Re: help with an idea on how to add "rblsmtp" like blocking at the qmail scanner level.

Rance Hall wrote:
> both greylisting, and rbl checking don't work since ALL message come from 
> the ip of the relaying server.
>
>   

This really isn't a problem. Simply stop using rblsmtpd, and instead
change the scores inside SpamAssassin assigned to those RBLs  to huge
values like 500.

Then configure Qmail-Scanner for quarantining high-scoring spam and
you're done. We do that here - specifically so that we get better logs
as to who spam was going to. rblsmtpd really gives no logs of any value.

e.g. if you currently call sbl-xbl.spamhaus.org from rblsmtpd, instead
edit /etc/mail/spamassassin/local.cf and add the line:

score RCVD_IN_XBL 0 663.114 0 663.897

That will cause SA to up the score of any mail coming from an IP address
known to sbl-xbl.spamhaus.org by 663 points (ignore the decimals - I
just banged "66" in front of whatever was already there).

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642