 |
 |
 |
 |
 |
|
Products that use the MAPS DULSM and Examples
Sendmail 8.10.x Probably the best solution for providing RBL protection and permitting roaming users, Sendmail 8.10 has support for multiple DNS based lists, local access control by IP address, and SMTP authentication via RFC 2554. Chuck Yerkes explains how:
NOTE: Sendmail 8.11 and later doesn't like commas in the error strings. The examples for Sendmail 8.11 and later should read:
Mail clients supporting SMTP AUTH include Pegasus Mail, Eudora (including free versions later than 4.0), Netscape Communicator 4.6 or later, Microsoft Outlook 98 or later (or Outlook 97 with Microsoft's Outlook Internet Mail Update), and Outlook Express 4.0 or later.
Sendmail 8.9.x If you run Sendmail 8.8, you should consider upgrading to Sendmail 8.9.3 or later which includes these features, and also a patch to support multiple DNS lists in a much cleaner manner. Once you install the mrbl.p3 patch, you can use these lines in your sendmail.cf file:
If you use FEATURE(access_db) before these rules, you can permit access from your own (possibly listed) dial-ups. Adding FEATURE(check_rcpt) with _POPAUTH_ enabled before these rules will permit relay access from DUL-listed networks, provided the user checks mail with POP3 first. NOTE: I am not by any means a Sendmail expert. I can really use a "cookbook" example of how to set up an access_db properly, how to implement _POPAUTH_ properly, and how to install the mrbl.p3 patch to support multiple DNS-based lists.
Sendmail 8.8.x with other check_* patches (Built into Sendmail 8.9.x) There are several HACKs for the check_* rule sets in Sendmail 8.8. Included in these are use of the RBL and DUL, supplying a local exclusion list, and permitting POPAUTH / POP before SMTP. An example from Claus Aßmann, author of these patches: Put at least this in your .mc file: define(`_IP_LOOKUP_') define(`_DNSVALID_') define(`_MAPS_RBL_') define(`_MAPS_RBL_2_',`dialups.mail-abuse.org') define(`_MAPS_RBL_URL_2_',`http://mail-abuse.org/dul/enduser.htm') define(`_RBLOVERRIDE_IP_') HACK(use_ip) HACK(use_relayto) HACK(check_mail3) HACK(check_rcpt4) Put local IP numbers/nets in /etc/mail/rblovrip and create the appropriate map: cd /etc/mail makemap dbm rblovrip <rblovrip General information: http://www.sendmail.org/~ca/email/check.html Further options: http://www.sendmail.org/~ca/email/chk-opt.html
Exim From Benton Bronnenburg's example for the DUL, these go in your Exim 'configure' file: This example sets up the three Lists, and excludes three networks from being blocked. Entries need to be separated by a ':'. rbl_domains = "blackholes.mail-abuse.org:dialups.mail-abuse.org" rbl_except_nets = "192.168.0.0/24:10.0.0.0/16:127.0.0.1/32"
MailShield MailShield provides a proxy server that pre-processes mail for the actual mail server. Its features include a DUL filter.
Postfix Oliver Robert made an example config for Postfix but it changed with the latest known Postfix (20010228_pl03). The following example is valid for the 20010228_pl03 version:
The "permit_mynetworks" feature lets you specify your dial-up pools as excluded from checks.
EMWAC IMS (and clones) and SCSMFILTER A replacement for SMTPRS.EXE available at http://www.fast351.com/ims/ allows blocking at the receiver level, obsoleting the antirelay plugin for SCSMFILTER. Both SMTPRCV and ANTIRELAY use the same configuration file and the same settings for controlling relay access and using MAPS projects. Do not use both SMTPRCV and ANTIRELAY at the same time. We recommend using SMTPRCV. IMS is a popular mail service for Windows NT. There is one commercial implementation (MailSite from Rockliffe) and several clones. If your mailer adds a Received: line claiming to come from "SMTPRS"", "SMTPRA", "SMTPR_" (whatever) and you run NT, you have a version of IMS. First, if you are using one of the clones or an older release of IMS (MailSite is already up to date), upgrade to IMS 0.83 from the Unofficial IMS support site. Then obtain SCSMFILTER from the same site, and the Antirelay plugin. (By Summer 1999, Antirelay will come pre-configured with SCSMFILTER.) Antirelay (written by yours-truly) provides defense against relay spammers, and supports filtering based on the RBL and DUL. Specifically, add an entry into the [dnslists] section in antirelay.ini: [dnslists] list1=blackholes.mail-abuse.org list2=dialups.mail-abuse.org Set allowlocal and allowpopauth to permit relay access to your own networks listed in [localnets], and to authorized users via POP3.
TCP Wrappers As the DUL cidr-data file was abused by third parties and subsequently removed, the example which uses tcp-wrappers is no longer useful. We recommend using a mail server or mail server add-on which produces a meaningful error message when refusing mail based on a MAPS project.
EIMS for Macintosh Newer versions (3.0.2 and later) come with prebuilt DUL filters, so hacking an existing filter is no longer required. Qualcomm's Eudora Internet Mail Server for Mac servers work immediately with the RBL, but take some editing to work with the DUL. You will need a version of ResEdit to make these changes. Thanks to Christian Mønsted and the EIMS mailing list for this one: You can get the latest RBL and ORBS filters with EIMS 2.2.1b4 from http://eudora.qualcomm.com/betas/. If you duplicate the RBL or ORBS filter, open it in ResEdit, and edit the STR# 128 resource. Change string 1 to ".dialups.mail-abuse.org" Change string 2 to "MAPS DUL blocked connection from " Change string 3 to "550 5.7.1 No trespassing - please see <http://mail-abuse.org/dul/enduser.htm>" Save and close the new filter, quit and relaunch EIMS, and it will be working. EIMS's local exclusion list allows skipping all RBL-style checks for listed addresses.
Obtuse SMTPD Christopher Schulte pointed me to an SMTPD example. SMTPD is part of the Juniper firewall kit. Smtpd can be easily configured to use the MAPS DUL. If you are already using MAPS RBL, then just add this single line to your smtpd_check_rules (or whatever file contains the connection rules) noto:RBL.dialups.mail-abuse.org:ALL:ALL:550 Mail refused from host %I in MAPS DUL, see http%C//mail-abuse.org/dul/enduser.htm Note if you have local dialup users connecting to the server to relay their mail, it's necessary to add rules that will allow local networks, if you do not have them defined already. Put these rules above DUL, since the rules are read from the top down and the first one matched is used. Keep this in mind, because it should also influence where you place the new configuration. I suggest you put all rules in this order: 1) allow statements from local source networks (so local users can send mail) 2) deny statements from MAPS services (to block incoming spam) 3) allow statements to local domains (so mail to local domains is accepted) 4) last line should be a deny (to catch all the people trying to relay, and other misc abuse) If you are not using RBL yet, you will need to patch the smtpd-2.0 source code first. See http://www.obtuse.com/smtpd.html for more info. -- Christopher Schulte http://www.schulte.org/ christopher@schulte.org
QMail QMail already supports the RBL, and the RBL patch also works with the DUL with the following instructions from Devin Carraway:
I'm still looking for a POP3 authentication example, but you might be able to accomplish something similar to the rblsmtpd exclusions above using the smtpd-poplock patch. The QMail site links to another POPAUTH example and one SMTP AUTH example.
Netscape Messaging Server 3.x Bob Poortinga maintains an example filter.cfg file at his web site. NMS does not have RBL or DUL capability built in, but you can invoke external programs using the RUN directive. He includes example .sh scripts which will work on any OS that supports them, and is developing a Perl script that will work on any OS that supports Perl, including Windows NT. More important than installing RBL or DUL capability, however, is securing the NMS server against relay theft. Bob explains how to do this properly.
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
© 1989-2005 Trend Micro Incorporated. All rights reserved. Privacy Policy. |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
