virtual/domainowners
group = mail
retry_use_local_part
transport = virtual_localdelivery

virtual_aliases:
driver = redirect
allow_defer
allow_fail
data = ${if exists{/etc/virtual/$domain/aliases}{${lookup{$local_part}lsearch*{/etc/virtual/$domain/aliases}}}}
file_transport = address_file
group = mail
pipe_transport = virtual_address_pipe
retry_use_local_part
#include_domain = true

userforward:
driver = redirect
allow_filter
check_ancestor
check_local_user
no_expn
file = $home/.forward
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply
no_verify

localuser:
driver = accept
check_local_user
transport = local_delivery

system_aliases:
driver = redirect
allow_defer
allow_fail
data = ${lookup{$local_part}lsearch{/etc/aliases}}
file_transport = address_file
pipe_transport = address_pipe
retry_use_local_part
user = mail

begin transports

#spamcheck:
# driver = pipe
# batch_max = 100
# command = /usr/sbin/exim -oMr spam-scanned -bS
# current_directory = "/tmp"
# group = mail
# home_directory = "/tmp"
# log_output
# message_prefix =
# message_suffix =
# return_fail_output
# no_return_path_add
# transport_filter = /usr/bin/spamc
# use_bsmtp
# user = mail

majordomo_pipe:
driver = pipe
group = daemon
return_fail_output
user = majordomo

local_delivery:
driver = appendfile
delivery_date_add
envelope_to_add
file = /var/mail/$local_part
group = mail
mode = 0660
return_path_add
user = ${local_part}

virtual_localdelivery:
driver = appendfile
create_directory
delivery_date_add
directory_mode = 700
envelope_to_add
file = /var/spool/virtual/${domain}/${local_part}
group = mail
mode = 660
return_path_add
user = "${lookup{$domain}lsearch*{/etc/virtual/domainowners}{$value}}"
quota = ${if exists{/etc/virtual/${domain}/quota}{${lookup{$local_part}lsearch*{/etc/virtual/${domain}/quota}{$value}{0}}}{0}}

uservacation:
driver = autoreply
file = /etc/virtual/${domain}/reply/${local_part}.msg
from = "${local_part}@${domain}"
log = /etc/virtual/${domain}/reply/${local_part}.log
no_return_message
subject = "${if def:h_Subject: {Autoreply: $h_Subject:} {I am on vacation}}"
text = "\
------ ------\n\n\
This message was automatically generated by email software\n\
The delivery of your message has not been affected.\n\n\
------ ------\n\n"
to = "${sender_address}"
user = mail
#once = /etc/virtual/${domain}/reply/${local_part}.once

userautoreply:
driver = autoreply
bcc = ${lookup{${local_part}} lsearch {/etc/virtual/${domain}/autoresponder.conf}{$value}}
file = /etc/virtual/${domain}/reply/${local_part}.msg
from = "${local_part}@${domain}"
log = /etc/virtual/${domain}/reply/${local_part}.log
no_return_message
subject = "${if def:h_Subject: {Autoreply: $h_Subject:} {Autoreply Message}}"
to = "${sender_address}"
user = mail
#once = /etc/virtual/${domain}/reply/${local_part}.once

remote_smtp:
driver = smtp

address_pipe:
driver = pipe
return_output

virtual_address_pipe:
driver = pipe
group = nobody
return_output
user = "${lookup{$domain}lsearch* {/etc/virtual/domainowners}{$value}}"

address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add

address_reply:
driver = autoreply

begin retry

* * F,2h,15m; G,16h,1h,1.5; F,4d,8h
 
apryan said:
motor --
The format for the blacklist is:
host.tld: spam. Don't add @'s or it wont work. Just domain names.

?? so it needs a colon spam? Like if I wanted to block my own domain bli.net from sendin spam to the server I would add

bli.net: spam

to the blacklist_domains file? hmmm. If this is true then it would solve the mystery for me fo sho. But I can't find anywhere where it says to do this.

???
I'll try it out.
 
I dont think it needs the : spam. Thats if you wanted to add a username i think?

If you want to block all of bli.net adding it like this:

bli.net

should do the trick. No user@ in front.
-anth
 
Back
Top