SORBS-BADCONF hasn't been tripped on the first 1,500 messages that it was checked for, but other SORBS tests are definitely producing positives...508 out of 1,500, and my server rejected 849 for being spam. Mostly it catches open relays of one sort or another. My SORBS config is as follows:
SORBS-HTTP ip4r dnsbl.sorbs.net 127.0.0.2 5 0 SORBS-SOCKS ip4r dnsbl.sorbs.net 127.0.0.3 5 0 SORBS-MISC ip4r dnsbl.sorbs.net 127.0.0.4 5 0 SORBS-SMTP ip4r dnsbl.sorbs.net 127.0.0.5 5 0 SORBS-SPAM ip4r dnsbl.sorbs.net 127.0.0.6 5 0 SORBS-WEB ip4r dnsbl.sorbs.net 127.0.0.7 5 0 SORBS-ZOMBIE ip4r dnsbl.sorbs.net 127.0.0.9 5 0 SORBS-DUL ip4r dnsbl.sorbs.net 127.0.0.10 5 0 SORBS-BADCONF ip4r dnsbl.sorbs.net 127.0.0.11 3 0 SORBS-NOMAIL ip4r dnsbl.sorbs.net 127.0.0.12 5 0
The scores are only a starting point, and I scored SORBS-BADCONF lower because I thought it might get tripped by the same data that HELOBOGUS does (this hasn't been confirmed because that SORBS filter has not been tripped).
Matt
Chuck Schick wrote:
I am trying to use Sorbs as a new black list.
I put this line in my Global config file.
SORBS-BADCONF ip4r dnsbl.sorbs.net 127.0.0.11 4 0
And I put in the following lines in both the Junkmail and the Global file
SORBS-BADCONF WARN
After running this for 24 hours I did not find the test had been triggered once.
Here are my questions:
1) Is my configuration incorrect?
2) Is it a waste of my time to use SORBS as a Blacklist?
Chuck Schick Warp 8, Inc. 303-421-5140 www.warp8.com
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- =================================================== Matthew S. Bramble President and Technical Coordinator iGaia Incorporated, Operator of NYcars.com --------------------------------------------------- Office Phone: (518) 862-9042 Cellular: (518) 229-3375 Fax: (518) 862-9044 E-mail: [EMAIL PROTECTED] or [EMAIL PROTECTED] ===================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
