Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: Derek L on April 12, 2004, 11:13:52 PM

Title: SURBL - Spam URI Realtime Blocklist
Post by: Derek L on April 12, 2004, 11:13:52 PM

Hi,

Just wondering if anyone has tried this in conjunction with Spamassassin on SME 6:

http://surbl.org/

Any opinions?

Title: smtpfront-qmail RBL blocking in sme server v6.0
Post by: raem on April 13, 2004, 08:54:59 AM

Dont't know about that but this certainly works.

You can save Spamassassin and your processor a lot of work by enabling the smtpfront-qmail RBL blocking feature in sme server v6.0.
Just by enabling this feature a lot of spam as well as virus infected messages will be rejected.


/sbin/e-smith/config setprop smtpfront-qmail RBLList sbl-xbl.spamhaus.org

/sbin/e-smith/expand-template /var/service/smtpfront-qmail/runenv

svc -t /service/smtpfront-qmail

Note: you can add multiple RBLs to the RBLList property by delimiting them with a colon. Add more lists as required.


/sbin/e-smith/config setprop smtpfront-qmail RBLList sbl-xbl.spamhaus.org:whois.rfc.ignorant.org:dnsbl.njabl.org:relays.ordb.org:list.dsbl.org

/sbin/e-smith/expand-template /var/service/smtpfront-qmail/runenv

svc -t /service/smtpfront-qmail



Note the bl.spmcop.net list (and some others) are aggressive and will block messages from yahoo, hotmail earthlink and other valid account senders.

There are plenty of alternative lists around though,
Use these after you have assessed whether they suit your needs, but the lists below appear to be "conservative & safe"

sbl-xbl.spamhaus.org
dsn.rfc-ignorant.org
postmaster.rfc-ignorant.org
abuse.rfc-ignorant.org
whois.rfc-ignorant.org
ipwhois.rfc-ignorant.org
bogusmx.rfc-ignorant.org
dnsbl.njabl.org
relays.ordb.org
dnsbl.sorbs.net
contacts.abuse.net
list.dsbl.org
blackholes.mail-abuse.org - need to register
relays.mail-abuse.org - need to register
dialups.mail-abuse.org - need to register
cbl.abuseat.org - included in xbl.spamhaus.org
checked opm.blitzed.org -included in xbl.spamhaus.org


You can look in the /var/log/smtpfront-qmail/* logs to see how effective the blocking is.

See
http://forums.contribs.org/index.php?topic=21195.0
for original post by Greg Zartman, thank you Greg & Charlie, this works extremely well.

Regs
Ray

Title: SURBL - Spam URI Realtime Blocklist
Post by: raem on April 13, 2004, 01:21:22 PM

I decided to put my above post into a HOWTO

See here for further details

http://forums.contribs.org/index.php?topic=21866.0

Regs
Ray

Title: surbl is for SA and not for smtpfront-qmail
Post by: paddywagon on April 13, 2004, 07:05:58 PM

Not so fast!

rtfm on surbl.org first!

surbl is designed as an add-on to Spamassassin and
not as yet another RBL.  It does not reject at the SMTP level.

this add-on examines the body of the email
for domains and checks for spam domains
using surbl.

when it finds a spam domain it adds a tag to the email
and a score - that is all it does!

IMHO it can give rise to spammer abuse - suppose
the spammer adds hundreds of false domains to the body of an email
to make your CPU and network churn?  The SA add on will look
for all of these domains at surbl and these requests all take time.

Anthony