#
# sc_BlackList.conf, multi_dnsbl.conf
# Configuration for sc_BLcheck.pl, sc_BLpreen.pl, and Net::DNSBL::MultiDaemon
#
# version 1.02, 6-13-13
#
my $DNSBL = {
## additional KEYS may be included with an INCLUDE statement of the form:
#
# INCLUDE => 'path/to/file.conf',
#
# this file may include an INCLUDE statement, as may the next, etc...
#
#
## Net::DNSBL::MultiDaemon parameters
# the OPTIONAL name of a file that will contain 'hit' statistics for DNSBLS
# this file will be used to seed the sort order of DNSBL checking if it is
# present and will be updated with the 'added' counts of each run. If it
# is deleted, it will be recreated with a new time tag at the beginning.
#
MDstatfile => '/usr/local/spamcannibal/mdstats.txt',
# The path for the directory where the pid file will live
#
MDpidpath => '/var/run',
# The zone name for this PSEUDO DNSBL
#
MDzone => 'pseudo.dnsbl',
###### The following optional configuration parameters
###### are shown with their default values
#
# Update frequency for the "stats" file, no
# update occurs if there is no new information
#
# MDstatrefresh => 300, # seconds
# The IPaddress that the daemon will listen on.
# The default will listen on ALL interfaces,
# this is probably not what you want. A more
# suitable value for co-installation with bind
# on the same host would be 127.0.0.1
#
MDipaddr => '127.0.0.1',
# The port that the daemon will listen on
#
MDport => 12000,
# Syslog facility. Specify one of:
# LOG_EMERG LOG_ALERT LOG_CRIT LOG_ERR LOG_WARNING LOG_NOTICE LOG_INFO LOG_DEBU
#
MDsyslog => 'LOG_ERR',
# DNSBL lookup cache, uses the TTL provided by the lookup DNSBL
# this is only useful for STANDALONE operation. When used as
# an add-on to BIND, BIND will provide the caching
# cache size below 10000 will default to 10000.
# suggested cache size 20,000 to 50,000
# each cache entry takes about 400 bytes
#
# MDcache => 10000,
# Do rhbl lookups only, default false
# all other rejection classes are disabled, IGNORE, BLOCK, BBC, in-addr.arpa
# RHBL need only be "true" for operation. If OPTIONAL URBL conditioning
# is needed, then the parameters in the has must be added
RHBL => { # optional URBL preparation
urblwhite => [
'cache/white',
],
# NOTE: level 3 tld's should be first before level 2 tld's
urbltlds => [
'cache/level3',
'cache/level2',
],
},
# FOR A COMPREHENSIVE LIST OF ALL DNSBL ZONES, SEE:
# http://www.openrbl.org
# click "zones"
#
# all dnsbl servers must have a record a config entry as follows:
#
# 'zone.name' => {
acceptany => 'comment - treat any response as valid',
# # or
# accept => { # a list of codes that are ok to add to tarpit from this DNSBL
# '127.0.0.2' => 'reason',
# '127.0.0.3' => 'reason',
# },
#
# WARNING !!! DO NOT USE THIS OPTION WITH DNSBL HOSTS THAT REPORT TARPIT ACTIVITY
#
# confirm => 1, # optional, confirmation of acceptance of non - 127.0.0.2 codes
#
# response => '127.0.0.3', # optional, our default response code for records
# # added because of queries to this DNSBL server
# # this code will be ignored if it is < 127.0.0.3
# # and 127.0.0.3 will be used in its place
#
# error message to use with this host.
# NOTE: if the DNSBL supplies a TXT record and it contains the string "http://something..." or
# "www.something..." then that will be use for the error string for the matching A record.
# Otherwise, the error string below will be appended to the whatever TXT is returned by the
# DNSBL. If no TXT is returned, then the "reason" code from the "accept" line for the matching
# 127.0.0.X code will be use and the error code below will be appended.
#
# If the error string ending matches /\?.+=$/ or /\?$/
# then the offending IP address will be automagically added
#
# error => 'IP address blocked, see http://www.somehost.com?ip=',
#
# expire => '7d', # optional default expiration if DNSBL can not be reached
# # may be specified in any combination of seconds, minutes, hours, days, weeks
# # i.e. 604800 or 604800s, 10080m, 168h
# # 1w 3d
#
# timeout => 30, # default seconds to wait for dnsbl query to timeout
# WARNING!! The default timeout in sendmail for DNS queries is "5 seconds"
# If this configuration is used with Net::DNSBL::MultiDaemon it is
# recommended that the timeouts here be set to 5 seconds and that the
# timeout parameter in the SENDMAIL m4 configuration build file for lookups be
# extended to at least 15 seconds -- particularly if you invoke reverse lookups
# with the in-addr.arpa parameter below.
#
# define(`confTO_RESOLVER_RETRANS_FIRST', `15s')dnl
# or
# define(`confTO_RESOLVER_RETRANS', `15s')dnl
#
# see: http://www.sendmail.org/m4/tweaking_config.html
#
# Similar precautions must be taken for other MTA's
#
# list of RHBL's here: http://spamlinks.net/filter-dnsbl-lists.htm
# working, sample file entries
#127.0.1.2 spam domain
#127.0.1.3 spammed redirector domain
#127.0.1.4-.19 spam domain (future use)
#127.0.1.20-.39 phish domain (future use)
#127.0.1.40-.59 malware domain (future use)
#127.0.1.255 IP queries prohibited!
# test as: dbltest.com.dbl.spamhaus.org
#
'dbl.spamhaus.org' => { # see http://www.spamhaus.org/dbl/
# acceptany => 'any response is valid',
# or accept a subset
accept => {
# each IP must go in one at a time
'127.0.1.2' => 'spam domain',
'127.0.1.3' => 'spammed redirector domain',
# '127.0.1.4-.19' spam domain (future use)
# '127.0.1.20-.39' phish domain (future use)
# '127.0.1.40-.59' malware domain (future use)
# '127.0.1.255' IP queries prohibited!
},
error => 'listed in dsb.spamhouse.org',
expire => '5d',
timeout => '15',
comment => '127.0.1.2 -> 127.0.1.255',
url => 'http://www.spamhaus.org/dbl/',
},
# test as: test.surbl.org.multi.surbl.org
#
'multi.surbl.org' => { # see surbl.org
# set multi.surbl.org bit mask
# 2 = comes from SC
# 4 = comes from WS
# 8 = comes from PH
# 16 = comes from OB (OB is deprecated as of 22 October 2012.)
# 16 = comes from MW (MW active as of 1 May 2013.)
# 32 = comes from AB
# 64 = comes from JP
acceptmask => 0xDE,
# mark as URBL
urbl => 1,
error => 'listed in multi.surbl.org',
expire => '5d',
timeout => '15',
comment => '127.0.1.1 -> 127.0.1.255',
url => 'http://surbl.org/',
},
# testpoints (2.0.0.127 and test.uribl.com) are the
# only items that are cross listed
# test as: test.uribl.com.multi.uribl.com
#
'multi.uribl.com' => { # see www.uribl.com
# set multi.uribl.com bit mask
# 1 00000001 Query blocked, possibly due to high volume
# 2 00000010 black
# 4 00000100 grey
# 8 00001000 red
# 14 00001110 black,grey,red (for testpoints)
acceptmask => 0x2,
# do NOT mark as URBL
error => 'listed in multi.urbl.com',
expire => '5d',
timeout => '15',
comment => '127.0.1.1 -> 127.0.1.255',
url => 'http://www.uribl.com/',
},
# rhbl list http://spamlinks.net/filter-dnsbl-lists.htm#domain
# potential, contact before using
# rhsbl.ahbl.org
};