Comments on: Stopping SPAM BEFORE the door with Spamcop & IPTables http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm Wed, 09 Apr 2008 09:32:17 -0400 http://wordpress.org/?v=2.8.4 hourly 1 By: jt http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm/comment-page-1#comment-21 jt Thu, 08 Nov 2007 23:51:16 +0000 http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm#comment-21 That's great! A scoring system would be more appropriate in this case. How many non-existent user address has the IP tried to send to. How many SMTP session timeouts. Then when you have the scoring down you can assign a block based on hours, days, weeks or months. If you're getting many connections from one host, or the host is sending lots of spam your way. Then yes filtering the traffic would be given. But basing your filtering on an RBL that includes hosts based on user submissions is something you should re-think. Lots of ISP and small business get on the block very easily. I sound like a broken record, but I'd rather receive my mail than have it blocked entirely. Before employing SA-Exim and a lot of Exim configuration, I was getting over 150 spam emails a day. Now its 3-4, and thats with a catchall! That’s great! A scoring system would be more appropriate in this case. How many non-existent user address has the IP tried to send to. How many SMTP session timeouts. Then when you have the scoring down you can assign a block based on hours, days, weeks or months.

If you’re getting many connections from one host, or the host is sending lots of spam your way. Then yes filtering the traffic would be given. But basing your filtering on an RBL that includes hosts based on user submissions is something you should re-think. Lots of ISP and small business get on the block very easily.

I sound like a broken record, but I’d rather receive my mail than have it blocked entirely. Before employing SA-Exim and a lot of Exim configuration, I was getting over 150 spam emails a day. Now its 3-4, and thats with a catchall!

]]> By: admin http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm/comment-page-1#comment-20 admin Mon, 05 Nov 2007 19:06:27 +0000 http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm#comment-20 I understand your point. I guess what I am saying is that the user is already bounced back a message when they first get blocked via the RBL. All this script does is comb through the logs and find those RBL blocks and go one step further and block them via IP tables so as to stop further email from these IP's. BTW, since this article was posted, over 17583 IP bans have been issued. Slowly but surely the amount getting banned is smaller and smaller as the list gets larger. I understand your point. I guess what I am saying is that the user is already bounced back a message when they first get blocked via the RBL.

All this script does is comb through the logs and find those RBL blocks and go one step further and block them via IP tables so as to stop further email from these IP’s.

BTW, since this article was posted, over 17583 IP bans have been issued. Slowly but surely the amount getting banned is smaller and smaller as the list gets larger.

]]> By: jt http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm/comment-page-1#comment-19 jt Mon, 05 Nov 2007 18:35:36 +0000 http://www.worldwidecreations.com/stopping_spam_before_the_door_with_spamcop_iptables.htm#comment-19 Good Article. Spamcop is a good RBL, but has sometimes caught ISP's and other hosting companies that many people use time after time. I would rather tag SPAM, than actually remove it. I can setup a filter in my email client and I always go through my SPAM to make sure that a false gets through. One thing that works really well is sa-exim: http://marc.merlins.org/linux/exim/sa.html It's runs inside of Exim and scans messages at SMTP time. Which is good for many reasons, you're not straight out blocking the ISP so it doesn't look like a network/firewall issue. This is important, because most of the time when there is an issue with mail people will point fingers (and for customers this isn't fun). Also, you want to reject mail at SMTP. As you can send a note along with the bounced mail back to the sender. However, changing your MTA is a big hassle if you're already using one that you love. Food for thought. Good Article. Spamcop is a good RBL, but has sometimes caught ISP’s and other hosting companies that many people use time after time. I would rather tag SPAM, than actually remove it. I can setup a filter in my email client and I always go through my SPAM to make sure that a false gets through.

One thing that works really well is sa-exim:

http://marc.merlins.org/linux/exim/sa.html

It’s runs inside of Exim and scans messages at SMTP time. Which is good for many reasons, you’re not straight out blocking the ISP so it doesn’t look like a network/firewall issue. This is important, because most of the time when there is an issue with mail people will point fingers (and for customers this isn’t fun).

Also, you want to reject mail at SMTP. As you can send a note along with the bounced mail back to the sender.

However, changing your MTA is a big hassle if you’re already using one that you love. Food for thought.

]]>