Ispconfig and spam

[Eleanor]

is it possible to bounce spam????

now its only renaming the spam.

i want to bounce it?

[Hans]

Yes you can,

Within ISPConfig, goto the user & email tab of your website.
Then click on the Spam & antivirus tab.

Activate spamfilter for that mailbox and click on discard.
Now spam will be blocked for that mailbox.

[Eleanor]

oke that is working

but i get stil al lot of spam

can i use a automatic blacklist to disable the last spam??

[planet_fox]

when you have postfix you can run postgrey
see more here

http://howtoforge.de/greylisting_postfix_postgrey

works so good

[falko]

can i use a automatic blacklist to disable the last spam??
Have a look here: http://www.howtoforge.com/forums/showpost.php?p=46447&postcount=2

[Eleanor]

there is olso a rating system from 1 to 9

how is that working before i use somthing else or a name then i can goolge

and that postgrey is that auto updating or use spam serverlist??

can you help me

[till]

The ratings are spamassasin ratings. Postgrey is a greylisting daemon, greylisting is neither server list based nor does it need any automatic updates. Greylisting denies incoming emails for some minutes and most spam senders wont retry to send the email.

[Eleanor]

The ratings are spamassasin ratings. Postgrey is a greylisting daemon, greylisting is neither server list based nor does it need any automatic updates. Greylisting denies incoming emails for some minutes and most spam senders wont retry to send the email.

oke but how can i use it 1= lot of spam and 9 = nothing or??

what can i use to disable spam??

sorry for my english

[falko]

oke but how can i use it 1= lot of spam and 9 = nothing or??

If you use 1, it means that a lot of emails will be tagged as spam, probably you will also have false positives (emails that aren't spam get tagged as spam). 9 means that only the worst spam messages will be tagged as spam, but a lot of spam will get through.
I think you should use a value of 4 or 5, I have good experiences with that.

[Eleanor]

If you use 1, it means that a lot of emails will be tagged as spam, probably you will also have false positives (emails that aren't spam get tagged as spam). 9 means that only the worst spam messages will be tagged as spam, but a lot of spam will get through.
I think you should use a value of 4 or 5, I have good experiences with that.

ok i will try that thanks

[Eleanor]

i get still al lot of spam what can i do

can sombody advice me??

[denmaus]

i get still al lot of spam what can i do

can sombody advice me??


may be - check if your server do not run as open relay.
:confused:

[edge]

i get still al lot of spam what can i do

can sombody advice me??

I do not know if you are allready using smtpd_recipient_restrictions

If not, add the following to your postfix main.cf, and do a postfix restart
The main.cf file should be located in /etc/postfix

(note: before adding the blacklists, make sure you read, and agree to their policy!)


smtpd_recipient_restrictions =
reject_invalid_hostname,
reject_unknown_recipient_domain,
reject_unauth_pipelining,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
reject_rbl_client multi.uribl.com,
reject_rbl_client dsn.rfc-ignorant.org,
reject_rbl_client dul.dnsbl.sorbs.net,
reject_rbl_client list.dsbl.org,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client bl.spamcop.net,
# reject_rbl_client dnsbl.sorbs.net,
# reject_rbl_client opm.blitzed.org,
# reject_rbl_client blackholes.easynet.nl,
reject_rbl_client cbl.abuseat.org,
reject_rbl_client ix.dnsbl.manitu.net,
permit


The smtpd_recipient_restrictions, will do a verification agains some databases, and some other "spam used" rules.

[Eleanor]

oke i fill this in the main.cf

i will wait to see wat happened

but can i put the spam filter for al my users to the same level in 1 time and wat is default is that 5?

[martinfst]

Wow, that's a long list. Please check the policies of these blacklists do meet your requirements. I see a couple that could lead to false positives. Of course, as the server owner, you decide what the criteria you use to filter, but my humble advise is to check the main web pages of these blacklists and make sure you agree with THEIR policy. Then add them to postfix.

[edge]

Wow, that's a long list. Please check the policies of these blacklists do meet your requirements. I see a couple that could lead to false positives. Of course, as the server owner, you decide what the criteria you use to filter, but my humble advise is to check the main web pages of these blacklists and make sure you agree with THEIR policy. Then add them to postfix.

martinfst you are correct about the "their policy", and I should have mentioned this in the my post!

The list is long, and I'm using this on one of my test servers that is getting a lot of spam!

Before I started to use that "list", I did check with the sites, and as far as I can see I'm okay.

However, as you see a couple that could lead to false positives, you got me checking each one again, but I did not find any problems.

Could you please let me know what you think the "problem" blacklists could be?

Thank you

[martinfst]

reject_rbl_client multi.uribl.com,
reject_rbl_client opm.blitzed.org,
reject_rbl_client blackholes.easynet.nl,
reject_rbl_client ix.dnsbl.manitu.net,are the ones I have question marks for. sorbs.net is intensively/regularly discussed about it's policies on Postfix/Spamassassin/Exim mailings lists, IIRC. But again, the usefulness and FP rate are entirely related to your own environment. But I think it's good to be aware of the policies of blacklists providers, so you know what you add on your server. If your fine with that, it's oke for me. :)

[Eleanor]

yes i mis now a lot of mail i change it to this:

smtpd_recipient_restrictions =
reject_invalid_hostname,
reject_unknown_recipient_domain,
reject_unauth_pipelining,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
# reject_rbl_client multi.uribl.com,
reject_rbl_client dsn.rfc-ignorant.org,
reject_rbl_client dul.dnsbl.sorbs.net,
reject_rbl_client list.dsbl.org,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client bl.spamcop.net,
# reject_rbl_client dnsbl.sorbs.net,
# reject_rbl_client opm.blitzed.org,
# reject_rbl_client blackholes.easynet.nl,
reject_rbl_client cbl.abuseat.org,
# reject_rbl_client ix.dnsbl.manitu.net,
permit

is that better?????

i mis the topic mail from this site to :-(

[martinfst]

I don't think you can comment the postfix configuration like you did. The whole smtpd_recipient_restrictions = line is one configuration line. You can check with postconf -nif everything is as expected. Also please check the /var/log/mail.* files (maillog) for any errors after you restart postfix.

I'd advice to remove the # lines completely from your config.

[Eleanor]

I don't think you can comment the postfix configuration like you did. The whole smtpd_recipient_restrictions = line is one configuration line. You can check with postconf -nif everything is as expected. Also please check the /var/log/mail.* files (maillog) for any errors after you restart postfix.

I'd advice to remove the # lines completely from your config.


i did not have a error but i change it for sure

[edge]

I've been using it that way (with the #), for a long time, and did not have a problem with it.

[Eleanor]

i use this option

smtpd_recipient_restrictions =
reject_invalid_hostname,
reject_unknown_recipient_domain,
reject_unauth_pipelining,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
reject_rbl_client dsn.rfc-ignorant.org,
reject_rbl_client dul.dnsbl.sorbs.net,
reject_rbl_client list.dsbl.org,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client bl.spamcop.net,
reject_rbl_client cbl.abuseat.org,
permit

but if someone email from @geldermalsen.rabobank.nl
then i get no mail
what can i do this adres is not in the spam lists!

[martinfst]

That's because this domain is not valid::~$ dig geldermalsen.rabobank.nl

; <<>> DiG 9.3.2 <<>> geldermalsen.rabobank.nl
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18106
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;geldermalsen.rabobank.nl. IN A

;; AUTHORITY SECTION:
rabobank.nl. 586 IN SOA NS.rabobank.nl. name-it.rf.rabobank.nl. 2001082639 3600 600 1209600 600

;; Query time: 2 msec
;; SERVER: 172.16.3.70#53(172.16.3.70)
;; WHEN: Wed Jan 31 15:42:55 2007
;; MSG SIZE rcvd: 92

See? No ANSWER section. One of you reject statements is triggered by this. Don't know for sure, but I'd suspect reject_unknown_recipient_domain, or dsn.rfc-ignorant.org. Or better, ask your contact at the bank to use a valid from/return address.

[Hans]

Personally, i do not have good experience with the blacklists as mentioned within /etc/postfix/main.cf. It causes to much problems for clients.

Right now i am using Postgrey, an easy to install software package for the Postfix MTA. I have good experience with it and it works very well on an ISPConfig server.

Here you can read how to setup Postgrey for Postfix:
http://www.howtoforge.com/greylisting_postfix_postgrey