Realtime Blackhole List (RBL) - qmail-dnsbl

dnsbllist: I have no idea what this file does.

Steffen Roßkamp April 7, 2015 19:18

Hi Roberto

First, thank you for your guide, which saved me countless hours getting our mailserver up and running!

I've got a problem though when trying to enable dnsbl like described here. I'm using your combined patch (current version as of now), but qmail seems not to recognize the dnsbllist file.

# qmail-showctl |grep dnsbl
dnsbllist: I have no idea what this file does.

Do you have any idea what I might have missed?

Sincerely
Steffen

Reply | Permalink

Hi Steffen, it's strange..

roberto puzzanghera Steffen Roßkamp April 7, 2015 19:43

Hi Steffen,

it's strange.. it's like you haven't patched qmail with the qmail-dnsbl patch... are you absolutely sure that you have actually patched qmail?

Reply | Permalink

OK, please discard my

Steffen Roßkamp roberto puzzanghera April 8, 2015 11:39

OK, please discard my comment.

Issue was that I had an old (timestamp indicates it's from the qmail compile before vpopmail install and patching qmail) qmail-showctl in /usr/sbin which was beeing called...

All is fine, dnsbl working as expected. Thank you!

Reply | Permalink

Yes, I have checked the

Steffen Roßkamp roberto puzzanghera April 8, 2015 10:55

Yes, I have checked the patched source files and they contain the patched lines.
I've also checked the compiled and installed binaries (qmail-smtpd and qmail-showctl) and they contain the dnsbllist string.

Indeed, very strange.

Reply | Permalink

Local User with Dynamic IP get banned

Marc September 16, 2014 10:54

Hello Roberto,

i have the problem that local users with dynamic ips get banned from list even if i use submission port 587 with this user. Is it possible to whitelist local users? Thanks for helping.

Greetings

Marc

Reply | Permalink

outgoingip

roberto puzzanghera Marc September 16, 2014 11:39

Marc, I think you can change your outgoing ip, adding it to control/outgoingip. take a look here http://notes.sagredo.eu/node/82#outgoingip

let us know if it will do the case, please

Reply | Permalink

Hi, the server has only one

Marc roberto puzzanghera September 16, 2014 12:31

Hi, the server has only one ip adress -  i know this outgoingip from another server which has more network interfaces and i don't think that  this is the reason. The user has an dynamic ip from his dsl provider, which is on zehnaus blacklist. And i thought when he use the port 587 the RBL filter is bypassed. The log shows this:
qmail-smtpd: message rejected (qmail-dnsbl) (1.1.1.1.zen.spamhaus.org): info@localdomain.xy from 1.1.1.1 to info@localdomain.xy helo PCLokal    1.1.1.1=DynamicDSL.IP.Adress from User

You wrote in the description: RBL filter *before* qmail-smtpd as rblsmtpd did is that the authenticated users who want to send messages from a remote dynamic IP will not be banned - but in this case it get banned and i don't know why. For the moment i have deleted spamhaus from the dnsbllist file and then it works for the client. But Zenhaus catches a much amount of spam an i like to use this again. Do you have another suggestion? Thanks!
 

Reply | Permalink

can you post your

roberto puzzanghera Marc September 16, 2014 12:45

can you post your qmail-submission run file and a smtp telnet session on 587 port?

Reply | Permalink

Telnet Output:telnet

Marc roberto puzzanghera September 16, 2014 13:22

Telnet Output:

telnet 127.0.0.1 587
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 xyz.net ESMTP
EHLO test
250-xyz.net
250-STARTTLS
250-PIPELINING
250-8BITMIME
250-AUTH LOGIN PLAIN
250 SIZE 30000000
mail from:mail@test.xy
250 ok
quit
221 xyz.net
Connection closed by foreign host.

submission run file:

#!/bin/sh

QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SOFTLIMIT=`cat /var/qmail/control/softlimit`

# You MUST export this, otherwise you'd get a 30 sec timeout
export SMTPAUTH=""

# This enables greetdelay for qmail-smtpd.
export SMTPD_GREETDELAY=1
export DROP_PRE_GREET=1

# This disables FORCETLS
#export FORCETLS=1

# This enables chkuser
export CHKUSER_START=ALWAYS

# This enables simscan debug
#export SIMSCAN_DEBUG=2

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
    /usr/local/bin/tcpserver -v -H -R -l 0 \
    -x /home/vpopmail/etc/tcp.submission.cdb -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \
    /var/qmail/bin/qmail-smtpd \
    /home/vpopmail/bin/vchkpw /bin/true 2>&1

Reply | Permalink

REALYCLIENT

roberto puzzanghera Marc September 16, 2014 13:39

if you want to allow your LAN to relay without authentication, use port 25 and put your localnet in the REALYCLIENT variable inside tcp.smtp...

Reply | Permalink

auth first

roberto puzzanghera Marc September 16, 2014 13:31

you are not authenticating, so it's normal that qmail-dnsbl checks for the block list and you are banned. You have to do the auth before the mail from: command, as this is not an open relay.

As an alternative you can always decide to turn off dnsbl:

Exception: If the environment variable DNSBLSKIP is set, qmail- smtpd ignores dnsbllist, and the dnsbl check is not performed. The check is skipped even if some other authentication method succedeed and authorized the client to relay (smtp-auth or tls client certificate), or if RELAYCLIENT enviromnent variable is set.

Reply | Permalink

Need some more explantion

Marc roberto puzzanghera September 16, 2014 14:30

Hello Roberto, thanks for helping. Just for clearing it more up to me, there is one thing that i didn't understand:

In the telnet sesion i missed the authentification, but when the user connects with his Mailclient to send the Mail, he gets forwarded to the submission run file and in this the authentification comes first or do i have to change something in the run file? 
And if i want to use the DNSBLSKIP parameter i have to write the following in the submission run file?:
export RBLSMTPD=""

Thanks!

Reply | Permalink

the run file is correct

roberto puzzanghera Marc September 16, 2014 14:55

the run file is correct. But you must do the auth if you want to relay with the 587 port, unless you are a RELAYCLIENT. And if you do the auth, dnsbl is turned off, so no need to use DNSBLSKIP

Anyway,

export RBLSMTPD=""

disables rblsmtpd, but we are not using it anymore, so forget.

Instead, if for some reason you want to disable qmail-dnsbl check just do this in your run file (qmail-smtpd or qmail-submission or both)

export DNSBLSKIP=""

but I can assure that it works if you do the auth

EDIT:

as already said, the simplest thing to do is assign the RELAYCLIENT on port 25 to the IPs that have to do the relay without auth (localnets for instance) and force the auth on port 587, but I guess that port 587 cannot be used without authentication.

Reply | Permalink