Mailing List Archive: URIBL_SBL and spamhouse problem

URIBL_SBL and spamhouse problem

Mar 14, 2024, 4:20 AM

Post #1 of 6 (100 views)

Hi
Today I get e-mail from spamhouse

"Hello Support,

I recently sent over a email regarding IP addresses querying the
Spamhaus threat feeds. The mentioned IP addresses are actively querying
our public mirrors, and exceeding our usage limits. Checking our
database, I’m unable to locate an active subscription for ..... Please
let me know if your organization has a Spamhaus license, and I’ll assist
with updating your account.

We do need to ask for your help with migrating the traffic to our
private *DQS service* for continued use. As a DQS subscriber you are
supplied with a private DNS query key, and additional data-sets to
increase your spam detection. Please click HERE
<https://www.spamhaus.com/product/data-query-service/> for additional
details on our DQS subscription.

If you are no longer interested with using Spamhaus, please let us know.
The mentioned IP addresses will go unanswered if the DNS query traffic
is not migrated. This can cause issues to your mail flows, please
ensure your mail admin is aware of this correspondence.

"
In SA i have
/var/lib/spamassassin/3.004006/updates_spamassassin_org/25_uribl.cf

How i can disable only spamhause
I can commit in
/var/lib/spamassassin/3.004006/updates_spamassassin_org/25_uribl.cf but
if I update SA probably files updated to

I have disable only spamahause rules
URIBL_SBL URIBL_CSS URIBL_SBL_A URIBL_CSS_A URIBL_ZEN_BLOCKED_OPENDNS
URIBL_ZEN_BLOCKED URIBL_DBL_SPAM URIBL_DBL_PHISH
URIBL_DBL_MALWARE URIBL_DBL_BOTNETCC URIBL_DBL_ABUSE_SPAM
URIBL_DBL_ABUSE_REDIR URIBL_DBL_ABUSE_PHISH
URIBL_DBL_ABUSE_MALW URIBL_DBL_ABUSE_BOTCC URIBL_DBL_ERROR
URIBL_DBL_BLOCKED_OPENDNS URIBL_DBL_BLOCKED

I'm afraid of how SA will react if Spamhouse blocks me

maby

--

Re: URIBL_SBL and spamhouse problem [ In reply to ]

me at junc

Mar 14, 2024, 5:13 AM

Post #2 of 6 (100 views)

Permalink

natan skrev den 2024-03-14 12:20:

> I have disable only spamahause rules
> URIBL_SBL URIBL_CSS URIBL_SBL_A URIBL_CSS_A URIBL_ZEN_BLOCKED_OPENDNS
> URIBL_ZEN_BLOCKED URIBL_DBL_SPAM URIBL_DBL_PHISH
> URIBL_DBL_MALWARE URIBL_DBL_BOTNETCC URIBL_DBL_ABUSE_SPAM
> URIBL_DBL_ABUSE_REDIR URIBL_DBL_ABUSE_PHISH
> URIBL_DBL_ABUSE_MALW URIBL_DBL_ABUSE_BOTCC URIBL_DBL_ERROR
> URIBL_DBL_BLOCKED_OPENDNS URIBL_DBL_BLOCKED
>
> I'm afraid of how SA will react if Spamhouse blocks me

all the tags blocked is not dqs

imho current spamassassin rule sets does not support dqs, tld domains
match both setups so one of them cant be disabled to only use one

hostname foo.zen.dq.spamhaus.net and foo.zen.spamhaus.net

in 00_init_dns.cf:

# dns_query_restriction (allow|deny) domain1 domain2 .
dns_query_restriction allow dq.spamhaus.net
dns_query_restriction deny zen.spamhaus.net
...

create this file, its important its named 00_something since it must be
readed first when spamd starts or amavisd or any other that uses
spamassaassin core

if still see blocked, use more deny

if just LinkedIn adminds did that knowledge :)

Re: URIBL_SBL and spamhouse problem [ In reply to ]

natan at epf

Mar 14, 2024, 8:04 AM

Post #3 of 6 (100 views)

Permalink

W dniu 14.03.2024 o 13:13, Benny Pedersen pisze:
> natan skrev den 2024-03-14 12:20:
>
>> I have disable only spamahause rules
>> URIBL_SBL URIBL_CSS URIBL_SBL_A URIBL_CSS_A URIBL_ZEN_BLOCKED_OPENDNS
>> URIBL_ZEN_BLOCKED URIBL_DBL_SPAM URIBL_DBL_PHISH
>> URIBL_DBL_MALWARE URIBL_DBL_BOTNETCC URIBL_DBL_ABUSE_SPAM
>> URIBL_DBL_ABUSE_REDIR URIBL_DBL_ABUSE_PHISH
>> URIBL_DBL_ABUSE_MALW URIBL_DBL_ABUSE_BOTCC URIBL_DBL_ERROR
>> URIBL_DBL_BLOCKED_OPENDNS URIBL_DBL_BLOCKED
>>
>> I'm afraid of how SA will react if Spamhouse blocks me
>
> all the tags blocked is not dqs
>
> imho current spamassassin rule sets does not support dqs, tld domains
> match both setups so one of them cant be disabled to only use one
>
> hostname foo.zen.dq.spamhaus.net and foo.zen.spamhaus.net
>
> in 00_init_dns.cf:
>
> # dns_query_restriction (allow|deny) domain1 domain2 .
> dns_query_restriction allow dq.spamhaus.net
> dns_query_restriction deny zen.spamhaus.net
> ...
>
In: /var/lib/spamassassin/3.004006/updates_spamassassin_org/

create 00__abuse_dns.cf
and add only:
dns_query_restriction allow dq.spamhaus.net
dns_query_restriction deny zen.spamhaus.net
?

and restart SA+amavis ?
beacuse I dont udderstand "hostname foo.zen.dq.spamhaus.net and
foo.zen.spamhaus.net"
> create this file, its important its named 00_something since it must
> be readed first when spamd starts or amavisd or any other that uses
> spamassaassin core
>
> if still see blocked, use more deny
>
> if just LinkedIn adminds did that knowledge :)
>

--

Re: URIBL_SBL and spamhouse problem [ In reply to ]

me at junc

Mar 14, 2024, 2:21 PM

Post #4 of 6 (100 views)

Permalink

natan skrev den 2024-03-14 16:04:

>> in 00_init_dns.cf:
>>
>> # dns_query_restriction (allow|deny) domain1 domain2 .
>> dns_query_restriction allow dq.spamhaus.net
>> dns_query_restriction deny zen.spamhaus.net
>> ...
> In: /var/lib/spamassassin/3.004006/updates_spamassassin_org/

do not edit or add any new files in this dir, it will wanish when you
make rule updates with sa-update

> create 00__abuse_dns.cf
> and add only:
> dns_query_restriction allow dq.spamhaus.net
> dns_query_restriction deny zen.spamhaus.net
> ?

in gentoo i have

# /etc/mail/spamassassin

where you should add 00_abuse_dns.cf

note its just readonly data

>
> and restart SA+amavis ?
> beacuse I dont udderstand "hostname foo.zen.dq.spamhaus.net and
> foo.zen.spamhaus.net"

does not matter :)

grep -r spamhaus.net
/var/lib/spamassassin/3.004006/updates_spamassassin_org/

gives a list of zone-hostnames to add to deny list above

if your dns server is bind

rndc querylog
rndc status

if last says query logging is on

then grep logs for spamhaus in your named logs

when all is well do

rndc querylog

else your logs will be filled

>
>> create this file, its important its named 00_something since it must
>> be readed first when spamd starts or amavisd or any other that uses
>> spamassaassin core
>>
>> if still see blocked, use more deny
>>
>> if just LinkedIn adminds did that knowledge :)
>
> --

Re: URIBL_SBL and spamhouse problem [ In reply to ]

natan at epf

Mar 15, 2024, 1:30 AM

Post #5 of 6 (99 views)

Permalink

Hi
Yes but this disable all URIBL_* where I use *.spamhouse.net

I have spamassassin-3.4.6 and URIBL_* works fine but payment is not so cool

W dniu 14.03.2024 o 22:21, Benny Pedersen pisze:
> natan skrev den 2024-03-14 16:04:
>
>>> in 00_init_dns.cf:
>>>
>>> # dns_query_restriction (allow|deny) domain1 domain2 .
>>> dns_query_restriction allow dq.spamhaus.net
>>> dns_query_restriction deny zen.spamhaus.net
>>> ...
>> In: /var/lib/spamassassin/3.004006/updates_spamassassin_org/
>
> do not edit or add any new files in this dir, it will wanish when you
> make rule updates with sa-update
>
>> create 00__abuse_dns.cf
>> and add only:
>> dns_query_restriction allow dq.spamhaus.net
>> dns_query_restriction deny zen.spamhaus.net
>> ?
>
> in gentoo i have
>
> # /etc/mail/spamassassin
>
> where you should add 00_abuse_dns.cf
>
> note its just readonly data
>
>>
>> and restart SA+amavis ?
>> beacuse I dont udderstand "hostname foo.zen.dq.spamhaus.net and
>> foo.zen.spamhaus.net"
>
> does not matter :)
>
> grep -r spamhaus.net
> /var/lib/spamassassin/3.004006/updates_spamassassin_org/
>
> gives a list of zone-hostnames to add to deny list above
>
> if your dns server is bind
>
> rndc querylog
> rndc status
>
> if last says query logging is on
>
> then grep logs for spamhaus in your named logs
>
> when all is well do
>
> rndc querylog
>
> else your logs will be filled
>
>
>>
>>> create this file, its important its named 00_something since it must
>>> be readed first when spamd starts or amavisd or any other that uses
>>> spamassaassin core
>>>
>>> if still see blocked, use more deny
>>>
>>> if just LinkedIn adminds did that knowledge :)
>>
>> --

--

Re: URIBL_SBL and spamhouse problem [ In reply to ]

me at junc

Mar 15, 2024, 3:23 AM

Post #6 of 6 (99 views)

Permalink

natan skrev den 2024-03-15 09:30:

> Yes but this disable all URIBL_* where I use *.spamhouse.net

i never asked you to add * !!!!

now you know your own mistake, good weekend