topic Re: deny all mails from ebay.com in Operating System - Linux

deny all mails from ebay.com

'chris' — Mon, 31 Oct 2005 10:45:32 GMT

hi

we would like to deny all mails from ebay.com on our mail appliance.

on the spam appliance I can block the mail host only with his IP address.

which IP address should I block according to:

ns1:~# dig mx ebay.com

; <<>> DiG 9.2.4 <<>> mx ebay.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7480
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 13, ADDITIONAL: 13

;; QUESTION SECTION:
;ebay.com. IN MX

;; ANSWER SECTION:
ebay.com. 330 IN MX 10 data.ebay.com.
ebay.com. 330 IN MX 10 lore.ebay.com.

;; AUTHORITY SECTION:
com. 150319 IN NS G.GTLD-SERVERS.NET.
com. 150319 IN NS H.GTLD-SERVERS.NET.
com. 150319 IN NS I.GTLD-SERVERS.NET.
com. 150319 IN NS J.GTLD-SERVERS.NET.
com. 150319 IN NS K.GTLD-SERVERS.NET.
com. 150319 IN NS L.GTLD-SERVERS.NET.
com. 150319 IN NS M.GTLD-SERVERS.NET.
com. 150319 IN NS A.GTLD-SERVERS.NET.
com. 150319 IN NS B.GTLD-SERVERS.NET.
com. 150319 IN NS C.GTLD-SERVERS.NET.
com. 150319 IN NS D.GTLD-SERVERS.NET.
com. 150319 IN NS E.GTLD-SERVERS.NET.
com. 150319 IN NS F.GTLD-SERVERS.NET.

;; ADDITIONAL SECTION:
data.ebay.com. 2595 IN A 66.135.195.180
lore.ebay.com. 2595 IN A 66.135.195.181
A.GTLD-SERVERS.NET. 44178 IN A 192.5.6.30
A.GTLD-SERVERS.NET. 150319 IN AAAA 2001:503:a83e::2:30
C.GTLD-SERVERS.NET. 44178 IN A 192.26.92.30
D.GTLD-SERVERS.NET. 44178 IN A 192.31.80.30
E.GTLD-SERVERS.NET. 102066 IN A 192.12.94.30
F.GTLD-SERVERS.NET. 44178 IN A 192.35.51.30
G.GTLD-SERVERS.NET. 44178 IN A 192.42.93.30
H.GTLD-SERVERS.NET. 44178 IN A 192.54.112.30
I.GTLD-SERVERS.NET. 44178 IN A 192.43.172.30
J.GTLD-SERVERS.NET. 44178 IN A 192.48.79.30
K.GTLD-SERVERS.NET. 44178 IN A 192.52.178.30

;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Oct 31 16:32:14 2005
;; MSG SIZE rcvd: 512

Re: deny all mails from ebay.com

Alexander Chuzhoy — Mon, 31 Oct 2005 11:00:57 GMT

If you use sendmail
you can edit the file /etc/mail/access and append a line to it:
ebay.com REJECT

restart the sendmail service after that.

Re: deny all mails from ebay.com

'chris' — Mon, 31 Oct 2005 12:29:20 GMT

sorry, but I'm using MS Exchange 5.5

Re: deny all mails from ebay.com

Alexander Chuzhoy — Tue, 01 Nov 2005 01:37:05 GMT

You still should specify the domainname rather than IP.Spammers can generate e-mails from any mail server open for relaying.Thus you can get "ebay.com" e-mails from any IP.

We don't use exchange 5.5 for years and this isn't the right forum, but you can seek for the blocking option somewhere in "connector" definitions.
I'd read the spam appliance's manual one more time-cause usually they support for whole domain blocking option.

Re: deny all mails from ebay.com

Steven E. Protter — Tue, 01 Nov 2005 01:59:26 GMT

ebay.com REJECT 550 I don't like ebay mail on my server.

Probably need to compile the hash databases.

Thats all it took to shut down mail on my servers except with me it was aol.

Realize this works both ways. It will reject any mail SENT to ebay as well.

SEP

Re: deny all mails from ebay.com

'chris' — Tue, 01 Nov 2005 05:56:48 GMT

sorry, but I'll not block mails from ebay.com on MS Exchange.
I'll block them on the spam appliance solinus:

http://www.solinus.com/mailfoundry/

MS Exchange is behind the spam appliance.
On the spam appliance I can block mails from ebay.com only with the IP addresses.

Re: deny all mails from ebay.com

Alexander Chuzhoy — Tue, 01 Nov 2005 07:33:39 GMT

This is from the website:
"The administration interface can be as detailed as creating specific filters for a single email address, system, or domain."

Thus the software supports adding domains.

The following section speacks about whitelist.I think it's going to help you to configure the desired filter.
1) Select â filtersâ from the Navigation menu.
2) Select â Whitelist Setupâ from the Filters Menu.
3) Select â *** System Domain ***â from the drop down menu.
4) Click â Goâ .
5) Click â Add an Entryâ
6) Select â Mail From Domain:â in the criteria section.
7) Enter the domain name.
8) Select the filters to be disabled in the â Disable these filtersâ section.
9) Add a comment which describes the entry (optional).
10) Select â enabledâ .
11) Click on â Addâ .

Re: deny all mails from ebay.com

'chris' — Tue, 29 Nov 2005 07:00:27 GMT

thanks Alexander,

but this is whitelist filter and not a black list filter.

under section "Disable These Filters"
I cannot find any option to block this domain.

Re: deny all mails from ebay.com

Steven E. Protter — Tue, 29 Nov 2005 08:06:28 GMT

In /etc/mail/access

ebay.com 550 REJECT

!/usr/bin/sh

#
# Steven E Protter
# This script is a mod if a port request that I made on itrc forums a few
# It builds the sendmail databases to stop spam and support virtual domains
# with sendmail 8.11 and lower 8.x versions.
# I've slighly impproved the effort of the original Jordan Bean script
# and made it compatible with being run from cron. It stops and starts the
# sendmail daemon though that is apparently unnecessary
#

/usr/sbin/newaliases
cd /etc/mail

/usr/sbin/makemap -rv dbm access_db < access
/usr/sbin/makemap -rv dbm domaintable_db < domaintable
/usr/sbin/makemap -rv dbm genericstable_db < genericstable
/usr/sbin/makemap -rv dbm mailertable_db < mailertable
/usr/sbin/makemap -rv dbm virtusertable_db < virtusertable
cp /etc/mail/sendmail.cf /root

service sendmail restart

This will block mail to ebay.com

BOTH WAYS. Inbound and outbound.

Now if you wanted to be slick about it, you could add entries to /etc/aliases or /etc/mail/virtusertable /etc/mail/genericstable that would forward the mail back to the sender. This would let you mail ebay, but is not supported and could cause the receiving server administrators to be a wee bit upset.

SEP

Re: deny all mails from ebay.com

'chris' — Tue, 29 Nov 2005 09:03:56 GMT

thanks a lot Steven,

but I'm not using sendmail

greetings
chris