FAQ: RBLSMTPD with SYSLOG

Log into your server as root (if you don't what this means, please ask your system administrator to install this).

Change to 'temporary' directory where we can work without overwriting anything:

cd ~

Download the tarball:

Extract the files from the tarball:

Change to the directory that was created by the command above:

Read the documentation for anything important that may not have made it to the FAQ yet!

Run the modified program:

This should result in the 'usage' line shown below:

Please take careful notice that the [-v] parameter is included in the message. If not, then the reply is most likely being generated by the existing rblsmtpd program which was triggered because it is in your default path. Please verify that the binary is in the current directory and that it has the correct attributes:

And you should get the following:

If the access attributes are not -rwxr-xr-x then you will need to do the following:

If the user and group are not root root then you will need to do the following:

If you are unable to get the binary to work on your server, you will have to re-compile the source (see below).

We will need to get some information about the current system configuration and make some small adjustments.

First it is necessary to know the location of the current rblsmtpd . If you don't already know where it is, you can use the following command to search your drive:

The result should show two files, the current one and the modified version. Write down the path for the original. For the sake of this FAQ, the path below will be used (from RedHat 7.2 with PSA 5.05 RPM):

Next we will copy the original to a back up and then copy the modified version over the original:

Answer "yes" when it asks you to overwrite the file.

Now we are ready to test it. You will want to send a message from an external account to a mailbox on the server and confirm that your server is properly receiving mail, it can take a couple minutes depending on the servers involved. If after about 15 min you do not receive the message, you may need to re-compile the source to get it to work on your server. So, copy the original back and follow the re-compile instructions below. Just FYI, during the short period that the non-working rblsmtpd was in place any incoming mail will be 'delayed' by the server, and it will be re-delivered later (usually within a couple hours, but could be as soon as a couple minutes). So, there should be no lost mail in the event that rblsmtpd didn't work.

At this point you have successfully installed and tested the modified version of rblsmtpd , but you are still not getting any log entries. This is normal. In order to start the logging you will need to add the -v parameter to the command that calls rblsmtpd each time an incoming message is detected. There are several programs that may be calling rblsmtpd although it is probably inetd (BSD), xinetd (RedHat) or tcpserver (part of ucspi-tcp). Due to the many ways even xinetd could be installed, I will use the following as an example. The theory is the same for all installs, but the file and path names will vary.

The last line in the /etc/xinetd.conf file reads includedir /etc/xinetd.d which causes xinetd to process all of the files in the /etc/xinetd.d/ directory. A listing of that directory reveals a file called smtp_psa so that is the file that needs to be edited in this example. Depending on your setup, your service smtp settings could be in the main xinetd.conf file. We are adding the -v right in front of the RBL server parameters, so you are looking for the same file that you used to install/configure the original rblsmtpd program. Basically, your are looking for something like this:

service smtp
{
    socket_type     = stream
    protocol        = tcp
    wait            = no
    disable         = no
    user            = root
    instances       = UNLIMITED
    server          = /var/qmail/bin/tcp-env
    server_args     = /usr/sbin/rblsmtpd -r relays.ordb.org /var/qmail/bin/relaylock
/var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true
/var/qmail/bin/cmd5checkpw /var/qmail/bin/true
}

The last command (wrapped to three lines) is the call to rblsmtpd and we will insert the -v parameter before any -r parameters:

    server_args = /usr/sbin/rblsmtpd -v -t 90 -r relays.ordb.org -r dnsbl.njabl.org -r
bl.spamcop.net -r relays.osirusoft.com -r sbl.spamhaus.org /var/qmail/bin/relaylock
/var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true
/var/qmail/bin/cmd5checkpw /var/qmail/bin/true

In the example above I have extended the timeout to 90 seconds (-t parameter) and also included a few additional RBL servers. Note that this is the correct way to use multiple servers.

When you save the file be sure that there is no line-wrap inserted by your editor (not a problem with vi).

Now, you need to give your daemon a kick to make sure it loads the changes. In my case, I use the following to force xinetd to do a 'soft restart':

Although the following may work for different configurations:

Or using the process id <pid> of the current running daemon:

Please refer to the documentation for the respective daemons to determine the appropriate command.

Finally, we need to test to see that it is working by sending the following two test messages:

If your root account is setup accordingly, you should get a reply from each of these servers indicating that the message was bounced. But more importantly, you will also be able to confirm the messages got bounced by the log entries. The entries will appear with your other mail entries. In this case it is in the /var/log/maillog so after waiting a couple minuted use the following to see the entries:

Below are some links related to this modification that may be of interest (all links open in a new window):

http://cr.yp.to/ucspi-tcp.html: source which the modification was based on.

http://forum.plesk.com/...: thread regarding this modification at the Plesk PSA Forums.

http://ns.at.com.au/rblsmtpd-with-log.tar.gz: an additional modification that logs only the IP to a specific log file.

http://forum.plesk.com/...: thread regarding the modification indicated above.

There are two things that I still need to do to this code...

1) UPDATE: There seems to be a problem running the 'rss' patched code from within certain 'wrappers' like xinetd. And, since I happen to be running xinted, I am unable to test if the 'rss' patch has been successfully implemented in a working environment (although it 'tests' just fine running on a local machine). Additionally, since I don't know of any IP's in the RBLs that do not have 'text' entries, I can't test if it is actually working either way. Curently laid a trap for a non-text IP to hit my server... As soon as I catch one I will be able to test the new code and get it out!

2) UPDATE: Successfully added the 'To' and 'From' fields to the log entries -- will be released as soon as I can get the 'rss' issues resolved.

If you happen to know of any IP addresses that are in an RBL without a 'text' record, please contact me via the e-mail address found in the rblsmtpd-syslog files (source or documentation). I am not including the address in this post only because I already get enough spam as it is! ;-)

Please read the comments in the source code or the documentation for the full disclaimer of liability.

Basically, use at your own risk. I do not make any guaranties whatsoever, that this will work for you.

This modification is free software. Permission to use, copy, modify and distribute this software for any purpose with or without fee is hereby granted, provided that the copyright notice and the permission notice appear in all copies.

However, if you would like to encourage me to continue 'customizing' software to better fit your needs, a donation is gladly accepted via PayPal using the link below. The amount of your donation is at your discretion. I will gladly reference (read advertise) any major contributors in this section of the FAQ. As you can see, no major donations to date! :-(