MAPS no longer working after 8.10 upgrade!

[Traged1]

After the upgrade from PLESK 8.01 to 8.10 I noticed that we are getting a ton more spam, this is becuase our MAPS is no longer working. I had a look in /etc/xinetd.d/smtp_psa file and I see this:

server_args = /usr/sbin/rblsmtpd -r cbl.abuseat.org;sbl-xbl.spamhaus.org;relays.ordb.org;bl.spamcop.net /var/qmail/bin/relaylock /var/qmail/bin/greylist /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true

This was inserted by PLESK upon the upgrade and causes the MAPS to not get checked! This is not the proper syntax for this file.

It should look like this:

server_args = /usr/sbin/rblsmtpd -r cbl.abuseat.org -r sbl-xbl.spamhaus.org -r relays.ordb.org -r bl.spamcop.net /var/qmail/bin/relaylock /var/qmail/bin/greylist /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true

Everyone should manually check this file is you are using maps and also the smtps_psa

 

[105547111]

Thanks for that

I just edited the files back and the load on spamassassin dropped to virtually nothing.

Man someone needs to write a list of all these bugs, else they never get fixed

I put in ticket on this one.

Cheers,

David

 

[dfuzion]

I had a look in /etc/xinetd.d/smtp_psa file

Hi Traged1

Thanks for your information. I could'nt understand why I have a lot more spam comming... I would like to fix that but I wasn't able to find the file you're talking about... I'm on Debian Sarge 3.1. Could you please tell me where I can find it ???

Thanks

Maybe SWSoft could also give a help...

 

[dfuzion]

Hi! I found the file you talked about.
On Debian sarge 3.1 we can find it there :
/etc/inetd.conf

What about that in your config :
/var/qmail/bin/greylist

Did you add greylisting to Plesk ? How did you made it ? I can't find infos for debian 3.1 and Plesk 8.1

Thanks

 

[Traged1]

Oh ya, sorry you should remove that qgreylist section if you are not using the greylisting for qmail.

I got the qgreylist rpm from ART's repository. You need to make sure that you are using the right rpm's for your OS and Build:

http://3es.atomicrocketturtle.com/

I highly recommend ART's rpm's if you can use them. They are very reliable and very effective.

 

[dfuzion]

Hi, i'd like to but I'm using Debian Sarge 3.1 and I cannot use ART's repository (or maybe I don't know how to do...) as they aren't for my distrib.

 

[cue79]

MAPS Question

Ok - so here's a question from someone who hasn't used MAPS up until seeing it mentioned here in this forum (yes, newbie flame all ya want ).

So the servers that I picked out of the first post here were:

cbl.abuseat.org;
sbl-xbl.spamhaus.org;
relays.ordb.org;
bl.spamcop.net

Are these the best MAPS servers to use? I tried turning it on, and a whole bunch of email was blocked by using it. Does the whitelist function (tab next to prefs in mail server config)?

Hope that makes sense - SpamAssisin just isn't doing the job sufficiently anymore.

Thanks

 

[jwdick]

Those are the most widely used. There are many others. The whitelist function works for me.

Have you ran sa-update for spamassassin? That might help update some rules.

 

[viruseater]

When you add these lists is there anything else I need to do?

Here's mine but I'm still seeing 10 to 20 spam emails coming in per hour.

I have greylist installed too.

What I don't understand is I see NOTHING in the logs. I am sure I should be seeing thr RBL rejections, but I also don't know where the greylist logs are.

Am I writing this wrong or something?

server_args = /usr/sbin/rblsmtpd -r bl.spamcop.net -r relays.ordb.org -r dnsbl.njabl.org -r KR.rbl.cluecentral.net -r TW.rbl.cluecentral.net -r SE.rbl.cluecentral.net /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true

 

[jwdick]

Your smtp_psa file should look like this IF you have greylisting installed:

server_args = /usr/sbin/rblsmtpd -r bl.spamcop.net -r relays.ordb.org -r dnsbl.njabl.org -r KR.rbl.cluecentral.net -r TW.rbl.cluecentral.net -r SE.rbl.cluecentral.net /var/qmail/bin/relaylock /var/qmail//bin/greylist /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true

Do you have the file listed in BOLD above? You should also have a greylist folder at /var/qmail/greylist that shows the ip addresses of incoming messages and a typical enter in the mail logs woudld be:

65 Dec 20 04:22:28 myserver greylist[7821]: IP 58.57.101.75 new - temp error
66 Dec 20 04:22:29 myserver greylist[7821]: SMTP: HELO: 250 hello
67 Dec 20 04:22:31 myserver greylist[7821]: SMTP: MAIL: 250 Mail from <[email protected]>
68 Dec 20 04:22:32 myserver greylist[7821]: SMTP: RCPT: 450 Rcpt to <[email protected]> - Temporary loc
al problem - try later

 

[viruseater]

No, i don't have that file. Neither do I see ANY entries 'greylist' anywhere in my logs. No rejections, no info, nothing. That's why I'm confused. I am still getting some spam, and to be honest I don't think much is being blocked but I could be wrong. I'm still getting around 10 spam emails per hour in my personal mailbox.

I am quite sure Brent installed this correctly but i think there's something missing that I need to do. I've send a couple emails to him but get no replies. So I don't know how to proceed since I don't have a clue what this program does. I had him install it for me (for $50.00)

So if someone might know where I should be looking I'd be very greatful. I don't wnat to bother Brent anymore, if he's not answering it's pretty obvious he's busy. So i'm hoping someone around here might know the answer.

Here's the site where I found him. it's his site.

http://meshier.com/2006/09/18/adding-greylisting-support-to-qmail-on-plesk-8/

 

[jwdick]

Check to see if you have the Greylist MySql database and if it has any entries.

From the control panel, click <SERVER><DATABASE SERVERS>
From the MySql line, go all the way to the right and click the database symbol. This opens phpMyAdmin and will list the server databases. You should have a greylisting database here if you have greylisting installed.

 

[viruseater]

There is no database on the server that contains the word 'greylist'.

There is a debug log in /tmp/ directory with thousands of lines of this:

protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------
protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------
protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------
protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------


Is that what it is? To be honest those look like callouts

 

[jwdick]

Originally posted by viruseater
There is no database on the server that contains the word 'greylist'.

There is a debug log in /tmp/ directory with thousands of lines of this:

protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------
protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------
protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------
protocol = notneeded4qmail [email protected] [email protected] -> [email protected] (83.30.142.172) Doesn't Exists Block
--------


Is that what it is? To be honest those look like callouts

Sorry, I have no idea what this is....

But, in my opinion, if you do not have a greylist mysql database (for standard greylisting) and you do not have the /var/qmail/greylist folder ( for Art's qgreylisting) , then you do not have greylisting installed.

 

[viruseater]

I'm sure I'll figure it out. I'm tenacious I just don't have much time, and since Plesk doesn't provide the correct source it's not as easy as a simple compile and go. So having someone else get involved makes sense.

I'm sure Brent will email me back, and I'm sure he DID install what he set out to, I just don't know the particulars.

Either way, I certainly appreciate you trying to help. Thank you.

 

[jwdick]

Hopefully your are right. Good Luck with it!

 

[Traged1]

Do this:

grep greylist /usr/local/psa/var/log/maillog

Look for log entries like

Dec 20 04:22:27 hostname greylist[14548]: SMTP: RCPT: 450 Rcpt to <[email protected]> - Temporary local problem - try later
Dec 20 04:22:28 hostname greylist[14548]: SMTP: connection closed

If you do not have any entries then qmail greylist is not installed on the server.