qmail & greylisting spam control

[bmeshier]

For those looking for a simple, maintenance free spam solution, check out greylisting. It's highly effective (far more than spamassasin and the like). Before you continue, I suggest reading the white paper to get a firm grasp of what greylisting is:
http://projects.puremagic.com/greylisting/whitepaper.html

I've rolled together qmail 1.03 with greylisting support specifically compiled for Plesk servers (includes SW Soft's qmail patches). I've tested on 7.1.x, 7.5.x and 8.0.x systems. I've been running it on 4 production servers for the last 18 months, without problems. It will reduce server load dramatically on systems with high mail volume. I've repackaged qmail in to a tarball and will provide the source code upon request. I can also install on your server.

Instructions and source here:
http://meshier.com/2006/09/18/adding-greylisting-support-to-qmail-on-plesk-8/

Brent Meshier
http://carbonblock.net/
brent@carbonblock.net

 

[rvdmeer]

What is the basic retry queue time from an healty mail server?
Some told me its around 4 hours. This means that the server is not accepting the email for the first 4 hours. Unhandy if an customer is waiting for an subscripe mail..

What is your experience with this?

 

[bmeshier]

Some told me its around 4 hours.

My configuration is setup to block unknown triplets for 5 minutes. If the recipient has received mail before from that sender & IP, there is no delay. Most mail servers retry within the hour. Here is some actual research on greylisting

http://www.decf.berkeley.edu/help/mail/greylisting-stats.html

 

[rvdmeer]

Is it possible for you to create a small howto?

 

[bmeshier]

Moved:

http://meshier.com/2006/09/18/adding-greylisting-support-to-qmail-on-plesk-8/

 

[csidewebhost]

Try qgreylist available at this site. It is a simplified version of greylist but I thought it was easier to install and use.

http://www.jonatkins.com/page/software/qgreylist

 

[bmeshier]

Originally posted by csidewebhost
[http://www.jonatkins.com/page/software/qgreylist

That patch WILL NOT work with Plesk servers. My HOW-TO is for Plesk users as the forum suggests. From the qgreylist page, it clearly states that qgreylist is not compatable with SMTP AUTH., which is just one of many reasons why it doesn't work with Plesk. Also, qgreylist is not a true implementation as developed by Evan Harris (puremagic.com)

 

[rvdmeer]

bmeshier, thanks for your howto, i'll test it on the test server asap. Are you able to put this tar ball on the internet

 

[bmeshier]

Originally posted by rvdmeer
bmeshier, thanks for your howto, i'll test it on the test server asap. Are you able to put this tar ball on the internet

No, but email me, bmeshier@gmail.com and I'll send it over to you.

 

[rvdmeer]

mail was send as requested

 

[rvdmeer]

Ok, did some testing but i dont get it running.
I really do need some more security because of the current mail load. Greylisting would be perfect.. if its working.

ANy other greylisting plugins for qmail? (plesk configuration compatible)

 

[bmeshier]

I really do need some more security because of the current mail load. Greylisting would be perfect.. if its working.

ANy other greylisting plugins for qmail? (plesk configuration compatible) [/B]

What part of the installation were you having problems with? My plesk implementation is the only that exists.

 

[rvdmeer]

well.. i did everything according to the howto...
but if i do a telnet locally its accepting like it should. Also from other connections its accepting it.

... [root@extre qmail-1.03]# cp qmail-envelope-scanner /var/qmail/bin/.
[root@extre qmail-1.03]# cp -f qmail-smtpd /var/qmail/bin/.
[root@extre qmail-1.03]# chown root.qmail /var/qmail/bin/qmail-envelope-scanner
[root@extre qmail-1.03]# chown root.qmail /var/qmail/bin/qmail-smtpd
[root@extre qmail-1.03]# /etc/init.d/qmail start
Starting qmail: [ OK ]
[root@extre qmail-1.03]# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 extre.nl ESMTP
helo guest
250 extre.nl

Checked the table but no records in the table.

 

[bmeshier]

Originally posted by rvdmeer
well.. i did everything according to the howto...
but if i do a telnet locally its accepting like it should. Also from other connections its accepting it.



Checked the table but no records in the table.

Greylisting doesn't start that early in the connection. It waits until it has the sender's address:

-> MAIL FROM: <sender@somedomain.com>
<- 250 2.1.0 Sender ok
-> RCPT TO: <recipient@otherdomain.com>
<- 451 4.7.1 Please try again later

Remember, greylisting is done by a triplet (relay IP, sender, recipient)

I suggest reading the whitepaper:
http://projects.puremagic.com/greylisting/whitepaper.html

 

[rvdmeer]

that i also checked.

[root@extre qmail]# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 extre.nl ESMTP
helo guest
250 extre.nl
mail from: user@test.com
250 ok
rcpt to: rvdmeer@extre.nl
250 ok
data
354 go ahead
test
.
250 ok 1132239632 qp 31179
quit
221 extre.nl
Connection closed by foreign host.
[root@extre qmail]#

 

[bmeshier]

Originally posted by rvdmeer
that i also checked.

Did you copy the newly compiled qmail-envelope-scanner and qmail-smtpd to your qmail/bin directory and restart qmail? If so, do you have a file called /tmp/greylist_dbg.txt?

 

[rvdmeer]

yes, and i do have that file.

protocol = notneeded4qmail ronald@q-works.net
--------
protocol = notneeded4qmail
--------
protocol = notneeded4qmail
--------
protocol = notneeded4qmail ronald@ab.com
--------

 

[bmeshier]

Originally posted by rvdmeer
yes, and i do have that file.

Strange, you should see something like this:

--------
protocol = notneeded4qmail [email]anonymous@plesk.com[/email]
SQL: ret=0  |SELECT id, block_expires > NOW(), block_expires < NOW() FROM relaytofrom WHERE record_expires > NOW()  AND mail_from IS NULL AND rcpt_to IS NULL AND (relay_ip = '69.64.46.29' OR relay_ip = '69.64.46' OR relay_ip = '69.64' OR relay_ip = '69') ORDER BY length(relay_ip)|
SQL: ret=0  |SELECT id, block_expires > NOW(), block_expires < NOW() FROM relaytofrom WHERE record_expires > NOW()  AND mail_from IS NULL AND relay_ip IS NULL AND rcpt_to = 'meshier.com'|
SQL: ret=0  |SELECT id, NOW() > block_expires FROM relaytofrom WHERE record_expires > NOW() AND mail_from = 'anonymous@plesk.com'  AND rcpt_to   = 'brent@meshier.com' AND relay_ip  like '69.64.46%' order by block_expires desc|
SQL: ret=0  |update relaytofrom set record_expires = NOW() + INTERVAL 36 DAY, passed_count = passed_count + 1 where id ='259503'|
[email]anonymous@plesk.com[/email] -> [email]brent@meshier.com[/email] (69.64.46.29) Exists Accept id = 259503  expire = 1

What entries do you have in the MySQL table?

 

[rvdmeer]

Thats the problem perhaps.. it doesnt insert anything into the database. I'll checked the config several times before compiling and flushed all the permissions on sql.. still nothing...

 

[rvdmeer]

I think i got it working...

220 extre.nl ESMTP
helo there
250 extre.nl
mail from ronald@qworks.net
250 ok
rcpt to: ronald@q-works.net
421 temporary envelope failure (#4.3.0)

busy testing