Frage Greylisting

[AWOHille]

Hallo,

mich würde mal interessieren, wie ihr zum Thema Greylisting steht bzw. wer es produktiv einsetzt. Ist es noch zeitgemäß oder sind RBL vorzuziehen oder sind beide zusammen gar empfehlenswert. Wie sind die Erfahrungen? Die Meinungen zu diesem Thema gehen ja doch recht weit auseinander.

Gruß Hille

[danu]

Seit 4 Jahren setze ich Postgrey ein. Hält ca. 80% Spam draussen. Nachteilig ist allerdings, dass von neuen Sendern die Mails eine halbe bis mehrere Stunden verzögert beim Empfänger ankommen.

[ddm3ve]

Ich nutze policyd_weight, also etwas mehr als reines blacklisting.
Dieser Dienst filtert 99,99%* des aufkommenden Spam raus.
*Das ist meine Schätzung zum Thema, es kommen im Monat nur noch wenige SPAM Mails durch, und die, die duch kommen kann man wunderbar abmahnen.

Postgrey war früher mal im Einsatz, einzelne "Nervöse" Kunden haten aber mit dem Delay von 1-2 Stunden oder je nach Absender MTA auch länger, erhebliche Probleme, was dazu führte, dass ein Admin rund 1/3 seiner Zeit mit Logfiles kontrollieren vebrachte.

Da es effektiv keinen Mehrwert gebracht hat zu policyd_weight, wurde greylisting abgestellt.

[AWOHille]

Danke erst mal für Eure Antworten.

Ja, das Problem der Verzögerung bei Greylisting ist auch für mich ein entscheidender negativer Punkt. Auf jeden Fall werde ich mal policyd_weight teste, gelesen hatte ich schon einiges darüber.

@ddm3ve mich würde mal interessieren, welchen Wert du für REJECTLEVEL nutzt?

Gruß Hille

[ddm3ve]

Ich bin da sehr restriktiv:

$REJECTLEVEL = 1;

Gelegentlich holpert es mit yahoo, hotmail und web.de.
Ich habe problematische Emailadressen und Domains in whitelists eingetragen.

Es gibt vereinzelt noch Provider die nicht RFC konform Ihre Maschinen aufgesetzt haben.

Mit en defaut Werten liefert policyd_weigth schon respektable Ergebnisse.

[AWOHille]

Welche RBL nutzt du bzw. wie setzt du da die Score ein?

[ddm3ve]

Dann meine Konfig.

Code: Select all

# ----------------------------------------------------------------
#  minimal configuration for policyd-weight
# ----------------------------------------------------------------
#$dnsbl_checks_only = 0;
#$TCP_PORT          = 12525;

# ----------------------------------------------------------------
#  policyd-weight configuration (defaults) Version 0.1.14 beta-17 
# ----------------------------------------------------------------


   $DEBUG        = 0;               # 1 or 0 - don't comment

   $REJECTMSG    = "550 Mail appeared to be SPAM or forged. Ask your Mail/DNS-Administrator to correct HELO and DNS MX settings or to get removed from DNSBLs";

   $REJECTLEVEL  = 1;               # Mails with scores which exceed this
                                    # REJECTLEVEL will be rejected

   $DEFER_STRING = 'IN_SPAMCOP= BOGUS_MX='; 
                                    # A space separated case-sensitive list of
                                    # strings on which if found in the $RET
                                    # logging-string policyd-weight changes
                                    # its action to $DEFER_ACTION in case
                                    # of rejects.
                                    # USE WITH CAUTION!
                                    # DEFAULT: "IN_SPAMCOP= BOGUS_MX="


   $DEFER_ACTION = '450';           # Possible values: DEFER_IF_PERMIT,
                                    # DEFER_IF_REJECT, 
                                    # 4xx response codes. See also access(5)
                                    # DEFAULT: 450

   $DEFER_LEVEL  = 4;               # DEFER mail only up to this level
                                    # scores greater than DEFER_LEVEL will be
                                    # rejected
                                    # DEFAULT: 5

   $DNSERRMSG         = '450 No DNS entries for your MTA, HELO and Domain. Contact YOUR administrator';

   $dnsbl_checks_only = 0;          # 1: ON, 0: OFF (default)
                                    # If ON request that ALL clients are only
                                    # checked against RBLs

   @dnsbl_checks_only_regexps = (
    # qr/[^.]*(exch|smtp|mx|mail).*\..*\../,
    # qr/yahoo.com$/
);                                  # specify a comma-separated list of regexps
                                    # for client hostnames which shall only
                                    # be RBL checked. This does not work for
                                    # postfix' "unknown" clients.
                                    # The usage of this should not be the norm
                                    # and is a tool for people which like to
                                    # shoot in their own foot.
                                    # DEFAULT: empty
                                    

   $LOG_BAD_RBL_ONLY  = 1;          # 1: ON (default), 0: OFF
                                    # When set to ON it logs only RBLs which
                                    # affect scoring (positive or negative)
                                    
## DNSBL settings
   @dnsbl_score = (
#    HOST,                    HIT SCORE,  MISS SCORE,  LOG NAME
    'pbl.spamhaus.org',       3.25,          0,        'DYN_PBL_SPAMHAUS',
    'sbl-xbl.spamhaus.org',   4.35,          0,        'SBL_XBL_SPAMHAUS',
    'bl.spamcop.net',         3.75,          0,        'SPAMCOP',
    'dnsbl.njabl.org',        4.25,          0,        'BL_NJABL',
    'list.dsbl.org',          4.35,          0,        'DSBL_ORG',
    'ix.dnsbl.manitu.net',    4.35,          0,        'IX_MANITU'
);

   $MAXDNSBLHITS  = 2;  # If Client IP is listed in MORE
                        # DNSBLS than this var, it gets
                        # REJECTed immediately

   $MAXDNSBLSCORE = 8;  # alternatively, if the score of
                        # DNSBLs is ABOVE this
                        # level, reject immediately

   $MAXDNSBLMSG   = '550 Your MTA is listed in too many DNSBLs';

## RHSBL settings
   @rhsbl_score = (
    'multi.surbl.org',             3,        0,        'SURBL',
    'rhsbl.ahbl.org',              3,        0,        'AHBL',
    'dsn.rfc-ignorant.org',        3.5,      0,        'DSN_RFCI',
    'postmaster.rfc-ignorant.org', 0.1,      0,        'PM_RFCI',
    'abuse.rfc-ignorant.org',      0.1,      0,        'ABUSE_RFCI'
);

   $BL_ERROR_SKIP     = 4;  # skip a RBL if this RBL had this many continuous
                            # errors

   $BL_SKIP_RELEASE   = 12; # skip a RBL for that many times

## cache stuff
   $LOCKPATH          = '/tmp/.policyd-weight/';    # must be a directory (add
                                                    # trailing slash)

   $SPATH             = $LOCKPATH.'polw.sock';     # socket path for the cache
                                                    # daemon. 

   $MAXIDLECACHE      = 60; # how many seconds the cache may be idle
                            # before starting maintenance routines
                           # NOTE: standard maintenance jobs happen
                            # regardless of this setting.

   $MAINTENANCE_LEVEL = 100;  # after this number of requests do following
                            # maintenance jobs:
                            # checking for config changes

# negative (i.e. SPAM) result cache settings ##################################

   $CACHESIZE       = 2000; # set to 0 to disable caching for spam results. 
                            # To this level the cache will be cleaned.

   $CACHEMAXSIZE    = 4000; # at this number of entries cleanup takes place

   $CACHEREJECTMSG  = '550 temporarily blocked because of previous errors';

   $NTTL            = 1;    # after NTTL retries the cache entry is deleted

   $NTIME           = 30;   # client MUST NOT retry within this seconds in order
                            # to decrease TTL counter


# positve (i.,e. HAM) result cache settings ###################################

   $POSCACHESIZE    = 1000; # set to 0 to disable caching of HAM. To this number
                            # of entries the cache will be cleaned

   $POSCACHEMAXSIZE = 2000; # at this number of entries cleanup takes place

   $POSCACHEMSG     = 'using cached result';

   $PTTL            = 60;   # after PTTL requests the HAM entry must
                            # succeed one time the RBL checks again

   $PTIME           = '3h'; # after $PTIME in HAM Cache the client
                            # must pass one time the RBL checks again.
                            # Values must be nonfractal. Accepted
                            # time-units: s, m, h, d

   $TEMP_PTIME      = '1d'; # The client must pass this time the RBL
                            # checks in order to be listed as hard-HAM
                            # After this time the client will pass
                            # immediately for PTTL within PTIME


## DNS settings
   $DNS_RETRIES     = 2;    # Retries for ONE DNS-Lookup

   $DNS_RETRY_IVAL  = 2;    # Retry-interval for ONE DNS-Lookup

   $MAXDNSERR       = 3;    # max error count for unresponded queries
                            # in a complete policy query
   $MAXDNSERRMSG    = 'passed - too many local DNS-errors';

   $PUDP            = 1;    # persistent udp connection for DNS queries.
                            # broken in Net::DNS version 0.51. Works with
                            # Net::DNS 0.53; DEFAULT: off

   $USE_NET_DNS     = 0;    # Force the usage of Net::DNS for RBL lookups.
                            # Normally policyd-weight tries to use a faster
                            # RBL lookup routine instead of Net::DNS


   $NS              = '';   # A list of space separated NS IPs
                            # This overrides resolv.conf settings
                            # Example: $NS = '1.2.3.4 1.2.3.5';
                            # DEFAULT: empty


   $IPC_TIMEOUT     = 2;    # timeout for receiving from cache instance

   $TRY_BALANCE     = 1;    # If set to 1 policyd-weight closes connections
                            # to smtpd clients in order to avoid too many
                            # established connections to one policyd-weight
                            # child

# scores for checks, WARNING: they may manipulate eachother
# or be factors for other scores.
#                                       HIT score, MISS Score
   @client_ip_eq_helo_score          = (1.5,       -1.25 );
   @helo_score                       = (1.5,       -2    );
   @helo_from_mx_eq_ip_score         = (1.5,       -3.1  );
   @helo_numeric_score               = (2.5,        0    );
   @from_match_regex_verified_helo   = (1,         -2    );
   @from_match_regex_unverified_helo = (1.6,       -1.5  );
   @from_match_regex_failed_helo     = (2.5,        0    );
   @helo_seems_dialup                = (1.5,        0    );
   @failed_helo_seems_dialup         = (2,          0    );
   @helo_ip_in_client_subnet         = (0,         -1.2  );
   @helo_ip_in_cl16_subnet           = (0,         -0.41 );
   @client_seems_dialup_score        = (3.75,       0    );
   @from_multiparted                 = (1.09,       0    );
   @from_anon                        = (1.17,       0    );
   @bogus_mx_score                   = (2.1,        0    );
   @random_sender_score              = (0.25,       0    );
   @rhsbl_penalty_score              = (3.1,        0    );
   @enforce_dyndns_score             = (3,          0    );


   $VERBOSE = 0;

   $ADD_X_HEADER        = 1;    # Switch on or off an additional 
                                # X-policyd-weight: header
                                # DEFAULT: on
   $DEFAULT_RESPONSE    = 'DUNNO default'; # Fallback response in case
                                           # the weighted check didn't
                                           # return any response (should never
                                           # appear).



#
# Syslogging options for verbose mode and for fatal errors.
# NOTE: comment out the $syslog_socktype line if syslogging does not
# work on your system.
#

   $syslog_socktype = 'unix';   # inet, unix, stream, console

   $syslog_facility = "mail";
   $syslog_options  = "pid";
   $syslog_priority = "info";
   $syslog_ident    = "postfix/policyd-weight";


#
# Process Options
#
   $USER            = "polw";      # User must be a username, no UID

   $GROUP           = "";          # specify GROUP if necessary
                                   # DEFAULT: empty, will be initialized as 
                                   # $USER

   $MAX_PROC        = 100;          # Upper limit if child processes
   $MIN_PROC        = 5;           # keep that minimum processes alive

   $TCP_PORT        = 12525;       # The TCP port on which policyd-weight 
                                   # listens for policy requests from postfix

   $BIND_ADDRESS    = '127.0.0.1'; # IP-Address on which policyd-weight will
                                   # listen for requests.
                                   # You may only list ONE IP here, if you want
                                   # to listen on all IPs you need to say 'all'
                                   # here. Default is '127.0.0.1'.
                                   # You need to restart policyd-weight if you
                                   # change this.

   $SOMAXCONN       = 1024;        # Maximum of client connections 
                                   # policyd-weight accepts
                                   # Default: 1024
                                   

   $CHILDIDLE       = 240;         # how many seconds a child may be idle before
                                   # it dies.

$PIDFILE         = "/var/run/policyd-weight.pid";

[AWOHille]

Beim Starten von policyd-weight kommt folgende Meldung:

Code: Select all

warning: cache_query: $csock couln't be created: connect: Datei oder Verzeichnis nicht gefunden, calling spawn_cache()

Eine Zeile später scheint aber wieder alles i.O. zu sein

Code: Select all

cache spawned

Was soll die Meldung mir sagen?

Übrigens, wer mal eine Vergleichsliste für RBL sucht, der kann hier schauen.

http://dnsbl.inps.de/index.cgi?lang=de&site=00009

[ddm3ve]

Siehe dazu den Code:

Code: Select all

my $LOCKPATH          = '/tmp/.policyd-weight/';    # must be a directory (add
                                                    # trailing slash)

my $SPATH             = $LOCKPATH.'/polw.sock';     # socket path for the cache
                                                    # daemon. 

sowie:

Code: Select all

if( (!($csock)) || ($csock && (!($csock->connected))) )
    {
        $csock = IO::Socket::UNIX->new($SPATH);
        if( (!($csock = IO::Socket::UNIX->new($SPATH))) )
        {
            if($query ne 'start')
            {
                mylog(warning=>"cache_query: \$csock couln't be created: $@, calling spawn_cache()");
            }
            else
            {
                mylog(info=>'cache_query: start: calling spawn_cache()');
            }
            spawn_cache();
            return(undef);
        }
        if( $query eq 'start')
        {
            $csock->close(); # dont inherit this socket;
            return(undef);
        }
    }

Wenn der Socket nicht vorhanden ist, wird dieser neu angelegt.
Also nur eine Warning und nichts porblematisches.