Project Gamera - RBL logs

albans · **Joined:** Tue Mar 28, 2006 4:03 am **Posts:** 59

Hi,

I just installed Project Gamera on a FC2 and I'm pretty happy with it. I use it as a gateway before the Plesk server and I could get rid of DrWeb (thx to clamav).

I also edited the file rbldomains in order to use RBL lists. It works great, but I wanted to see the RBL-refused messages into my logs in order to know which MAPS server block what IP... Is it possible?
I couldn't find any entry in qmail "current" log or maillog.

Thanks.

scott · **Posted:** Tue May 16, 2006 6:24 pm

Yeah mike made a patch to send rblsmtp data to syslog. Im guessing I didnt add it in or something, and I cant find the src anywhere in my build environment. I'll poke around for it more later.

albans · **Joined:** Tue Mar 28, 2006 4:03 am **Posts:** 59

I found this: http://www.tjsi.com/rblsmtpd/

Could I replace the actual /usr/bin/rblsmtpd of the Gamera Project with the above version?
And where is stored the service smtp configuration? In xinetd.conf I couln't find any entry calling rblsmtpd...

Thanks for all thos informations!

albans · **Joined:** Tue Mar 28, 2006 4:03 am **Posts:** 59

Haaaa, found my way...

rblsmtpd is called by?!

Code:

/var/qmail/service/smtpd/run

I modified the line

Code:

rbl= "/usr/bin/rblsmtpd –t $timeout $rblopts"

with

Code:

rbl= "/usr/bin/rblsmtpd –t $timeout -v $rblopts"

And I could follow the FAQ (http://www.tjsi.com/rblsmtpd/faq/), I just had to recompile rblsmtpd with ucspi-tcp (as indicated in the above faq) >> and before that, I had to edit the file error.h to include the following line before "extern int errno;":
#include "errno.h"
(as indicated in this post: http://forum.swsoft.com/showthread.php? ... tid=113988)

But bad bad bad, it doesn't work... If I send me mails, nothing happens. As there was not SMTP service running.
I also got this message from a RBL test:

Quote:

I connected to xxx.xxx.xxx.xxx and here's the conversation I had:

Terminating conversation.

This is not a good thing, by the way. It looks like you're using tcp_wrappers to close the SMTP connection before the SMTP server even has a chance to run. This confuses some SMTP clients, so they immediately reconnect. This can happen hundreds of times per minute, which has the same effect as a denial of service attack. Much better to spit back a 5xx permanent failure message, then close the connection without waiting for a quit.

I had to copy back the original rblsmtpd in order to make my smtp server working again (I didn't not have to modify the smtpd/run file).

Could somebody help me?

Project Gamera - RBL logs

Who is online