RE: [cobalt-users] Nuonce Antispam feature

["Crocket" <crocket@xxxxxxxxxxx>]

-----Original Message-----
On Behalf Of Peter Kuipers - Netpeople.be
Sent: zaterdag 17 april 2004 15:00

Hey list,

Is somebody familiar with this antispam solution by nuonce networks. As
found on: http://www.nuonce.net/cobalt-smtp-blackhole.php i would use it on
a raq 4 and a raq 550
-----END Original Message-----


Hi Peter,

If your goal is to use blocklists, then an easier solution is to modify your
/etc/mail/sendmail.cf file
(back up the file first !!!)
# cd /etc/mail
# cp sendmail.cf sendmail.cf.bkk20040417

then using vi or whatever editor your prefer :

Add these rules (and others if you like)


# DNS based IP address spam list relays.ordb.org
R$*                     $: $&{client_addr}
R::ffff:$-.$-.$-.$-     $: <?> $(host $4.$3.$2.$1.relays.ordb.org. $: OK $)
R$-.$-.$-.$-            $: <?> $(host $4.$3.$2.$1.relays.ordb.org. $: OK $)
R<?>OK                  $: OKSOFAR
R<?>$+                  $#error $@ 5.7.1 $: "Rejected Mail from "
$&{client_addr} " Email blocked using http://ordb.org/";

# DNS based IP address spam list bl.spamcop.net
R$*                     $: $&{client_addr}
R::ffff:$-.$-.$-.$-     $: <?> $(host $4.$3.$2.$1.bl.spamcop.net. $: OK $)
R$-.$-.$-.$-            $: <?> $(host $4.$3.$2.$1.bl.spamcop.net. $: OK $)
R<?>OK                  $: OKSOFAR
R<?>$+                  $#error $@ 5.7.1 $: "Rejected Mail from "
$&{client_addr} " Email blocked using http://spamcop.net/";

# DNS based IP address spam list sbl.spamhaus.org
R$*                     $: $&{client_addr}
R::ffff:$-.$-.$-.$-     $: <?> $(host $4.$3.$2.$1.sbl.spamhaus.org. $: OK $)
R$-.$-.$-.$-            $: <?> $(host $4.$3.$2.$1.sbl.spamhaus.org. $: OK $)
R<?>OK                  $: OKSOFAR
R<?>$+                  $#error $@ 5.7.1 $: "Rejected Mail from "
$&{client_addr} " Email blocked using http://spamhaus.org/";

# DNS based IP address spam list blackholes.mail-abuse.org
R$*                     $: $&{client_addr}
R::ffff:$-.$-.$-.$-     $: <?> $(host $4.$3.$2.$1.blackholes.mail-abuse.org.
$: OK $)
R$-.$-.$-.$-            $: <?> $(host $4.$3.$2.$1.blackholes.mail-abuse.org.
$: OK $)
R<?>OK                  $: OKSOFAR
R<?>$+                  $#error $@ 5.7.1 $: "Rejected Mail from "
$&{client_addr} " Email blocked using http://mail-abuse.org/";

right before

######################################################################
###  check_mail -- check SMTP `MAIL FROM:' command argument
######################################################################


Beware : NO SPACES but tabs
eg: R$*<tab><tab>$:

Then restart sendmail
/etc/rc.d/init.d/sendmail stop
killall -9 sendmail
/etc/rc.d/init.d/sendmail start

If you get any errors, you probably forgot to use tabs instead of spaces
somewhere.

But seeing you are from Belgium just like I am you should know that one of
our biggest providers, Telenet has been blacklisted with spamcop for 2.5
days know. We've contacted them and they are working on this. Unless you OK
all the IP's of their mailservers, or you OK *.telenet-ops.be , you will end
up blocking alot of email for now.
http://www.spamcop.net/w3m?action=checkblock&ip=195.130.132.57
I didn't feel like adding all their ip's (alot of mailservers), so I
disabled the DNSBL rules for now, hoping they'll solve the problem soon.