Mailing List Archive: Qmail: users

QMail and Rbl => Logs ?

Index | Next | Previous | View Threaded

jerome at phibee

Feb 21, 2010, 10:33 AM

Post #1 of 10 (1988 views)
Permalink

QMail and Rbl => Logs ?

Hi

anyone know if they have a patch for qmail-smtpd or rblsmtpd for i get
into a log
the mail-from and rcpt-to of a rejeted mails ?

Thanks
jerome

--
Jerome Schevingt
Ingénieur Systèmes et Réseaux
PHIBEE
Tel: +33(0)426847860
Mobile: +33(0)607759222
Fax: +33(0)426847861
Mail: jerome [at] phibee

ar-djblists at acrconsulting

Feb 21, 2010, 11:14 AM

Post #2 of 10 (1940 views)
Permalink

Re: QMail and Rbl => Logs ? [In reply to]

On Sunday 21 February 2010 18:33:50 Jerome SCHEVINGT wrote:
> anyone know if they have a patch for qmail-smtpd or rblsmtpd for
> i get into a log the mail-from and rcpt-to of a rejeted mails ?

I've been working on a patch for rblsmtpd.c to do exactly that but not yet
added details to describe it. The raw patch is however available here,

http://free.acrconsulting.co.uk/sw/patches/rblsmtpd-logmsg-v1.0.patch

When the description is ready it will be somewhere on this site,

http://free.acrconsulting.co.uk/

probably here,

http://free.acrconsulting.co.uk/email/other.html

cheers,

Andrew.
--
====================================================================
* Custom email solutions * Systems Administration * Networking
http://www.acrconsulting.co.uk/email/qmail.html
====================================================================

mducharme at cybergeneration

Feb 22, 2010, 8:56 AM

Post #3 of 10 (1920 views)
Permalink

RE: QMail and Rbl => Logs ? [In reply to]

Hi guys

I happen to need exactly the same thing.

Thanks Andrew

Maxime Ducharme

> -----Message d'origine-----
> De : Andrew Richards [mailto:ar-djblists [at] acrconsulting]
> Envoyé : 21 février 2010 14:15
> À : qmail [at] list
> Objet : Re: QMail and Rbl => Logs ?
>
> On Sunday 21 February 2010 18:33:50 Jerome SCHEVINGT wrote:
> > anyone know if they have a patch for qmail-smtpd or rblsmtpd for
> > i get into a log the mail-from and rcpt-to of a rejeted mails ?
>
> I've been working on a patch for rblsmtpd.c to do exactly that but not yet
> added details to describe it. The raw patch is however available here,
>
> http://free.acrconsulting.co.uk/sw/patches/rblsmtpd-logmsg-v1.0.patch
>
> When the description is ready it will be somewhere on this site,
>
> http://free.acrconsulting.co.uk/
>
> probably here,
>
> http://free.acrconsulting.co.uk/email/other.html
>
> cheers,
>
> Andrew.
> --
> ====================================================================
> * Custom email solutions * Systems Administration * Networking
> http://www.acrconsulting.co.uk/email/qmail.html
> ====================================================================

ar-djblists at acrconsulting

Feb 22, 2010, 12:24 PM

Post #4 of 10 (1919 views)
Permalink

Re: QMail and Rbl => Logs ? [In reply to]

On Monday 22 February 2010 16:56:53 Maxime Ducharme wrote:
> I happen to need exactly the same thing.
>
> Thanks Andrew

My pleasure, thanks for the acknowledgement.

cheers,

Andrew.

> > -----Message d'origine-----
> > De : Andrew Richards [mailto:ar-djblists [at] acrconsulting]
> > Envoyé : 21 février 2010 14:15
> > À : qmail [at] list
> > Objet : Re: QMail and Rbl => Logs ?
> >
> > On Sunday 21 February 2010 18:33:50 Jerome SCHEVINGT wrote:
> > > anyone know if they have a patch for qmail-smtpd or rblsmtpd for
> > > i get into a log the mail-from and rcpt-to of a rejeted mails ?
> >
> > I've been working on a patch for rblsmtpd.c to do exactly that but not
> > yet added details to describe it. The raw patch is however available
> > here,
> >
> > http://free.acrconsulting.co.uk/sw/patches/rblsmtpd-logmsg-v1.0.patch
> >
> > When the description is ready it will be somewhere on this site,
> >
> > http://free.acrconsulting.co.uk/
> >
> > probably here,
> >
> > http://free.acrconsulting.co.uk/email/other.html
> >
> > cheers,
> >
> > Andrew.
--
====================================================================
* Custom email solutions * Systems Administration * Networking
http://www.acrconsulting.co.uk/email/qmail.html
====================================================================

dibl283 at gmail

Feb 22, 2010, 12:31 PM

Post #5 of 10 (1922 views)
Permalink

Re: QMail and Rbl => Logs ? [In reply to]

> anyone know if they have a patch for qmail-smtpd or rblsmtpd for i get into
> a log
> the mail-from and rcpt-to of a rejeted mails ?

See attached for my version of this type of thing. Note: My version
of qmail-smtpd.c has a few patches applied to it. The basis for the
code is netqmail-1.06. Read the man page I included for some
documentation.

The attached tar.gz file has the patches and the resulting
qmail-smtpd.c and qmail-smtpd.8 files.

As always, YMMV, but it works for me!

- David

Attachments:

qmail-smtpd.tar.gz (20.1 KB)

mducharme at cybergeneration

Feb 22, 2010, 2:33 PM

Post #6 of 10 (1919 views)
Permalink

RE: QMail and Rbl => Logs ? [In reply to]

> -----Message d'origine-----
> De : David I. Bell [mailto:dibl283 [at] gmail]
> Envoyé : 22 février 2010 15:32
> À : Jerome SCHEVINGT; Maxime Ducharme; Andrew Richards
> Cc : qmail [at] list
> Objet : Re: QMail and Rbl => Logs ?
>
> > anyone know if they have a patch for qmail-smtpd or rblsmtpd for i get
> into
> > a log
> > the mail-from and rcpt-to of a rejeted mails ?
>
> See attached for my version of this type of thing. Note: My version
> of qmail-smtpd.c has a few patches applied to it. The basis for the
> code is netqmail-1.06. Read the man page I included for some
> documentation.

Hi David, this seems interesting

>
> The attached tar.gz file has the patches and the resulting
> qmail-smtpd.c and qmail-smtpd.8 files.
>
> As always, YMMV, but it works for me!
>
> - David

I'm not sure if it fits with what we needed, I'll explain with an example.

We are hosting provider and actually blocking a lot of spam via DNSBL and
reverse DNS verification. The annoying part is when a customer calls and ask
"why I did not receive the email from my customer which is xyz [at] domain ?"

If the SMTP server's used by the customer of my customer is listed in a
DNSBL we use, rblsmtpd closes the SMTP transaction before it can see any
"mail from" or "rcpt to" addresses. This way we cannot search for a blocked
xyz [at] domain since rblsmtpd closed the communications before it could log
anything. I do not always have the contact of the sysadmin of the customer
of my customer so that’s why it become annoying since we run a high volume
of traffic and I cannot base my search on the date and time neither. Same
thing applies for reverse DNS verification.

We use tcpserver and rblsmtpd for reverse DNS verification. In fact we use
/etc/tcp.smtp to tell tcpserver to send every IPs with reverse DNS (line
which starts with a "=" sign) to our local filtering services, and other IPs
which do not have reverse DNS are actually blocked by rblsmtpd by filling
RBLSMTPD env var with a nice message :

:allow,RBLSMTPD="-No DNS PTR Record - MTA misconfigured"

Do you think the patch would allow us to log "mail from" and "rcpt to" in
that case also ?

Thanks in advance

Have a nice day

Maxime Ducharme

dibl283 at gmail

Feb 22, 2010, 2:45 PM

Post #7 of 10 (1909 views)
Permalink

Re: QMail and Rbl => Logs ? [In reply to]

Hello Maxime,

> We use tcpserver and rblsmtpd for reverse DNS verification. In fact we use
> /etc/tcp.smtp to tell tcpserver to send every IPs with reverse DNS (line
> which starts with a "=" sign) to our local filtering services, and other IPs
> which do not have reverse DNS are actually blocked by rblsmtpd by filling
> RBLSMTPD env var with a nice message :
>
> :allow,RBLSMTPD="-No DNS PTR Record - MTA misconfigured"
>
> Do you think the patch would allow us to log "mail from" and "rcpt to" in
> that case also ?

I think the code I sent you could be used as an example from which you
can create a solution for yourself. I don't think the code I sent you
will serve your exact purpose. You'll have to make your own
adaptations, but the foundation is there.

If you are not a C programmer, or do not have the time, there are
several people on the qmail list who offer professional services and
can create a solution for you.

- David Bell

mducharme at cybergeneration

Feb 22, 2010, 4:58 PM

Post #8 of 10 (1932 views)
Permalink

RE: QMail and Rbl => Logs ? [In reply to]

> -----Message d'origine-----
> De : David I. Bell [mailto:dibl283 [at] gmail]
>
> Hello Maxime,
>

Hello David

> I think the code I sent you could be used as an example from which you
> can create a solution for yourself. I don't think the code I sent you
> will serve your exact purpose. You'll have to make your own
> adaptations, but the foundation is there.

excellent

>
> If you are not a C programmer, or do not have the time, there are
> several people on the qmail list who offer professional services and
> can create a solution for you.
>
> - David Bell

Thanks for the reply, I'll add this to our possible solutions :)

Andrew : does rblsmtpd-logmsg-v1.0.patch log messages even in a case of an
empty reverse DNS instead of valid DNSBL entry ?

ar-djblists at acrconsulting

Feb 23, 2010, 12:33 AM

Post #9 of 10 (1904 views)
Permalink

Re: QMail and Rbl => Logs ? [In reply to]

On Tuesday 23 February 2010 00:58:29 you wrote:
> > -----Message d'origine-----
> > De : David I. Bell [mailto:dibl283 [at] gmail]
> >
> > I think the code I sent you could be used as an example from which you
> > can create a solution for yourself. I don't think the code I sent you
> > will serve your exact purpose. You'll have to make your own
> > adaptations, but the foundation is there.
>
> excellent
>
> > If you are not a C programmer, or do not have the time, there are
> > several people on the qmail list who offer professional services and
> > can create a solution for you.
>
> Thanks for the reply, I'll add this to our possible solutions :)
>
> Andrew : does rblsmtpd-logmsg-v1.0.patch log messages even in a case of
> an empty reverse DNS instead of valid DNSBL entry ?

If you've set RBLSMTPD as per your example,
> :allow,RBLSMTPD="-No DNS PTR Record - MTA misconfigured"

then yes, it will log the sender and recipient addresses for connections
that match that rule.

cheers,

Andrew.
--
====================================================================
* Custom email solutions * Systems Administration * Networking
http://www.acrconsulting.co.uk/email/qmail.html
====================================================================

ar-djblists at acrconsulting

Feb 23, 2010, 8:23 AM

Post #10 of 10 (1876 views)
Permalink

Re: QMail and Rbl => Logs ? [In reply to]

On Tuesday 23 February 2010 14:46:47 Jerome SCHEVINGT wrote:
> Thanks for your help and your patch.
>
> I have patched my ucspi with your patch but i don't see a change, but
> it's my config i thinks.
>
> When i am connect to my mx server:
>
> [root [at] de SOURCES]# telnet 84.14.176.235 25
> Trying 84.14.176.235...
> Connected to mx1-v4.scanerys.org (84.14.176.235).
> Escape character is '^]'.
> 220 rblsmtpd.local
>
> i see immediatly a "220 rblsmtpd.local" and i can't put mailfrom or
> rctpto i think's that your patch don't receiv this information.
>
> do you have a idea of my problems ?

The server (in this case rblsmtpd) is waiting for you to specify the sender
and recipient; once you try to send the message (DATA command) rblsmtpd
will give an error response and the session will end.

So I think you're misunderstanding SMTP: A 220 response indicates "Service
ready". Don't be distracted by the text after the 220 - the text is only
for humans, mail servers read the 220 instead.

RFC5321 is your friend (esp. the sample sessions)

cheers,

Andrew.
------------
> Le 21/02/2010 20:14, Andrew Richards a écrit :
> > On Sunday 21 February 2010 18:33:50 Jerome SCHEVINGT wrote:
> >> anyone know if they have a patch for qmail-smtpd or rblsmtpd for
> >> i get into a log the mail-from and rcpt-to of a rejeted mails ?
> >
> > I've been working on a patch for rblsmtpd.c to do exactly that but not
> > yet added details to describe it. The raw patch is however available
> > here,
> >
> > http://free.acrconsulting.co.uk/sw/patches/rblsmtpd-logmsg-v1.0.patch
> >
> > When the description is ready it will be somewhere on this site,
> >
> > http://free.acrconsulting.co.uk/
> >
> > probably here,
> >
> > http://free.acrconsulting.co.uk/email/other.html
> >
> > cheers,
> >
> > Andrew.
--
====================================================================
* Custom email solutions * Systems Administration * Networking
http://www.acrconsulting.co.uk/email/qmail.html
====================================================================

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads