Blocking SPAM in Plesk Options

[deeplist]

I am running PLESK 7.0.2 and I have a huge list of IP address that I want to block mail from. It is a list of known SPAM IPs and I do not see any kind of an area where I can add IPs that I wish to block mail from. Any ideas?

[alex042]

Block the ip's at the firewall. We do this with apf, but I would guess you could do this in the plesk firewall also. I believe you'd need to upgrade to 7.5 though because I'm not sure 7.0 has the firewall module.

[deeplist]

Okay, I didn't think there was an option like that in there. I asked before for SM to upgrade my plesk but I got an excuse. I don't remember what it was, so I never did it.

[awood]

If this is a Linux server, you can probably use IPTables to do it.

For exmaple, if you have a file "bad_ips" with each IP on a new line, you could do this:

CODE

# iptables -N bad_ips

# iptables -I INPUT 1 -j bad_ips



# cat bad_ips

1.1.1.0

1.1.1.1

1.1.1.2

1.1.1.3

1.1.1.4

2.2.2.0/24



# for i in `cat bad_ips`; do iptables -A bad_ips -s $i -j DROP; done

This will create a new chain in IPTables, "bad_ips", and force all traffic to run through that chain first. Then bash runs through the "bad_ips" file and adds each IP subnet to the bad_ips chain with the DROP target.

You might want to consider adding a good_ips chain first to prevent accidental downtime. The chain would have entires directing traffic to the ACCEPT target.

[deeplist]

I figured a way, and it really does a good job. I run all the incoming mail through the spamhaus filter and it removes well over 90% of the spam.

[JVRudnick]

can you explain please "I run all the incoming mail through the spamhaus filter..." for me?

I too have SpamAss hooked up to my Plesk cp on a w2k3 server, and I do NOT see how to add a list of IPs like from SpamHaus - ???

Jim

[deeplist]

I do not use the Spam Assasin because it does not make sence to me. In the "mail" section in Plesk, there is a "MAPS Zone" area. I put in the address "sbl-xbl.spamhaus.org" without the quotes and it runs all incomming mail through their database of blacklisted IP addresses. It actually works pretty well.

[JVRudnick]

I've just enabled same here....wonder how it'll do for my own server...hopefully, it'll work fine!

Oh, do you have to update that "sbl-xbl.spamhaus.org" link - or do the folks at Spamhaus do that automatically??

Jim

[deeplist]

Nope, they take care of everything so you don't have to worry about a thing. I know it REALLY cut down on the spam that was entering my server. Of course there will still be some because every filter is not completely 100%.

[JVRudnick]

okay...dunno if it's working (how can you tell?) but we'll give same a try...



Jim

[deeplist]

Well I guess you could wait it out and see if you receive the amount of SPAM you used to. If you don't then you know it is working.

There was an email address that you could send a message to, and it would reply with a report, but I don't remember what it was.

[JVRudnick]

would it be a part of the spamhaus site? gonna look...and if I find same, will post it back here...

thanks tho....very much!

:-)


Jim

[JVRudnick]

And it seems that (thanks deepList) that we're using the right tools....

However, this line from Spamhaus has me confused...

"...If using SpamAssassin, we reccomend you increase the value of the SBL-check feature, URIBL_SBL (by default it's set to 1 which in most cases is too low to trigger the spam flag).
..."

Anyone know where or what that might be in SpamAssasin?

Jim

[RossH]

/etc/mail/spamassassin/local.cf

However you will not see it there as plesk installs a basic spamassassin file with 4 options. I suggest you go read up on SA on their website so that you can tune it.

[JVRudnick]

I went to the SA site and carefully have read about the app. They nicely also provide a string to try a test of the SA filter to determine if you've set things up properly.

I must not have done so, as the test failed...and the help that they offer for that is to ask the people who run my "MTA filter..." which as this is a ded server, must be me....

sigh...

so I'm going to read more...

could anyone offer up a forum that deals with SA and Plesk and Mailenable?

Jim

[RossH]

There isn't one as Plesk's forum is quite the dissapointment :-( This is where a community like DirectAdmin's would come in handy as those people are great!

I'll help you with whatever you need but please read first, attempt, break and then ask questions.

[JVRudnick]

I logged into my server and ran those "testing" command lines there.

And they both passed! Cool, the spamhaus filters are now 'filtering' my server emails...

This am, I did notice that instead of the normal 200+ that I get normally every day, I got only 29 emails, which comes to me using the Mailwasher app.

I also note there that those people allow me to send to SpamCop, a list of the emails that I judge as spam - a switch that I've just toggled today for the first time. Hopefully, that info is shared among all the spam haters....

Can you offer, what else can I do to help beat back spam? For both my own server, and others too?

Jim

[RossH]

The best way to beat spam is to not buy the products people are spamming and educating others not to either.

To cut down spam you could try TP's Spirus service. Are you using all the black lists in SA? Have you gone to their config site, it contains configs with rules for blocking spam a number of different ways. You can pm me your config file, I'll make any suggestions I can.

[JVRudnick]

Hey Ross....

just a SA newbie here....so I've really NO idea on exactly what SA is doing on my server...honestly!

I am using the string to filter same as per the previous posts here...and as I said, I have run the command line tests on the server that show that the filter is working fine. My spams are down, too!

So...I've been to the SA site, and do not see any config items to copy or use...I will search on the server for that config file too..

And yes, I agree, the Plesk site forums are trash....

Jim

[alex042]

Spam's not too tough to control if you take proactive measures to control it. We not only use a combination of lists added within the plesk control panel but periodically review our logs and block abusive ips at the firewall which takes care of those pesky spam servers that those lists miss.

As for plesk forums, there's a lot of useful information and people there to help with questions so I wouldn't say it's trash.