> On 07 Apr 2016, at 01:19, Joerg Jung <[email protected]> wrote:
>
>
>
>> Am 06.04.2016 um 16:58 schrieb Michiel van Es <[email protected]>:
>>
>>
>>> On 06 Apr 2016, at 13:52, Michiel van Es <[email protected]> wrote:
>>>
>>>
>>>> On 06 Apr 2016, at 13:38, Joerg Jung <[email protected]> wrote:
>>>>
>>>>
>>>>
>>>>> Am 06.04.2016 um 13:08 schrieb Michiel van Es <[email protected]>:
>>>>>
>>>>> Hello,
>>>>>
>>>>> I also posted this as an issue to the OpenSMTPD github repo but somebody
>>>>> told me that the mailinglist would be more accurate to post this question
>>>>> to (I will remove the github issue if preferred).
>>>>>
>>>>> it seems whenever I use filter-dnbl with several hostnames, the lookups
>>>>> always fail.
>>>>> I tried using ipv6 lookups (although this is something opensmtpd does
>>>>> right?) and have the latest version of the master branch of
>>>>> OpenSMTPD-Extras (where this ipv4/ipv6 problem was solved with an earlier
>>>>> similar issue?).
>>>>
>>>> All v6 addresses are just accepted by filter-dnsbl.
>>>> There is no lookup happening for v6 addresses
>>>> (just not implemented).
>>>
>>> ok, then I won’t use IPv6 for now :)
>>>
>>>>
>>>>> The error I get is:
>>>>> smtp-in: New session 81cf3e1a4d9ef916 from host pro-mail-smtp-001.bol.com
>>>>> [185.14.168.222] filter-pause[1337]: debug: on_connect: sleeping 5
>>>>> filter-dnsbl-spamhaus[1336]: debug: on_connect: checking
>>>>> 222.168.14.185.zen.spamhaus.org. filter-dnsbl-spamhaus[1336]: warn:
>>>>> session 81cf3e1a4d9ef916: event_dispatch: REJECT address smtp-in: Failed
>>>>> command on session 81cf3e1a4d9ef916: "" => 554 5.7.1 Address in DNSBL
>>>>> smtp-in: Closing session 81cf3e1a4d9ef916 debug: smtp: 0x24460a0:
>>>>> deleting session: done
>>>>
>>>> This looks legit.
>>>> Have you tried to lookup/verify the IP manually
>>>> at the time this happened, was it listed?
>>>
>>> No and I know this ip (its the MX for my company and they/we do checks via
>>> Nagios on most DNSBL’s)
>>> A lookup shows:
>>>
>>> 185.14.168.222 is not listed in the SBL
>>> 185.14.168.222 is not listed in the PBL
>>> 185.14.168.222 is not listed in the XBL
>>>
>>> or PTR
>>>
>>> 222.168.14.185.zen.spamhaus.org is not listed in the DBL
>>>
>>> I tried this config with the Google DNS servers and using a caching
>>> localhost dns (with forwarders to OpenNIC servers) - no difference
>>
>> Also tried with some more debugging and now tried the default SORBS dnsbl,
>> the result (with strace and smtpctl trace all):
>>
>> r_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> mproc: pony -> filter-proc : 100 IMSG_CTL_FAIL
>> filter: waiting for running query
>> 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter-pause[9835]: debug: on_connect: sleeping 5
>> filter: imsg IMSG_FILTER_RESPONSE from procfilter
>> filter-pause[hooks=0xffffffff,flags=0x0000]
>> filter: filter_drain_query 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter: running filter filter:filter-regex[hooks=0xffffffff,flags=0x0000]
>> for query 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> mproc: pony -> filter-proc : 100 IMSG_CTL_FAIL
>> filter: waiting for running query
>> 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter: imsg IMSG_FILTER_RESPONSE from procfilter
>> filter-regex[hooks=0xffffffff,flags=0x0000]
>> filter: filter_drain_query 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter: running filter
>> filter:filter-dnsbl-sorbs[hooks=0xffffffff,flags=0x0000] for query
>> 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> mproc: pony -> filter-proc : 100 IMSG_CTL_FAIL
>> filter: waiting for running query
>> 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter-dnsbl-sorbs[9834]: debug: on_connect: checking
>> 222.169.14.185.dnsbl.sorbs.net.
>> filter-dnsbl-sorbs[9834]: warn: session 511e5d1ea5ee10d1: event_dispatch:
>> REJECT address
>> filter: imsg IMSG_FILTER_RESPONSE from procfilter
>> filter-dnsbl-sorbs[hooks=0xffffffff,flags=0x0000]
>> filter: filter_drain_query 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter: filter_end_query 511e5d1fe40dcd9c[QUERY_CONNECT=178.21.114.197 <->
>> 185.14.169.222(pro-mail-smtp-002.bol.com),filter_session@0x1fc28a0[datalen=0,eom=(nil),ofile=(nil)]]
>> filter: query 511e5d1fe40dcd9c done: status=FILTER_CLOSE code=554
>> response="5.7.1 Address in DNSBL"
>> smtp: 0x20ae090: >>> 554 5.7.1 Address in DNSBL
>> smtp-in: Failed command on session 511e5d1ea5ee10d1: "" => 554 5.7.1 Address
>> in DNSBL
>> smtp: 0x20ae090: STATE_CONNECTED -> STATE_QUIT
>> smtp: 0x20ae090: IO_LOWAT <io:0x20ae0d8 fd=4 to=300000 fl=W ib=0 ob=0>
>> smtp-in: Closing session 511e5d1ea5ee10d1
>> debug: smtp: 0x20ae090: deleting session: done
>>
>> The hostname is interesting, it seems to do a lookup of
>> 222.169.14.185.dnsbl.sorbs.net. => on_connect: checking
>> 222.169.14.185.dnsbl.sorbs.net.
>>
>> Off course the . at the end makes it an invalid hostname and a check on
>> SORBS tells me the same: Bad host/domain 222.169.14.185.dnsbl.sorbs.net.
>
> The . in the end is correct (root domain).
> A "dig 222.169.14.185.dnsbl.sorbs.net." works fine
> here, nxdomain/not listed.
ok, same here
>
>> Using without the . at then end I get: [222.169.14.185.dnsbl.sorbs.net] Not
>> found in the database
>> Trying the ip and the hostname of the MX: [185.14.169.222/32] Not found in
>> the database & [pro-mail-smtp-002.bol.com] Not found in the database
>>
>> So I am a little bit lost here what is going wrong with the lookups..
>
> Maybe you have some "search domain" or
> something configured in your resolv.conf which
> is appended to each query?
no search domain
>
>> Can I have more debugging of the filter-dnsbl option?
>
> Nope, but you can try adding some more debug
> logs in the filter source.
>
> What asr version have you installed? Recent one?
>
> You can also do a tcpdump please, to see what
> exactly goes over the wire (and comes back)?
>
> Also please temporarily disable all other filters, to
> rule-out chain problems.
I installed libasr, opensmtpd and OpenSMTPD-Extras from github to ensure the
latest version.
I use the following config to only use dnsbl:
filter dnsbl dnsbl "-h" "psbl.surriel.com"
filter filter-clamav clamav
filter all chain dnsbl
filter sub chain filter-clamav
pki server.pragmasec.nl key
"/etc/letsencrypt/archive/server.pragmasec.nl/privkey1.pem"
pki server.pragmasec.nl certificate
"/etc/letsencrypt/archive/server.pragmasec.nl/fullchain1.pem"
listen on lo
listen on ens3 port 25 filter all hostname server.pragmasec.nl tls pki
server.pragmasec.nl
listen on ens3 port 587 filter sub hostname server.pragmasec.nl tls-require pki
server.pragmasec.nl auth mask-source
expire 7d
table vdomains "/usr/local/etc/vdomains"
table vusers "/usr/local/etc/vusers"
accept from any for domain <vdomains> virtual <vusers> deliver to mda
"/usr/lib/dovecot/dovecot-lda -f %{sender} -a %{rcpt}"
accept from local for any relay
tcpdump of any traffic to psbl.surriel.org: (this seems useless as the traffic
is only dns and goes to the forwarders via my dnsmasq local cache)
tcpdump -i any | grep ’74.92.59.67'
*nothing*
the error with strace and running with smtpd -d -v -T filter:
epoll_wait(3, debug: smtp: new client on listener: 0x79d0c0
smtp-in: New session 71768b23cba98cf7 from host pro-mail-smtp-001.bol.com
[185.14.168.222]
filter: post-event event=EVENT_CONNECT filter=dnsbl
filter: new query QUERY_CONNECT
filter: filter_drain_query 71768b247df9084f[QUERY_CONNECT=178.21.114.197 <->
185.14.168.222(pro-mail-smtp-001.bol.com),filter_session@0x795bc0[datalen=0,eom=(nil),ofile=(nil)]]
filter: running filter filter:dnsbl[hooks=0xffffffff,flags=0x0000] for query
71768b247df9084f[QUERY_CONNECT=178.21.114.197 <->
185.14.168.222(pro-mail-smtp-001.bol.com),filter_session@0x795bc0[datalen=0,eom=(nil),ofile=(nil)]]
filter: waiting for running query 71768b247df9084f[QUERY_CONNECT=178.21.114.197
<->
185.14.168.222(pro-mail-smtp-001.bol.com),filter_session@0x795bc0[datalen=0,eom=(nil),ofile=(nil)]]
dnsbl[22353]: debug: on_connect: checking 222.168.14.185.psbl.surriel.com.
dnsbl[22353]: warn: session 71768b23cba98cf7: event_dispatch: REJECT address
filter: imsg IMSG_FILTER_RESPONSE from procfilter
dnsbl[hooks=0xffffffff,flags=0x0000]
filter: filter_drain_query 71768b247df9084f[QUERY_CONNECT=178.21.114.197 <->
185.14.168.222(pro-mail-smtp-001.bol.com),filter_session@0x795bc0[datalen=0,eom=(nil),ofile=(nil)]]
filter: filter_end_query 71768b247df9084f[QUERY_CONNECT=178.21.114.197 <->
185.14.168.222(pro-mail-smtp-001.bol.com),filter_session@0x795bc0[datalen=0,eom=(nil),ofile=(nil)]]
filter: query 71768b247df9084f done: status=FILTER_CLOSE code=554
response="5.7.1 Address in DNSBL"
smtp-in: Failed command on session 71768b23cba98cf7: "" => 554 5.7.1 Address in
DNSBL
smtp-in: Closing session 71768b23cba98cf7
debug: smtp: 0x859c80: deleting session: done
filter: post-event event=EVENT_DISCONNECT filter=dnsbl
dnsmasq logging:
Apr 7 07:48:41 server dnsmasq[6018]: query[A] 222.168.14.185.psbl.surriel.com
from 127.0.0.1
Apr 7 07:48:41 server dnsmasq[6018]: forwarded 222.168.14.185.psbl.surriel.com
to 95.85.9.86
Apr 7 07:48:41 server dnsmasq[6018]: reply 222.168.14.185.psbl.surriel.com is
NXDOMAIN
any more pointers what could go wrong?
thanks for all the help :)
>
>>>>> My (sniplet of relevant) config is:
>>>>>
>>>>> # filters
>>>>> filter filter-pause pause
>>>>> filter filter-regex regex
>>>>> #filter filter-dnsbl-sorbs dnsbl
>>>>> #filter filter-dnsbl-surriel dnsbl "-dv" "-h psbl.surriel.com"
>>>>> #filter filter-dnsbl-spamhaus dnsbl "-h" "zen.spamhaus.org"
>>>>> filter filter-spamassassin spamassassin "-s accept"
>>>>> filter filter-clamav clamav
>>>>> #filter all chain filter-pause filter-regex filter-dnsbl-surriel
>>>>> filter-dnsbl-spamhaus filter-spamassassin filter-clamav
>>>>> filter all chain filter-pause filter-regex filter-spamassassin
>>>>> filter-clamav
>>>>> #filter all chain filter-pause filter-regex filter-dnsbl-spamhaus
>>>>> filter-spamassassin filter-clamav
>>>>> filter sub chain filter-pause filter-spamassassin filter-clamav
>>>>> # pki/ssl/certs
>>>>> pki server.pragmasec.nl key
>>>>> "/etc/letsencrypt/archive/server.pragmasec.nl/privkey1.pem"
>>>>> pki server.pragmasec.nl certificate
>>>>> "/etc/letsencrypt/archive/server.pragmasec.nl/fullchain1.pem"
>>>>> # listen
>>>>> listen on lo
>>>>> listen on eth0 port 25 filter all hostname server.pragmasec.nl tls pki
>>>>> server.pragmasec.nl
>>>>> listen on eth0 port 587 filter sub hostname server.pragmasec.nl
>>>>> tls-require pki server.pragmasec.nl auth mask-source
>>>>> # queue expiry
>>>>> expire 7d
>>>>> # virtual domains and users
>>>>> table vdomains "/usr/local/etc/vdomains"
>>>>> table vusers "/usr/local/etc/vusers"
>>>>> # our accepted relays
>>>>> accept from any for domain <vdomains> virtual <vusers> deliver to mda
>>>>> "/usr/lib/dovecot/dovecot-lda -f %{sender} -a %{rcpt}"
>>>>> accept from local for any relay
>>>>>
>>>>> Using Ubuntu 14.04.3 LTS with git branch of opensmtpd (OpenSMTPD 5.9.1p1)
>>>>>
>>>>> What can I do to troubleshoot or further investigate this?
>>>>
>>>> Validate manually with a listed and non-listed IP.
>>>> Try to rule-out local resolving problems.
>>>
>>> It seems everything is listed through the filter rule..even using Gmail or
>>> other big mail servers.
>>>
>>>>
>>>>> Are there any other spam filters that I can use or might be handy to
>>>>> follow RFC’s? for example I do use some HELO checks but I think there
>>>>> might be more then the ones I have:
>>>>>
>>>>> # reject helo with leading or trailing dot, and without dots (non-FQDN)
>>>>> # skipping address literals
>>>>> helo ! ^\[
>>>>> helo ^\.
>>>>> helo \.$
>>>>> helo ^[^\.]*$
>>>>
>>>> In general OpenSMTPD is RFC conform.
>>>> This helo check is just an additional hard restriction.
>>>>
>>>> There are other restrictions possible like enforcing
>>>> line lengths or forcing valid reverse lookups, but
>>>> these might not help but likely break legit mails.
>>>
>>> Hmm then I keep it as is, thanks for the feedback!
>>>
>>>>
>>>>> Michiel
>>>>> --
>>>>> You received this mail because you are subscribed to [email protected]
>>>>> To unsubscribe, send a mail to: [email protected]
>>>
>>>
>>> --
>>> You received this mail because you are subscribed to [email protected]
>>> To unsubscribe, send a mail to: [email protected]
>>
>>
>> --
>> You received this mail because you are subscribed to [email protected]
>> To unsubscribe, send a mail to: [email protected]
>>
>
>
> --
> You received this mail because you are subscribed to [email protected]
> To unsubscribe, send a mail to: [email protected]
>
--
You received this mail because you are subscribed to [email protected]
To unsubscribe, send a mail to: [email protected]
