Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: wacko on March 11, 2004, 03:21:09 AM

Title: extra spamassassin RBL
Post by: wacko on March 11, 2004, 03:21:09 AM

Hi

I found some extra RBL to put in the local.cf of spamassassin. Might help pick up extra spamming IP's
Change the scores how you wish

Quote

#--------------------------------------------
#Extra Real Time BlackHoles
#--------------------------------------------
header   ARIX_DF rbleval:check_rbl('arix-df', 'fresh.dict.rbl.arix.com.')
describe ARIX_DF Recent dictionary spammer
tflags   ARIX_DF net

header   ARIX_DS rbleval:check_rbl('arix-ds', 'stale.dict.rbl.arix.com.')
describe ARIX_DS Sender has a history of dictionary spamming
tflags   ARIX_DS net
score    ARIX_DF 3.0
score    ARIX_DS 0.5

header   DYNABLOCK rbleval:check_rbl('dynablock', 'dynablock.easynet.nl.')
describe DYNABLOCK spamming IP
tflags      DYNABLOCK net
score    DYNABLOCK 5.0

header   EASYNET rbleval:check_rbl('easynet', 'blackholes.easynet.nl.')
describe EASYNET spamming IP
tflags      EASYNET net
score    EASYNET 5.0

header   ABUSEAT rbleval:check_rbl('abuseat', 'cbl.abuseat.org.')
describe ABUSEAT spamming IP
tflags      ABUSEAT net
score    ABUSEAT 5.0

header   SPAMHAUS rbleval:check_rbl('spamhaus', 'sbl-xbl.spamhaus.org.')
describe SPAMHAUS spamming IP
tflags      SPAMHAUS net
score    SPAMHAUS 5.0

header   BLITZED rbleval:check_rbl('blitzed', 'opm.blitzed.org.')
describe BLITZED spamming IP
tflags      BLITZED net
score    BLITZED 5.0

header   DSBL rbleval:check_rbl('dsbl', 'list.dsbl.org.')
describe DSBL spamming IP
tflags      DSBL net
score    DSBL 5.0

Restart spamassassin when done and they should start picking up any spam orginating from the IP's

It seems to work for me fine.

Title: Re: extra spamassassin RBL
Post by: gzartman on March 13, 2004, 01:25:31 AM

Quote from: "wacko"

Hi
I found some extra RBL to put in the local.cf of spamassassin. Might help pick up extra spamming IP's
Change the scores how you wish

Defining RBLs in SA on SME 6 is a real waste of resources.  It is much more efficent to block messages at the front door.  See my post here:

http://forums.contribs.org/index.php?topic=21195.msg84015#msg84015

Title: extra spamassassin RBL
Post by: wellsi on April 03, 2004, 12:47:34 PM

Quote from: "gzartman"

Defining RBLs in SA on SME 6 is a real waste of resources.  It is much more efficent to block messages at the front door.

If collecting email from multiple POP3 mailboxes - using fetchmail for multipop - then I think that using RBLs 'inside' spamassassin is the easiest/only way. I welcome hearing of a better way.