I decided over the weekend to use the rblsmtpd tool on my RedHat9/Plesk 6.0 box -- but I wanted the rblsmtpd with logging enabled. I went and downloaded the binary rblsmtpd-syslog from http://www.tjsi.com/rblsmtpd/ , only to find that the binary doesn't run right on the RedHat 9.0 boxes! (something about errno... etc.). Point being -- RedHat has changed up something that causes rblsmtpd to not run correctly. I found the source RPM for ucspi-tcp (the package that contains rblsmtpd), and found that they had a patch for ucspi-tcp. I unpacked the source, applied the patch, and then copied over TJSI.com's rblsmtpd.c and compiled it all. It worked fine!

Now, you MUST make some changes to your /etc/xinetd.d/smtp_psa file.

Find the line that looks like this:
server_args = /usr/sbin/rblsmtpd -r list.dsbl.org /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd....

Before the '-r', add '-v -t 90' (without the quotes). If using pico, make sure to keep the server args line all on one line, with no breaks. Mine looks like this:

server_args = /usr/sbin/rblsmtpd -v -t 90 -r bl.spamcop.net -r relays.ordb.org -r sbl.spamhaus.org /var/qmail/bin/relaylock....

(Note that I have specified more than one block list. I personally use SpamCop on my spam, so I chose them first. There are quite a few... you can google ORDB or MAPS to find more)

Restart xinetd:
/etc/rc.d/init.d/xinetd restart

Now, anything blocked by rblsmtpd will be logged here:
/usr/local/psa/var/log/maillog

just 'grep rblsmtpd /usr/local/psa/var/log/maillog' to find all that have been blocked.

To test whether or not rblsmptd is working:

-- telnet to a localhost loopback, specifically 127.0.0.2, which is used by the MAPS servers as a testing address that is always blocked. Here is a test conversation with our newly spam-blocking mailserver:
> telnet 127.0.0.2 25

Trying 127.0.0.2...
Connected to 127.0.0.2.
Escape character is '^]'.
rblsmtpd: 127.0.0.2 pid 16511: 451 Blocked - see http://www.spamcop.net/bl.shtml?127.0.0.2
220 rblsmtpd.local
mail to:
250 rblsmtpd.local
rcpt to:
451 Blocked - see http://www.spamcop.net/bl.shtml?127.0.0.2
quit
221 rblsmtpd.local
Connection closed by foreign host.

I have posted both the modified source tree for ucspi-tcp and the prebuilt binary here: http://thelocust.org/projects/misc/