Tag Info

Hot answers tagged

38

Here is my list and why I use them: zen.spamhaus.org - Comprehensive RBL, catches a ton of spam sources, updated regularly. They have a long history and decent reputation in the spam filtering community. I have heard some negative things about them from time to time, but those are generally without real merit. Downside is that if your volume of traffic ...


17

MxToolbox has a web-based blacklist check tool that's a good starting point. The Domain Name System Blacklists (DNSBL) and Anti-Abuse Multi-RBL Check are other great free resources for this purpose. DNSstuff also has a subscription based service called RBLalerts that will monitor 130+ blacklists for an IP address you specify and notify you if it has been ...


16

No, there is no "global" list; every company maintains their own classifications. So you will have to contact each one individually.


13

I'd suggest grabbing a sinmple firewall config tool, scuch a Firestarter, and going from there. Here are some basics for you, though. #Flush existing rules iptables -F # Set up default DROP rule for eth0 iptables -P INPUT DROP # Allow existing connections to continue iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept ...


13

try using iptables and building multi-level tree to decrease number of lookups. iptables -N rules_0_0_0_0_2 iptables -N rules_64_0_0_0_2 iptables -N rules_128_0_0_0_2 iptables -N rules_192_0_0_0_2 iptables -N rules_0_0_0_0_4 iptables -N rules_16_0_0_0_4 iptables -A INPUT -p tcp --dport 80 -s 0.0.0.0/2 -j rules_0_0_0_0_2 iptables -A INPUT -p tcp --dport 80 ...


10

you can deny access by BrowserMatch and Deny from SetEnvIf Example: SetEnvIfNoCase User-Agent "^Wget" bad_bot SetEnvIfNoCase User-Agent "^EmailSiphon" bad_bot SetEnvIfNoCase User-Agent "^EmailWolf" bad_bot <Directory "/var/www"> Order Allow,Deny Allow from all Deny from env=bad_bot </Directory> To permanenly block them ...


10

When we found ourselves categorized incorrectly in several blacklists a few months ago, we had to contact each one individually to appeal. Some useful addresses: https://www.trustedsource.org/ (McAfee) suggest@websense.com (Websense) http://www.fortiguard.com/webfiltering/webfiltering.html (FortiGuard) http://domain.opendns.com (OpenDNS)


9

If you go to mxtoolbox.com and put in your IP, you can get a blacklist report. Your IP is on two of them: UCEPROTECTL2 UCEPROTECTL3 Click the details next to the BL in question and it will tell you why you are on there and how to remove your self. EDIT: I see that you already know that you are on the UCE Protect... Most mail admins use clearing house ...


9

You could try using moblock (google it - can't add links yet, new user). Disable all downloaded blocklists, and use only a local blocklist that you generate. You may need to add NFQUEUE (netlink queue) support to your kernel, but it may already be there by default. The general setup is: for all SYN packets on the ports you want to filter, use netfilter's ...


8

'zen.spamhaus.org' is pretty good. I recommend it.


8

This is exactly what ipset is for. From its website http://ipset.netfilter.org/: If you want to store multiple IP addresses or port numbers and match against the collection by iptables at one swoop; dynamically update iptables rules against IP addresses or ports without performance penalty; express complex IP address and ports based rulesets with one ...


7

The easiest approach would be to time limit the blacklisting. The first time an IP is put into the DB, set the timeout for 3 days or something. On subequent submissions from that IP: The second time junk comes from an IP set the timeout for 2 weeks. The third time junk comes from that same IP set the timeout for Permanent (0) Or something similar to that, ...


7

iptables -I INPUT -s <allowed_ip> -j ACCEPT #(repeat this line as needed) iptables -P INPUT DROP This will turn your system into a non-existent system for non-allowed computers.


7

I used to trust RBLs directly. Then I wen't to scoring with policyd-weight which is much safer (but not your question). I would only trust these RBLs for direct blocking: zen.spamhaus.org (I think it includes the CBL of Abuseat) ix.dnsbl.manitu.net (iX magazine) dnsrbl.swinog.ch (Swiss network operators group) IMPORTANT: never ever trust anything ...


6

There are multiple tools in this space; however, I urge caution using them as many have been found to have exploits that make them worse than not having them. You will also need to decide what service you are protecting. HTTP, SMTP, POP, etc. have different tools. For example, fail2ban: http://www.fail2ban.org/wiki/index.php/Main_Page Can be customized ...


5

I have not tested this myself, but when I heard your problem description I instantly thought "pf" (as from OpenBSD). pf has the concept of address tables which may just be what you're looking for. According to some very cursory research I did, it would seem that this has the potential to scale better than ipset. According to the PF FAQ's chapter on Runtime ...


5

The problem is that the mail is sent via the pickup service (via sendmail inteface) and so it is an "outgoing" mail. For outgoing mail the smtpd_*_restrictions don't apply. These restrictions only apply for "incoming" mails that have been sent via SMTP. Edit There is even a solution provided by Victor Duchovni (Postfix maintainer): ...


5

You could use restriction classes. See: http://www.postfix.net/postconf.5.html#smtpd_restriction_classes http://www.postfix.net/RESTRICTION_CLASS_README.html. For example: /etc/postfix/main.cf: smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/protected_destinations ... smtpd_restriction_classes = ...


5

You shouldn't be using DNSBL's directly. They cause too many false positives. The goal isn't necessarily to block spam, but to let all the good mail through. If you use a blacklist as an authority on what is spam, you'll have your bosses upset and nobody wants that. Instead, use a composite approach. Tools like Spam Assassin or the various anti spam ...


4

The goal of using a DNS blacklist should not be to stop all spam -- it should be to block a good percentage of the spam, say 1/2 to maybe 2/3 of it. You're mainly doing this to reduce load on your servers. The next step, the truly effective spam removal step, is a bayesian filtering engine. See Paul Grahams original article. They main benefit of bayesian ...


4

AFAIK Deny rules in Apache config and iptables have linear lookup time. Sort of. You can use chains in IPTables to break it up, i.e. a simplistic approach would be to have a chain for each A class block of addresses (e.g. 1.0.0.0/8, 2.0.0.0/8, etc.) and the rules for that block within the chain, reducing the look up time significantly (i.e. worst case ...


4

SORB provide this information on their website. I'm surprised you didn't look there first, so perhaps you meant to ask something a bit less obvious?


4

I own Exchange 2003 server and have only been blacklisted once. You must be doing something wrong to get blacklisted so much. I've fixed it by doing following: Using mxtoolbox to check my current server settings to see if IP is not blocked, and if Exchange is configured correctly (denying any sort of open gate). Create SPF record in DNS. Put exchange ...


4

A great way to manage this would be with your internal DNS server. You can setup DNS BlackHoles. Which you can set to go to 127.0.0.1 or whatever IP address you want. This is a lot more manageable and scalable. You can read up a bit more about it here: http://www.malwaredomains.com/bhdns.html


4

This is Rob McEwen, CEO of invaluement. First, while ivmSIP/24 has been around for a few years, we're always making improvements/tweaks... and we've made a number of improvements to the removal request system in just the past few weeks, some of which directly impact the suggestions I'm about to provide. (I'll also address Dmitry's comment later this message) ...


4

The techniques I use to identify spam have little to do with volume. They are bases more on how well the server complies with standards and best practices. 5,000 is a relatively small mailing list and shouldn't trigger spam classification. Getting your server correctly configured to use its FQDN and having PTR configured so you pass rDNS validation will ...


4

If you are on Hotmail's blacklist then the only way you are going to get off it is to get them to remove you, or get a new IP. If your IP is blacklisted and you don't believe it's of your doing, then you need to go back to your ISP and ask for a new one.


4

There is no way that you can send millions of emails from an Amazon instance and not have a majority of them blocked by most email systems. Amazon IP ranges are perma-banned on many black lists as well as directly on many major email provider networks, inlcuding ISPs and the major webmail providers like Gmail and Yahoo. You will be better served by using a ...


4

It's not your decision as to whether or not your emails get blocked as spam, because spammers would use the same mechanism to say "Our messages aren't spam either, honest, all these people asked for penis extension pill information, really they did, even that 11 year old boy and that 88 year old woman, honest!". There are essentially 3 reasons why a message ...


4

I would recommend to place your blacklist in iptables :) iptables -A INPUT -s 58.218.199.250 -j DROP That way you dont spend resources processing requests from unwanted ip addresses.



Only top voted, non community-wiki answers of a minimum length are eligible