Topic: SOLVED! smeserver-wbl / failure notice

[michelandre]

Hi all,

I received this answer after I tried to send email to this friend's site in France.
Everyone else sending email to this server received same answer.

Code: [Select]

Connected to xx.xx.xx.xx but sender was rejected.
Remote host said: 550 (dnsbl) Your recipients got bored with email. They preferred to guess what RBL zones at UCEPROTECT-Network might be or where to query, instead of reading http://www.uceprotect.net/en/index.php?m=6&s=11
Friend'server: SME-9.2 fully updated.
I ssh to this server as root.

- I de-activate smeserver-wbl // failure notice
- I reboot // failure notice
- yum remove smeserver-wbl, signal-event post-upgrade; signal-event reboot  // problem gone

Re-installed smeserver-wbl, signal-event post-upgrade; signal-event reboot  // problem gone

- 3 days after  // failure notice
- I de-activate smeserver-wbl // failure notice
- I reboot // failure notice
- yum remove smeserver-wbl, signal-event post-upgrade; signal-event reboot  // problem gone

Any help appreciated,

Michel-André

[michelandre]

I should have added:

- After looking at the messages log I noticed that yesterday at around 09h00, all the lists started taking out 1 mail address by 1 mail address until empty then start adding 1 mail address by 1 mail address .
- Is that a refresh?

- Repeated the same 3 times about 1 minutes between.

Michel-André

[Stefano]

sincerely and with no flame intention, you spent a lot of time but you did not catch the issue..
smeserver-wbl is just a web interface to edit some values in your configuration dbs.
Please, post the result of

Code: [Select]

config show qpsmtpd

IOW, removing, reinstalling and poking around with rpms doesn't change your core configuration

[Stefano]

I was obviously referring to the remote server's conf (the one is refusing your email)

[Jean-Philippe Pialasse]

I second Stefano on the unnecessary removal of the rpm and on the need to inspect the core configuration.

so we need 

Code: [Select]

config show qpsmtpd
we would also need a complete transaction from the remote server when your email is refused  ( /var/log/qpsmtpd/current)

[michelandre]

Hi Stefano and Jean-Philippe,

Thank you for your fast responses.

- It is the first time I have to look at smeserver-wbl.
- Presently, it is uninstalled.

- What bug me is that after re-installation, it took the same lists and worked for 3 days.

Code: [Select]

qpsmtpd=service
    Bcc=disabled
    BccMode=cc
    BccUser=maillog
    DNSBL=disabled
    LogLevel=6
    MaxScannerSize=25000000
    RBLList=bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org,all.s5h.net      b.barracudacentral.org  bl.emailbasura.org,bl.spamcannibal.org      bl.spamcop.net  blacklist.woody.ch,bogons.cymru.com     cbl.abuseat.org cdl.anti-spam.org.cn,combined.abuse.ch      db.wpbl.info    dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net       dnsbl-3.uceprotect.net  dnsbl.anticaptcha.net,dnsbl.cyberlogic.net      dnsbl.dronebl.org   dnsbl.inps.de,dnsbl.sorbs.net   dnsbl.spfbl.net drone.abuse.ch,duinv.aupads.org dul.dnsbl.sorbs.net dyna.spamrats.com,dynip.rothen.com      exitnodes.tor.dnsbl.sectoor.de  http.dnsbl.sorbs.net,ips.backscatterer.org  ix.dnsbl.manitu.net     korea.services.net,misc.dnsbl.sorbs.net     noptr.spamrats.com      orvedb.aupads.org,pbl.spamhaus.org      proxy.bl.gweep.ca   psbl.surriel.com,relays.bl.gweep.ca     relays.nether.net       sbl.spamhaus.org,short.rbl.jp       singular.ttk.pte.hu     smtp.dnsbl.sorbs.net,socks.dnsbl.sorbs.net      spam.abuse.ch       spam.dnsbl.anonmails.de,spam.dnsbl.sorbs.net    spam.spamrats.com       spambot.bls.digibase.ca,spamrbl.imp.ch      spamsources.fabel.dk    ubl.lashback.com,ubl.unsubscore.com virus.rbl.jp    web.dnsbl.sorbs.net,wormrbl.imp.ch      xbl.spamhaus.org        z.mailspike.net,zen.spamhaus.org    zombie.dnsbl.sorbs.net,xblteams.com,assurer.revuefrance.eu,revueoffre.eu,prendre.publicgrossiste.top,negocier.publicgrossiste.top,csechannel.com,revusilver.eu,revumin.eu,boulanger.com,boulanger.fr,noreply.stores@mailspecificdata.website,information@newsletter.pret-dunion.fr,plbapp1512.plebicity.com,ebuyclub.com,pret-union.fr,print.revuepro.eu,.my,.mx,.ph,.cc,.fi,.co.nz,.br,.jp,.hk,.ai,.ru,.bo,.PL,.pk
    RHSBL=disabled
    RelayRequiresAuth=enabled
    SBLList=multi.surbl.org,black.uribl.com,rhsbl.sorbs.net,boulanger.com,boulanger.fr,wheresiton.com,xe@negocier.publicgrossiste.top,kandinkantpur.com,sky-partners.com,revusilver.eu,admis.revumin.eu,senderscorecertified.com,returnpath.net,mailspecificdata.website,information@newsletter.pret-dunion.fr,newsletter@ebuyclub.com,print.revuepro.eu,publicachat.top,commander.pub
    TlsBeforeAuth=1
    UBLList=multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net
    URIBL=disabled
    access=public
    qplogsumm=disabled
    status=enabled
Michel-André

[Stefano]

your RBLList value is totally wrong (and I don't mind to understand how, when and why..)

Code: [Select]

config delprop qpsmtpd RBLList
/etc/e-smith/events/actions/initialize-default-databases
signal-event email-update


[Stefano]

and I'd add that you'd really do the same for SBLList key

[michelandre]

Hi Stephano,

- config delprop qpsmtpd RBLList
- I re-installed / activated

received your new reply and then
- config delprop qpsmtpd SBLList

Code: [Select]

# config show qpsmtpd
qpsmtpd=service
    Bcc=disabled
    BccMode=cc
    BccUser=maillog
    DNSBL=enabled
    LogLevel=6
    MaxScannerSize=25000000
    RBLList=bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org
    RHSBL=enabled
    RelayRequiresAuth=enabled
    SBLList=multi.surbl.org,black.uribl.com,rhsbl.sorbs.net
    TlsBeforeAuth=1
    UBLList=multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net
    URIBL=disabled
    access=public
    qplogsumm=disabled
    status=enabled

- Send email and it is working with no failure.

I will have to wait for a few days to see what will happen.

Thank you again Stephano,

Michel-ANdré

[Jean-Philippe Pialasse]

my guess is that it could be related to wbl, but not really because of wbl, but rather because of previsible misuse of it.

every URL should be separated by a coma ",".
If you use wbl, this is added every time you make a new line (enter) between urls in the text box.

my guess is that a lot of entries have been added there using the manager, and some were not intended to be in the DNSBL box: (zombie.dnsbl.sorbs.net,xblteams.com,assurer.revuefrance.eu,revueoffre.eu,prendre.publicgrossiste.top,negocier.publicgrossiste.top,csechannel.com,revusilver.eu,revumin.eu,boulanger.com,boulanger.fr,noreply.stores@mailspecificdata.website,information@newsletter.pret-dunion.fr,plbapp1512.plebicity.com,ebuyclub.com,pret-union.fr,print.revuepro.eu,.my,.mx,.ph,.cc,.fi,.co.nz,.br,.jp,.hk,.ai,.ru,.bo,.PL,.pk)


 and somewere all on the same line : (all.s5h.net      b.barracudacentral.org  bl.emailbasura.org,bl.spamcannibal.org      bl.spamcop.net  blacklist.woody.ch,bogons.cymru.com     cbl.abuseat.org cdl.anti-spam.org.cn,combined.abuse.ch      db.wpbl.info    dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net       dnsbl-3.uceprotect.net  dnsbl.anticaptcha.net,dnsbl.cyberlogic.net      dnsbl.dronebl.org   dnsbl.inps.de)

 

Code: [Select]

   RBLList=bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org,all.s5h.net      b.barracudacentral.org  bl.emailbasura.org,bl.spamcannibal.org      bl.spamcop.net  blacklist.woody.ch,bogons.cymru.com     cbl.abuseat.org cdl.anti-spam.org.cn,combined.abuse.ch      db.wpbl.info    dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net       dnsbl-3.uceprotect.net  dnsbl.anticaptcha.net,dnsbl.cyberlogic.net      dnsbl.dronebl.org   dnsbl.inps.de,dnsbl.sorbs.net   dnsbl.spfbl.net drone.abuse.ch,duinv.aupads.org dul.dnsbl.sorbs.net dyna.spamrats.com,dynip.rothen.com      exitnodes.tor.dnsbl.sectoor.de  http.dnsbl.sorbs.net,ips.backscatterer.org  ix.dnsbl.manitu.net     korea.services.net,misc.dnsbl.sorbs.net     noptr.spamrats.com      orvedb.aupads.org,pbl.spamhaus.org      proxy.bl.gweep.ca   psbl.surriel.com,relays.bl.gweep.ca     relays.nether.net       sbl.spamhaus.org,short.rbl.jp       singular.ttk.pte.hu     smtp.dnsbl.sorbs.net,socks.dnsbl.sorbs.net      spam.abuse.ch       spam.dnsbl.anonmails.de,spam.dnsbl.sorbs.net    spam.spamrats.com       spambot.bls.digibase.ca,spamrbl.imp.ch      spamsources.fabel.dk    ubl.lashback.com,ubl.unsubscore.com virus.rbl.jp    web.dnsbl.sorbs.net,wormrbl.imp.ch      xbl.spamhaus.org        z.mailspike.net,zen.spamhaus.org    zombie.dnsbl.sorbs.net,xblteams.com,assurer.revuefrance.eu,revueoffre.eu,prendre.publicgrossiste.top,negocier.publicgrossiste.top,csechannel.com,revusilver.eu,revumin.eu,boulanger.com,boulanger.fr,noreply.stores@mailspecificdata.website,information@newsletter.pret-dunion.fr,plbapp1512.plebicity.com,ebuyclub.com,pret-union.fr,print.revuepro.eu,.my,.mx,.ph,.cc,.fi,.co.nz,.br,.jp,.hk,.ai,.ru,.bo,.PL,.pk


[Jean-Philippe Pialasse]

move to contrib section

[michelandre]

Hi Stefano and Jean-Philippe,

All is still working properly.

Thank you so much,

Michel-André