My server is blacklisted with Outbound Antispam Protection working

[docilweb]

I purchased and installed Parallels Premium Outgoing Antispam. PPOA is working:

[tmp]# /etc/init.d/ctasd_initd status
Parallels Premium Outgoing Antispam (pid 8462) is running...

[root@ns1 tmp]# grep License_key_code /etc/ctasd/ctasd-out.conf
License_key_code = 0001 ... BF11 <-- (Modified to be unidentified)

... And the attached image...

But PPOA info says that only 2 emails were analyzed, when I know that were sent hundreds of emails. I paid for a service that is not working fine, and now my server is blacklisted!!! Please I need urgent help!

 

[IgorG]

Have you configured it as it is described here http://download1.parallels.com/Ples...inistrator-guide/index.htm?fileName=71442.htm ?

 

[docilweb]

Yes I configured it.

 

[docilweb]

anyone can help me? Yesterday my server was blacklisted again, and the PPOA has not blocking any spam email... PPOA has analyzed only 21 emails from more than 100 domains in 5 days!!!!!!

 

[Faris Raouf]

I realise you are under stress, but it is not helpful to make comments like that.

The main thing is to solve your problem, and to solve it as quickly as possible.

I think the best option for you would be to open a support case with Parallels. This is the quickest and simplest way to get to the bottom of things.

The difficult is that without access to your system, there's no easy way to tell exactly what's going on. It could be something simple and easy to resolve. Or it could be something nasty, like a system compromise.

 

[RuslanT]

Hello,
to detect is your installation of Parallels Premium Outgoing Antispam is working you can do following:
1. Send a email from mailbox hosted on your server to any mailbox served on the another mail server (gmail.com for instance) using any MUA (mail user agent) like thunderbird or outlook.
2. Check the mail log file: /usr/local/psa/var/log/maillog. There should be a record like records below:

Log example for Qmail:
Jan 23 18:59:00 linuxpc qmail-ctasd[30381]: OUT|IN IP: 172.20.20.222, From: root@calamar, sClass: Unknown, vClass: Unknown,
RefID: str=0001.0A0B020A.4F1D91E2.00C7,ss=1,re=0.000,fgs=0, SenderID: [email protected], Flags: 0, TMsg: 1, TSpam: 0, TSus: 0, TVirus: 0

Log example for Postfix:
Feb 12 20:04:03 commtouch ct-milter[6578]: [ASVOD] OUT|IN IP: 218.102.23.45, Sender(Auth): <[email protected]>((null)), Spam: Unknown, VOD: Unknown, RefID: str=0001.0A020201.4F37AAB3.0044:SCFSTAT1403659,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, Action: tag, Reason: global-policy, QueueId: unknown, SenderID: [email protected], Flags: 0, TMsg: 1, TSpam: 0, TSus: 0, TVirus: 0

Also you can filter your maillog for such lines:

# egrep "ctasd|ASVOD" /usr/local/psa/var/log/maillog | grep SenderID

Commands to count number of emails detected as
Spam:

# egrep "ctasd|ASVOD" /usr/local/psa/var/log/maillog | grep SenderID | egrep "Spam: Confirmed|Spam: Bulk|sClass: Confirmed|sClass: Bulk" | wc -l

Suspect Spam:

# egrep "ctasd|ASVOD" /usr/local/psa/var/log/maillog | grep SenderID | egrep "Spam: Suspect|sClass: Suspect" | wc -l

Non Spam:

# egrep "ctasd|ASVOD" /usr/local/psa/var/log/maillog | grep SenderID | egrep "Spam: NonSpam|Spam: Unknown|sClass: NonSpam|sClass: Unknown" | wc -l

Please note that commands above gives no information about date - but you can add additional filter, command below will show number of processed non spam messages during Feb 28 or March 1:

# egrep "ctasd|ASVOD" /usr/local/psa/var/log/maillog | grep SenderID | egrep "Spam: NonSpam|Spam: Unknown|sClass: NonSpam|sClass: Unknown" | egrep "Mar 1|Feb 28" | wc -l
1033

etc.

3.1. If there is no such line in the mailllog after successful email sending than add following into /etc/hosts file:

103.5.198.210 resolver1.plesk.ctmail.com
84.39.152.31 resolver2.plesk.ctmail.com
84.39.153.31 resolver3.plesk.ctmail.com
38.113.116.210 resolver4.plesk.ctmail.com
64.191.223.35 resolver5.plesk.ctmail.com

and try to switch off and switch on the Parallels Premium Outgoing Antispam and check again. If this not help - please contact Parallels Support.

3.2. If there are lines in the maillog showing that ctasd daemon have processed the email it can mean that statistics counts incorrectly. Try to apply following workaround:
1) Copy original script:

# cp /opt/ctch/ctoblogs.php /opt/ctch/ctoblogs.php.orig

2) Perform Plesk daily statistics calculation to empty maillog:

# /opt/psa/bin/sw-engine-pleskrun /opt/psa/admin/plib/DailyMaintainance/script.php

3) Edit file /opt/ctch/ctoblogs.php with your preferred editor. Locate string:

$prevdateh=date("YmdH",$lastepoch);

and comment it:

# $prevdateh=date("YmdH",$lastepoch);

Save the file.
4) Check the difference beetween modified and original files:

# diff -u /opt/ctch/ctoblogs.php.orig /opt/ctch/ctoblogs.php
--- /opt/ctch/ctoblogs.php.orig 2013-03-07 18:50:10.611244001 +0700
+++ /opt/ctch/ctoblogs.php 2013-03-07 18:53:27.051244001 +0700
@@ -221,7 +221,7 @@
$f=fopen(BASEDIR."lastepoch","r");
$lastepoch=fgets($f,4096);
fclose($f);
- $prevdateh=date("YmdH",$lastepoch);
+# $prevdateh=date("YmdH",$lastepoch);
$prevhfile=$workdir."/h".$prevdateh;
# processhourpart($prevhfile);
# $skiph=false;

5) Wait for few hours (more than 2) and compare the stats showed in the Plesk with the manually counted (see point 2).
If manually counted stats significantly greater than the Plesk shows - contact Parallels Support.