Tag Info

Hot answers tagged

41

Here is my list and why I use them: zen.spamhaus.org - Comprehensive RBL, catches a ton of spam sources, updated regularly. They have a long history and decent reputation in the spam filtering community. I have heard some negative things about them from time to time, but those are generally without real merit. Downside is that if your volume of traffic ...


17

MxToolbox has a web-based blacklist check tool that's a good starting point. The Domain Name System Blacklists (DNSBL) and Anti-Abuse Multi-RBL Check are other great free resources for this purpose. DNSstuff also has a subscription based service called RBLalerts that will monitor 130+ blacklists for an IP address you specify and notify you if it has been ...


17

I'd suggest grabbing a sinmple firewall config tool, scuch a Firestarter, and going from there. Here are some basics for you, though. #Flush existing rules iptables -F # Set up default DROP rule for eth0 iptables -P INPUT DROP # Allow existing connections to continue iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept ...


16

No, there is no "global" list; every company maintains their own classifications. So you will have to contact each one individually.


14

Is this becoming a real problem for your users? I'd recommend a full-on mail filtering service at this point. Bayesian isn't really that hot anymore. Reputation, RBL, header/intent-analysis and other factors seem to help more. Consider a cloud filtering service to combine multiple approaches (and collective volume) to provide better protection (I use ...


13

try using iptables and building multi-level tree to decrease number of lookups. iptables -N rules_0_0_0_0_2 iptables -N rules_64_0_0_0_2 iptables -N rules_128_0_0_0_2 iptables -N rules_192_0_0_0_2 iptables -N rules_0_0_0_0_4 iptables -N rules_16_0_0_0_4 iptables -A INPUT -p tcp --dport 80 -s 0.0.0.0/2 -j rules_0_0_0_0_2 iptables -A INPUT -p tcp --dport 80 ...


11

iptables -I INPUT -s <allowed_ip> -j ACCEPT #(repeat this line as needed) iptables -P INPUT DROP This will turn your system into a non-existent system for non-allowed computers.


10

When we found ourselves categorized incorrectly in several blacklists a few months ago, we had to contact each one individually to appeal. Some useful addresses: https://www.trustedsource.org/ (McAfee) suggest@websense.com (Websense) http://www.fortiguard.com/webfiltering/webfiltering.html (FortiGuard) http://domain.opendns.com (OpenDNS)


10

you can deny access by BrowserMatch and Deny from SetEnvIf Example: SetEnvIfNoCase User-Agent "^Wget" bad_bot SetEnvIfNoCase User-Agent "^EmailSiphon" bad_bot SetEnvIfNoCase User-Agent "^EmailWolf" bad_bot <Directory "/var/www"> Order Allow,Deny Allow from all Deny from env=bad_bot </Directory> To permanenly block them ...


9

If you go to mxtoolbox.com and put in your IP, you can get a blacklist report. Your IP is on two of them: UCEPROTECTL2 UCEPROTECTL3 Click the details next to the BL in question and it will tell you why you are on there and how to remove your self. EDIT: I see that you already know that you are on the UCE Protect... Most mail admins use clearing house ...


9

You could try using moblock (google it - can't add links yet, new user). Disable all downloaded blocklists, and use only a local blocklist that you generate. You may need to add NFQUEUE (netlink queue) support to your kernel, but it may already be there by default. The general setup is: for all SYN packets on the ports you want to filter, use netfilter's ...


8

'zen.spamhaus.org' is pretty good. I recommend it.


8

This is exactly what ipset is for. From its website http://ipset.netfilter.org/: If you want to store multiple IP addresses or port numbers and match against the collection by iptables at one swoop; dynamically update iptables rules against IP addresses or ports without performance penalty; express complex IP address and ports based rulesets with one ...


8

I'm a DNS Ops guy who works closely with a group who is frequently subject to these attacks. Dealing with Snowshoe attacks is primarily a process problem, and as ewwhite points out it may beyond the scope of your company to solve in-house. I'd go as far as to say that unless you have a sizable operation and several commercial RBL feeds, you probably ...


8

Here is why I think that is a terrible idea: Contrary to what you seem to believe, spam RBLs aren't a particular good or well-liked concept. They are in widespread use only because their contribution to the anti-spam fight outweighs their numerous drawbacks (often just slightly). I am sure you have heard about errors, outages and other problems related to ...


7

Generally use this website MX TOOLBOX to find out which blacklist you are at (it can also help you to troubleshoot problems with your configuration such as good practice etc. While you're at it it will point you to blacklists you are on and will provide you with links to websites were you can remove it. Usually removing your server from blacklist happens ...


7

The easiest approach would be to time limit the blacklisting. The first time an IP is put into the DB, set the timeout for 3 days or something. On subequent submissions from that IP: The second time junk comes from an IP set the timeout for 2 weeks. The third time junk comes from that same IP set the timeout for Permanent (0) Or something similar to that, ...


7

I used to trust RBLs directly. Then I wen't to scoring with policyd-weight which is much safer (but not your question). I would only trust these RBLs for direct blocking: zen.spamhaus.org (I think it includes the CBL of Abuseat) ix.dnsbl.manitu.net (iX magazine) dnsrbl.swinog.ch (Swiss network operators group) IMPORTANT: never ever trust anything ...


6

If you want to allow arbitrary ranges rather than entire subnets, you can use the 'iprange' iptables module: iptables -P INPUT DROP iptables -A INPUT -m iprange --src-range 192.168.1.30-50 -j ACCEPT for example, will allow traffic coming from all machines with addressess between 192.168.1.30 and 192.168.1.50. If you want to allow incoming and outgoing ...


6

Try visiting their lookup and removal request page: http://dnsbl.invaluement.com/lookup/


6

This is Rob McEwen, CEO of invaluement. First, while ivmSIP/24 has been around for a few years, we're always making improvements/tweaks... and we've made a number of improvements to the removal request system in just the past few weeks, some of which directly impact the suggestions I'm about to provide. (I'll also address Dmitry's comment later this message) ...


6

You could use restriction classes. See: http://www.postfix.net/postconf.5.html#smtpd_restriction_classes http://www.postfix.net/RESTRICTION_CLASS_README.html. For example: /etc/postfix/main.cf: smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/protected_destinations ... smtpd_restriction_classes = ...


6

There are multiple tools in this space; however, I urge caution using them as many have been found to have exploits that make them worse than not having them. You will also need to decide what service you are protecting. HTTP, SMTP, POP, etc. have different tools. For example, fail2ban: http://www.fail2ban.org/wiki/index.php/Main_Page Can be customized ...


5

I would recommend to place your blacklist in iptables :) iptables -A INPUT -s 58.218.199.250 -j DROP That way you dont spend resources processing requests from unwanted ip addresses.


5

I have not tested this myself, but when I heard your problem description I instantly thought "pf" (as from OpenBSD). pf has the concept of address tables which may just be what you're looking for. According to some very cursory research I did, it would seem that this has the potential to scale better than ipset. According to the PF FAQ's chapter on Runtime ...


5

The problem is that the mail is sent via the pickup service (via sendmail inteface) and so it is an "outgoing" mail. For outgoing mail the smtpd_*_restrictions don't apply. These restrictions only apply for "incoming" mails that have been sent via SMTP. Edit There is even a solution provided by Victor Duchovni (Postfix maintainer): ...


5

You shouldn't be using DNSBL's directly. They cause too many false positives. The goal isn't necessarily to block spam, but to let all the good mail through. If you use a blacklist as an authority on what is spam, you'll have your bosses upset and nobody wants that. Instead, use a composite approach. Tools like Spam Assassin or the various anti spam ...


5

Spam messages in the postfix message queue could mean a number of things: Your mail server is acting as an open relay. An open relay means that your server is accepting messages from any client on the Internet, and relaying them onward. Open Relays are quickly picked-up by spammers and quickly blacklisted. To see if your mail server is acting as an open ...


5

I often handle support cases because of CBL listings. I have never seen a false positive. If the CBL thinks something behind your IP is infected they're most probably right. Remember that a CBL listing insn't necessarily caused by spam sent over your mailserver. Any type of bot connection using different protocols / ports from an infected laptop to a CBL ...


4

Microsoft ban whole /24 IP ranges they do not usually block a single IP, as a service provider I can tell you that it is near impossible to get MS to budge on such problems even more so when other people in the same IP range as you could be sending spam or poorly constructed emails from badly configured servers. The best solution to this is to pipe your ...



Only top voted, non community-wiki answers of a minimum length are eligible