Hi,
I'd like to weight blacklists. My current setup with four lists looks
like this:
---------
dnsrbl "ZEN" zen.spamhaus.org 127.0.0.1/8
dnsrbl "IX" ix.dnsbl.manitu.net 127.0.0.1/8
dnsrbl "JMF" hostkarma.junkemailfilter.com 127.0.0.2/32
dnsrbl "WPBL" db.wpbl.info 127.0.0.2/32
racl "BL_DNSBL" blacklist dnsrbl "ZEN" dnsrbl "IX" msg "Bad reputation -
%d [%i] listed on too many DNS blacklists: %D" flushaddr
racl "BL_DNSBL" blacklist dnsrbl "ZEN" dnsrbl "JMF" msg "Bad reputation
- %d [%i] listed on too many DNS blacklists: %D" flushaddr
racl "BL_DNSBL" blacklist dnsrbl "ZEN" dnsrbl "WPBL" msg "Bad reputation
- %d [%i] listed on too many DNS blacklists: %D" flushaddr
racl "BL_DNSBL" blacklist dnsrbl "IX" dnsrbl "JMF" msg "Bad reputation -
%d [%i] listed on too many DNS blacklists: %D" flushaddr
racl "BL_DNSBL" blacklist dnsrbl "IX" dnsrbl "WPBL" msg "Bad reputation
- %d [%i] listed on too many DNS blacklists: %D" flushaddr
racl "BL_DNSBL" blacklist dnsrbl "JMF" dnsrbl "WPBL" msg "Bad reputation
- %d [%i] listed on too many DNS blacklists: %D" flushaddr
---------
Now after upgrading to newest milter-greylist I'd like to add further
blacklists with different weights and thinking about something like this
to keep a bigger list manageable:
---------
dnsrbl "ZEN" zen.spamhaus.org 127.0.0.1/8
dnsrbl "IX" ix.dnsbl.manitu.net 127.0.0.1/8
dnsrbl "JMF" hostkarma.junkemailfilter.com 127.0.0.2/32
dnsrbl "WPBL" db.wpbl.info 127.0.0.2/32
dnsrbl "BLMAILSPIKE" bl.mailspike.net 127.0.0.0/24
[...]
racl continue rset $bl_score=0
racl continue rset $bl_listname=" "
racl continue dnsrbl "ZEN" set $bl_score+=2 set
$bl_listname="%P{bl_listname} ZEN"
racl continue dnsrbl "IX" set $bl_score+=2 set
$bl_listname="%P{bl_listname} IX"
racl continue dnsrbl "JMF" set $bl_score+=2 set
$bl_listname="%P{bl_listname} JMF"
racl continue dnsrbl "WPBL" set $bl_score+=2 set
$bl_listname="%P{bl_listname} WPBL"
racl continue dnsrbl "BLMAILSPIKE" set $bl_score+=2 set
$bl_listname="%P{bl_listname} BLMAILSPIKE"
[...]
racl "BL_DNSBL" blacklist $bl_score >= 4 msg "Bad reputation - %d [%i]
listed on too many DNS blacklists: %P{bl_listname} (hit %P{bl_score})"
flushaddr
---------
Would that work? I don't get an error when loading this config, but want
to be sure before deploying to my live host.
And how do I reset the string "bl_listname"?
There was a post by me with the subject "combine blacklists" where Jim
Klimov answered two years ago, but I didn't understand him:
"Also note that is you later add "msg" or "log" into the mix (for the
same rule hit), there is a specific order in which these can be
specified, since some keywords are considered as clauses and others
are... different ;)"
Ciao
MarcusMessage
weighting blacklists
2016-11-15 by Marcus Schopen
Attachments
- No local attachments were found for this message.