Needed to add RBL checking into sendmail as the machine was under attack by some smtp botnet. RAQ550s had no inbuilt RBL support so had to update the sendmail.cf manually.
URL: http://www.cobaltuserslist.com/CobaltUsersList/Sun-Cobalt-Users-List-76800.html
The example is a bit old… the RBLs I used are: cbl.abuseat.org , bl.spamcop.net, sbl.spamhaus.org
Cobalt list post:
RBL (Realtime Blackhole List) filtering allows your sendmail installation to block spammers from sending email to your users. If you desire to learn more on RBL, visit http://www.mail-abuse.org/rbl/. Below are two RBLs which I've included in the RBL installation; there are many other database blacklists, but for the purpose of this document, only ORDB and Spamcop are specifically discussed. I encourage that you use Spamcop and ORDB, because Spamcop maintains a catalog of the servers which are consistently sending out spam, while ORDB keeps a database of mail servers with open relays. Ensure that you backup your existing sendmail.cf to avoid damage to your server. By reading this document, you agree to indemnify and hold me harmless; I am not liable for your actions. If you want to make these changes with the sendmail configuration compiler, view this post: http://list.cobalt.com/pipermail/cobalt-users/2002-February/063883.html (After the compilation of your configuration file, you should look for important changes you should amend to the new file. Use Scooter Software Beyond Compare to look for changes.) All changes to your configuration must be done with root privileges: 1. Backup your existing sendmail.cf: su - cd /etc/mail # or where your sendmail.cf is located cp /etc/mail/sendmail.cf /etc/mail/sendmail.backup.cf 2. Search your sendmail.cf for the text below: ###################################################################### ### check_relay -- check hostname/address on SMTP startup ###################################################################### SLocal_check_relay Scheck_relay R$* $: $1 $| $>"Local_check_relay" $1 R$* $| $* $| $#$* $#$3 R$* $| $* $| $* $@ $>"Basic_check_relay" $1 $| $2 SBasic_check_relay # check for deferred delivery mode R$* $: < ${deliveryMode} > $1 R< d > $* $@ deferred R< $* > $* $: $2 R$+ $| $+ $: $>LookUpDomain < $1 > <?> < $2 > <+Connect> R<?> <$+> $: $>LookUpAddress < $1 > <?> < $1 > <+Connect> no: another lookup R<?> < $+ > $: $1 found nothing R<$={Accept}> < $* > $@ $1 return value of lookup R<REJECT> $* $#error $@ 5.7.1 $: "550 Access denied" R<DISCARD> $* $#discard $: discard R<ERROR:$-.$-.$-:$+> <$*> $#error $@ $1.$2.$3 $: $4 R<ERROR:$+> <$*> $#error $: $1 R<$+> <$*> $#error $: $1 2. Directly below it, insert the following text: # DNS based IP address spam list bl.spamcop.net R$* $: $&{client_addr} R::ffff:$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1.bl.spamcop.net. $: OK $) R$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1.bl.spamcop.net. $: OK $) R<?>OK $: OKSOFAR R<?>$+ $#error $@ 5.7.1 $: "Spam blocked see: http://spamcop.net/bl.shtml?"$&{client_addr} # DNS based IP address spam list relays.ordb.org R$* $: $&{client_addr} R::ffff:$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1.relays.ordb.org. $: OK $) R$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1.relays.ordb.org. $: OK $) R<?>OK $: OKSOFAR R<?>$+ $#error $@ 5.7.1 $: "Email blocked using ORDB.org - see <http://ORDB.org/lookup/?host="$&{client_addr}";>" 3. Keep in mind that: R<?>$+ $#error $@ 5.7.1 $: "Spam blocked see: http://spamcop.net/bl.shtml?"$&{client_addr} and... R<?>$+ $#error $@ 5.7.1 $: "Email blocked using ORDB.org - see <http://ORDB.org/lookup/?host="$&{client_addr}";>" need to be on one line (your mail client may have brought it to the next line). Each line that you add should begin with a R or a R$. 4. Save your sendmail.cf file. 5. Restart your sendmail server: su /etc/rc.d/init.d/sendmail restart 6. If you wish to include other RBLs to your configuration, append this to what has already been added: # DNS based IP address spam list another.rbl.com R$* $: $&{client_addr} R::ffff:$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1.another.rbl.com. $: OK $) R$-.$-.$-.$- $: <?> $(host $4.$3.$2.$1.another.rbl.com. $: OK $) R<?>OK $: OKSOFAR R<?>$+ $#error $@ 5.7.1 $: "Email blocked using another.rbl.com - see <http://another.rbl.com/lookup/?host="$&{client_addr}";>" Replace "another.rbl.com" with the RBL of your choice and add this to the bottom of your SpamCop and/or ORDB configuration. Each line should begin with a R or R$. You may also wish to use Mailscanner (http://www.sng.ecs.soton.ac.uk/mailscanner) which scans and filters your email for viruses and spam. It uses an optional SpamAssassin module (http://www.spamassassin.org/), which is very effective. Mailscanner acts as the final barrier before your mail reaches your box; if alse else fails (ORDB and Spamcop don't stop it), Mailscanner with Spamassassin will probe the email in question. You can also use Procmail to move e-mail marked as spam to another folder. Jason