Topic: SURBL - Spam URI Realtime Blocklist

[Derek L]

Hi,

Just wondering if anyone has tried this in conjunction with Spamassassin on SME 6:

http://surbl.org/

Any opinions?

[raem]

Dont't know about that but this certainly works.

You can save Spamassassin and your processor a lot of work by enabling the smtpfront-qmail RBL blocking feature in sme server v6.0.
Just by enabling this feature a lot of spam as well as virus infected messages will be rejected.


/sbin/e-smith/config setprop smtpfront-qmail RBLList sbl-xbl.spamhaus.org

/sbin/e-smith/expand-template /var/service/smtpfront-qmail/runenv

svc -t /service/smtpfront-qmail

Note: you can add multiple RBLs to the RBLList property by delimiting them with a colon. Add more lists as required.


/sbin/e-smith/config setprop smtpfront-qmail RBLList sbl-xbl.spamhaus.org:whois.rfc.ignorant.org:dnsbl.njabl.org:relays.ordb.org:list.dsbl.org

/sbin/e-smith/expand-template /var/service/smtpfront-qmail/runenv

svc -t /service/smtpfront-qmail



Note the bl.spmcop.net list (and some others) are aggressive and will block messages from yahoo, hotmail earthlink and other valid account senders.

There are plenty of alternative lists around though,
Use these after you have assessed whether they suit your needs, but the lists below appear to be "conservative & safe"

sbl-xbl.spamhaus.org
dsn.rfc-ignorant.org
postmaster.rfc-ignorant.org
abuse.rfc-ignorant.org
whois.rfc-ignorant.org
ipwhois.rfc-ignorant.org
bogusmx.rfc-ignorant.org
dnsbl.njabl.org
relays.ordb.org
dnsbl.sorbs.net
contacts.abuse.net
list.dsbl.org
blackholes.mail-abuse.org - need to register
relays.mail-abuse.org - need to register
dialups.mail-abuse.org - need to register
cbl.abuseat.org - included in xbl.spamhaus.org
checked opm.blitzed.org -included in xbl.spamhaus.org


You can look in the /var/log/smtpfront-qmail/* logs to see how effective the blocking is.

See
http://forums.contribs.org/index.php?topic=21195.0
for original post by Greg Zartman, thank you Greg & Charlie, this works extremely well.

Regs
Ray

[raem]

I decided to put my above post into a HOWTO

See here for further details

http://forums.contribs.org/index.php?topic=21866.0

Regs
Ray

[paddywagon]

Not so fast!

rtfm on surbl.org first!

surbl is designed as an add-on to Spamassassin and
not as yet another RBL.  It does not reject at the SMTP level.

this add-on examines the body of the email
for domains and checks for spam domains
using surbl.

when it finds a spam domain it adds a tag to the email
and a score - that is all it does!

IMHO it can give rise to spammer abuse - suppose
the spammer adds hundreds of false domains to the body of an email
to make your CPU and network churn?  The SA add on will look
for all of these domains at surbl and these requests all take time.

Anthony