rejecting botnets with sendmail

Martin Hepworth martinh at solidstatelogic.com
Wed Nov 1 16:47:56 GMT 2006


DAve wrote:
> Denis Beauchemin wrote:
>> Andoni Auzmendi a écrit :
>>> Experiencing the recent increase in spam from botnets, is there a way to
>>> reject (or discard) connections coming from servers containing their ip
>>> address within the hostname? I can see lots of connections from
>>> broadband or dialup addresses. Some of them even bypass greylilst as
>>> they resend the messages several times. We use Sendmail here and I guess
>>> there must be a milter which is capable of doing that.
>>>
>>> Andoni Auzmendi
>>>   
>> Andoni,
>>
>> This saved us:
>> FEATURE(`dnsbl',`safe.dnsbl.sorbs.net',`"554 Rejected " 
>> $&{client_addr} " found in safe.dnsbl.sorbs.net"')dnl
> 
> What list is this? I don't see it on the sorbs.net website.
> 
> I just lost my battle with the PHB over dul.dnsbl.sorbs.net and I had to 
> remove it. Our VOIP provider (we are a reseller) has their VM server on 
> the dul list. All VM wave files have been blocked since I started using 
> dul last week to thwart a dictionary attack. I hate spammers, really, I 
> wish them all constant pain and eternal agony.
> 
> DAve
> 
>>
>> Put it in your sendmail.mc and then make your sendmail.cf from it. 
>> Last step is to restart sendmail using MailScanner's script.
>>
>> I guess you can use other RBLs but I don't know which ones to recommend.
>>
>> Denis
>>
> 
> 
for me I find the DUL RBLs too sensitive and I don't run them..

-- 
Martin Hepworth
Senior Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************



More information about the MailScanner mailing list