Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've recently been battling spam issues on our mail server. One account in particular was getting hammered with incoming spam. SpamAssassin's memory use is one of our concerns.

What I've done is enable RBLs in Exim. I now see many rejection notices in the Exim log based on the various RBLs, which is good.

However, when I run Eximstats, the numbers seem to be the same as they were prior to the enabling of the RBLs. I am assuming because the email is still logged in some way prior to the rejection. Is that what's happening, or am I missing something else?

Does anyone know if these emails are rejected prior to being processed by SpamAssassin? Or does anyone know how I'd be able to find out? Is there a standard way to generate SpamAssassin stats, similar to Eximstats, so that I could compare the numbers?

Thank you for your time and any advice.

Edit: Here is the ACL section of my Exim configuration file

######################################################################
#                               ACLs                                 #
######################################################################

begin acl

# ACL that is used after the RCPT command
check_recipient:

# to block certain wellknown exploits, Deny for local domains if
# local parts begin with a dot or contain @ % ! / |
  deny  domains       = +local_domains
        local_parts   = ^[.] : ^.*[@%!/|]

# to restrict port 587 to authenticated users only
# see also daemon_smtp_ports above
accept  hosts = +auth_relay_hosts
        condition = ${if eq {$interface_port}{587} {yes}{no}}
        endpass
        message = relay not permitted, authentication required
        authenticated = *

# allow local users to send outgoing messages using slashes
# and vertical bars in their local parts.
# Block outgoing local parts that begin with a dot, slash, or vertical
# bar but allows them within the local part.
# The sequence \..\ is barred. The usage of @ % and ! is barred as
# before. The motivation is to prevent your users (or their virii)
# from mounting certain kinds of attacks on remote sites.
  deny  domains       = !+local_domains
        local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

# local source whitelist
# accept if the source is local SMTP (i.e. not over TCP/IP).
# Test for this by testing for an empty sending host field.
  accept  hosts = :

# sender domains whitelist
# accept if sender domain is in whitelist
  accept  sender_domains = +whitelist_domains

# sender hosts whitelist
# accept if sender host is in whitelist
  accept  hosts = +whitelist_hosts
  accept  hosts = +whitelist_hosts_ip

# envelope senders whitelist
# accept if envelope sender is in whitelist
  accept  senders = +whitelist_senders

# accept mail to postmaster in any local domain, regardless of source
  accept  local_parts = postmaster
          domains     = +local_domains

# accept mail to abuse in any local domain, regardless of source
  accept  local_parts = abuse
          domains     = +local_domains

# accept mail to hostmaster in any local domain, regardless of source
  accept  local_parts = hostmaster
          domains     =+local_domains

# OPTIONAL MODIFICATIONS:
# If the page you're using to notify senders of blocked email of how
# to get their address unblocked will use a web form to send you email so
# you'll know to unblock those senders, then you may leave these lines
# commented out.  However, if you'll be telling your senders of blocked
# email to send an email to errors@yourdomain.com, then you should
# replace "errors" with the left side of the email address you'll be
# using, and "example.com" with the right side of the email address and
# then uncomment the second two lines, leaving the first one commented.
# Doing this will mean anyone can send email to this specific address,
# even if they're at a blocked domain, and even if your domain is using
# blocklists.

# accept mail to errors@example.com, regardless of source
#   accept  local_parts = errors
#           domains     = example.com

# deny so-called "legal" spammers"
  deny message = Email blocked by LBL - to unblock see http://www.example.com/
       # only for domains that do want to be tested against RBLs
       domains = +use_rbl_domains
       sender_domains = +blacklist_domains

# deny using hostname in bad_sender_hosts blacklist
  deny message = Email blocked by BSHL - to unblock see http://www.example.com/
       # only for domains that do want to be tested against RBLs
       domains = +use_rbl_domains
       hosts = +bad_sender_hosts

# deny using IP in bad_sender_hosts blacklist
  deny message = Email blocked by BSHL - to unblock see http://www.example.com/
       # only for domains that do want to be tested against RBLs
       domains = +use_rbl_domains
       hosts = +bad_sender_hosts_ip

# deny using email address in blacklist_senders
  deny message = Email blocked by BSAL - to unblock see http://www.example.com/
       domains = +use_rbl_domains
       senders = +blacklist_senders

# By default we do NOT require sender verification.
# Sender verification denies unless sender address can be verified:
# If you want to require sender verification, i.e., that the sending
# address is routable and mail can be delivered to it, then
# uncomment the next line. If you do not want to require sender
# verification, leave the line commented out

#require verify = sender

# deny using .spamhaus
  deny message = Email blocked by SPAMHAUS - to unblock see http://www.example.com/
       # only for domains that do want to be tested against RBLs
       domains = +use_rbl_domains
       dnslists = sbl.spamhaus.org

# deny using ordb
#  deny message = Email blocked by ORDB - to unblock see http://www.example.com/
#       # only for domains that do want to be tested against RBLs
#       domains = +use_rbl_domains
#       dnslists = relays.ordb.org

# deny using sorbs smtp list
  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       # only for domains that do want to be tested against RBLs
       domains = +use_rbl_domains
       dnslists = dnsbl.sorbs.net=127.0.0.5

# Next deny stuff from more "fuzzy" blacklists
# but do bypass all checking for whitelisted host names
# and for authenticated users

# deny using spamcop
  deny message = Email blocked by SPAMCOP - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = bl.spamcop.net

# deny using njabl
  deny message = Email blocked by NJABL - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = dnsbl.njabl.org

# deny using cbl
  deny message = Email blocked by CBL - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = cbl.abuseat.org

# deny using all other sorbs ip-based blocklist besides smtp list
  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       hosts = !+relay_hosts
       domains = +use_rbl_domains
       !authenticated = *
       dnslists = dnsbl.sorbs.net!=127.0.0.6

# deny using sorbs name based list
  deny message = Email blocked by SORBS - to unblock see http://www.example.com/
       domains =+use_rbl_domains
       # rhsbl list is name based
       dnslists = rhsbl.sorbs.net/$sender_address_domain

# accept if address is in a local domain as long as recipient can be verified
  accept  domains = +local_domains
          endpass
      message = "Unknown User"
          verify = recipient

# accept if address is in a domain for which we relay as long as recipient
# can be verified
  accept  domains = +relay_domains
          endpass
          verify=recipient

# accept if message comes for a host for which we are an outgoing relay
# recipient verification is omitted because many MUA clients don't cope
# well with SMTP error responses. If you are actually relaying from MTAs
# then you should probably add recipient verify here

  accept  hosts = +relay_hosts
  accept  hosts = +auth_relay_hosts
          endpass
          message = authentication required
          authenticated = *
  deny    message = relay not permitted

# default at end of acl causes a "deny", but line below will give
# an explicit error message:
  deny    message = relay not permitted

# ACL that is used after the DATA command
check_message:
  accept
share|improve this question
    
Fix "deny using email address in blacklist_senders", put + in front of use_rbl_domains. –  kupson Feb 15 '12 at 14:49
    
@kupson That ended up blocking all email sent to our domain, which is in the use_rbl_domains file. Whoops. –  user955664 Feb 15 '12 at 16:55
    
There was additional error -- remove second deny (before senders). –  kupson Feb 15 '12 at 17:19

2 Answers 2

SpamAssasin is (typically) called from DATA ACL and RBLs from RCPT TO ACL -- before DATA.

Exim reject by RBLs in RCTP TO: in configuration stanzas like that

deny message = <msg>
  <additional conditions>
  dnslists = <RBL service address>

but you have empty DATA ACL (below) -- is that all of your ACLs config?

# ACL that is used after the DATA command
check_message:
  accept

I guess you use exim-sa if you don't have "spam = " line somewhere in your ACLs.

Look at other (recommended) way of calling SA in Exim docs, section 41.3.

share|improve this answer
    
Added them above. –  user955664 Feb 15 '12 at 14:20
    
As for the version: "This is version "2.0 of the SpamBlocker exim.conf file as distributed by NoBaloney Internet Services for DirectAdmin based servers." Regarding the DATA ACL, is that bad? This is the setup I've inherited and trying to do the best I can with it. I'm not sure how much I can change the way SA is called because of the DirectAdmin tie-in –  user955664 Feb 15 '12 at 15:28
    
Calling SpamAssasin from DATA ACL is recommended for it could reject spam in SMTP session. No problem with bounces etc. –  kupson Feb 15 '12 at 15:39

Check your /var/log/syslog for spamd output; at least in our configuration, SpamAssassin logs every message ID it has checked and the respective result in the syslog.

What I've done is enable RBLs in Exim. I now see many rejection notices in the Exim log based on the various RBLs, which is good.

No, it's not :/

If you reject mail just because the sending MTA is listed on a single blacklist, you will lose legitimate mail, which in my opinion is unacceptable.

My company runs two mail relays that relay the mail of about 600000 users; several of these accounts are getting hacked per week and will start to send spam mails. We monitor our logs to identify these accounts as soon as possible and then we disable them, but it's unavoidable that our servers sometimes end up on one or two blacklist. I therefore think that rejecting mails just because the sending MTA is listed on a single blacklist is a grave mistake.

All our ~800 servers use SpamAssassin to identify spam, and none of them reject suspected spam mails outright. Instead the spam mails are sorted into Junk folders with sieve scripts so that the users can decide for themselves. A single blacklist entry will usually just lead to a higher SpamAssassin score, but as long as nothing else is wrong with the mail, it will be delivered normally.

share|improve this answer
    
> No, it's not :/ yes it is - period - if your mailsever is not just for you and your family you won't survive to scan every message content longer than a few hours a sane setup will use multiple RBL's and reject based on a summary score which leads in 90% of all junk never hit SpamAssassin / ClamAV and if your setup don't support that get Postfix/Postscreen which supports that out-of-the-box for years now but please stop tell people they have to pass every crap to a expensive contentfilter –  Harald Reindl Oct 4 at 20:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.