Home » forums » Imported debian.org Mailing Lists » Debian ISP

Blacklisting (postfix rbl) - recent issue with blackhole.securitysage.com

Tags:

Hi folks,

Yesterday, I received multiple reports from users that they had trouble
mailing us. After checking the maillog I discovered that
blackhole.securitysage.com seemed to block a whole lot of mail to us
(read: all)! I of course immediatly deleted this blacklist from our
reject_rbls but the host blackhole.securitysage.com was just
unreacheable (also see this page
http://wiki.openrbl.org/wiki/Blackhole.securitysage.com). Now it seems
weird that if the rbl host is unreachable Postfix decides to simply take
that as a "ah well, just block everything then", or maybe something else
was going on?

What are you thoughts on this?

maillog:

[....]
> Mar 14 11:01:03 hostname postfix/smtpd[28035]: NOQUEUE: reject: RCPT
> from hostname[ip]: 554 5.7.1 Service unavailable; Client host
> [hostname] blocked using blackhole.securitysage.com;
> from= to= proto=ESMTP
> helo=
[....]

Best regards,
Robert

--
Hensel Hosting
Overtoom 473 I
NL-1054 LE Amsterdam
W: http://www.hensel.nl/
E:
T: (+31)(0)20 662 1348
F: (+31)(0)20 662 3601

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Please visit our web site: http://www.hensel.nl/
for more information about our products and services.

This email and any attachment is intended for the
addressee only. If you are not the addressee, you
are notified that no part of the email or any
attachment may be disclosed, copied or distributed,
and that any other action related to this email or
attachment is strictly prohibited, and may be unlawful.

If you are not the addressee, please notify the sender
immediately by return email, and delete this message.

Hensel Hosting and/or its employees shall not be liable
for the incorrect or incomplete transmission of this
email or any attachments, nor responsible for any
delay in receipt.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

--

Bookmark/Search this post with:
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Google
  • Yahoo
  • Technorati
0
‹ backports.org became really shitty for php5-mysql and mysql-server-5.0 windows dynamic storage ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by Gilles Mocellin on Thu, 2007-03-15 16:00.

Le jeudi 15 mars 2007 20:34, Robert Hensel (Hensel Hosting) a écrit :
> Hi folks,
>
> Yesterday, I received multiple reports from users that they had trouble
> mailing us. After checking the maillog I discovered that
> blackhole.securitysage.com seemed to block a whole lot of mail to us
> (read: all)! I of course immediatly deleted this blacklist from our
> reject_rbls but the host blackhole.securitysage.com was just
> unreacheable (also see this page
> http://wiki.openrbl.org/wiki/Blackhole.securitysage.com). Now it seems
> weird that if the rbl host is unreachable Postfix decides to simply take
> that as a "ah well, just block everything then", or maybe something else
> was going on?

I just see that on my own postfix too !

> What are you thoughts on this?

You're right, a non response is not the same as a negative response.
Postfix could consider a non response has "not blacklisted".

As I say that, I realize that it opens a breach.
Spammers have just to DDOS theses blacklists and spam will spread...

»

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by Craig Sanders on Thu, 2007-03-15 17:00.

On Thu, Mar 15, 2007 at 08:34:39PM +0100, Robert Hensel (Hensel Hosting) wrote:
> Yesterday, I received multiple reports from users that
> they had trouble mailing us. After checking the maillog I
> discovered that blackhole.securitysage.com seemed to block a
> whole lot of mail to us (read: all)! I of course immediatly
> deleted this blacklist from our reject_rbls but the host
> blackhole.securitysage.com was just unreacheable (also see this page
> http://wiki.openrbl.org/wiki/Blackhole.securitysage.com). Now it
> seems weird that if the rbl host is unreachable Postfix decides to
> simply take that as a "ah well, just block everything then", or maybe
> something else was going on?

postfix doesn't do that.

if it can't get an answer from an RBL, it just ignores it.

> What are you thoughts on this?
>
> maillog:
>
> [....]
> >Mar 14 11:01:03 hostname postfix/smtpd[28035]: NOQUEUE: reject: RCPT
> >from hostname[ip]: 554 5.7.1 Service unavailable; Client host
> >[hostname] blocked using blackhole.securitysage.com;
> >from= to= proto=ESMTP
> >helo=

blackhole.securitysage.com must have returned a response that said
"block this".

note: the fact that their web site was down doesn't mean that their RBL
name server was down.

craig

--
craig sanders

One man's theology is another man's belly laugh.

--

»

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by Rejo Zenger on Thu, 2007-03-15 18:00.

++ 15/03/07 20:34 +0100 - Robert Hensel (Hensel Hosting):
>http://wiki.openrbl.org/wiki/Blackhole.securitysage.com). Now it seems
>weird that if the rbl host is unreachable Postfix decides to simply take
>that as a "ah well, just block everything then", or maybe something else
>was going on?

As far as I know, this is not default behaviour of Postfix. In other
words, Postfix does not behave like this or you may have configured
Postfix to behave like this.

>>Mar 14 11:01:03 hostname postfix/smtpd[28035]: NOQUEUE: reject: RCPT
>>from hostname[ip]: 554 5.7.1 Service unavailable; Client host
>>[hostname] blocked using blackhole.securitysage.com;
>>from= to= proto=ESMTP
>>helo=

It is quite useless to paste (sections of) logfiles, while munging most
of it. I could have come up with this line myself. The most important
part has been munged as well: the connecting IP address which has been
checked against the blackhole.securitysage.com rbl.

--
Rejo Zenger https://rejo.zenger.nl

»

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by Robert Hensel (... on Thu, 2007-03-15 20:00.

Rejo Zenger wrote:

++ 15/03/07 20:34 +0100 - Robert Hensel (Hensel Hosting):

http://wiki.openrbl.org/wiki/Blackhole.securitysage.com). Now it seems
weird that if the rbl host is unreachable Postfix decides to simply take
that as a "ah well, just block everything then", or maybe something else
was going on?

As far as I know, this is not default behaviour of Postfix. In other
words, Postfix does not behave like this or you may have configured
Postfix to behave like this.

Postfix is not configured in any strange way here, and you're right; as
far as I'm aware it does indeed not act like this when an rbl host is
down (which is something I haven't seen much anyway), of course this
raises the question again to which extend 3th parties influence the
behaviour of mailservers. I'm pretty interested in what happened at
securitysage (quite an established blacklist if I'm not mistaken), if
it wasn't really "down" and was blacklisting all clients that would
make this a bigger issue from my point of view.

Mar 14 11:01:03 hostname postfix/smtpd[28035]: NOQUEUE: reject: RCPT

>from hostname[ip]: 554 5.7.1 Service unavailable; Client host

[hostname] blocked using blackhole.securitysage.com;
from=<address@addresss.com> to=<address@address.com> proto=ESMTP
helo=<hostname>

It is quite useless to paste (sections of) logfiles, while munging most
of it. I could have come up with this line myself. The most important
part has been munged as well: the connecting IP address which has been
checked against the blackhole.securitysage.com rbl.

Since it is clearly an issue that is not related to a specific host,
since multiple systems (inbound and servers) had the same problem I do
not find it usefull or necessary to disclose that information. Also see
the email below I received from securitysage (can also be found on the
wiki link):

Hello!
 
We have received e-mails
from you telling us that some
specific domains are blacklisted using blackhole.securitysage.com. None
of your
domains are blacklisted. Our RHSBL server stopped responding last night
and we
have worked starting at 6:00 AM local time to fix this issue. We
figured out it
was a DNS problem and it has been fixed since 9:00 AM.
Because it was a DNS
issue it will take 4 to 24, maximum 48
hours to replicate the changes that we made to all DNS servers in the
world.
We apologize for the
inconvenience and we want to assure you
that we are doing our best to prevent this from happening in the future.
We appreciate your
patience and your understanding.
Best regards,
 
Tech Support Team
SecuritySage Inc.

Best regards,
Robert

»

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by Brett Parker on Fri, 2007-03-16 04:00.

On Fri, Mar 16, 2007 at 01:56:14AM +0100, Robert Hensel wrote:

> >Hello!
> >
> >
> >
> >We have received e-mails from you telling us that some specific
> >domains are blacklisted using blackhole.securitysage.com. None of your
> >domains are blacklisted. Our RHSBL server stopped responding last
> >night and we have worked starting at 6:00 AM local time to fix this
> >issue. We figured out it was a DNS problem and it has been fixed since
> >9:00 AM.
> >
> >Because it was a DNS issue it will take 4 to 24, maximum 48 hours to
> >replicate the changes that we made to all DNS servers in the world.
> >
> >We apologize for the inconvenience and we want to assure you that we
> >are doing our best to prevent this from happening in the future.
> >
> >We appreciate your patience and your understanding.

Well, looking at the DNS for the blackhole:

$ host blackhole.securitysage.com
blackhole.securitysage.com is an alias for resalehost.networksolutions.com.
resalehost.networksolutions.com has address 205.178.189.128
blackhole.securitysage.com is an alias for resalehost.networksolutions.com.
blackhole.securitysage.com is an alias for resalehost.networksolutions.com.
$

The website at www.securitysage.com also appears to go to a
networksolutions holding page...

I'd suggest removing securitysage from your blacklists at this point -
DNS lookups against "resalehost.networksolutions.com" fail, and there's
no telling how long it's going to take them to fix it.

Cheers,
--
Brett Parker

--

»

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by Craig Sanders on Fri, 2007-03-16 18:00.

On Fri, Mar 16, 2007 at 01:56:14AM +0100, Robert Hensel wrote:
> >>>Mar 14 11:01:03 hostname postfix/smtpd[28035]: NOQUEUE: reject: RCPT
> >>>
> >>>from hostname[ip]: 554 5.7.1 Service unavailable; Client host
> >>
> >>>[hostname] blocked using blackhole.securitysage.com;
> >>>from= to= proto=ESMTP
> >>>helo=
> >>>
> >
> >It is quite useless to paste (sections of) logfiles, while munging most
> >of it. I could have come up with this line myself. The most important
> >part has been munged as well: the connecting IP address which has been
> >checked against the blackhole.securitysage.com rbl.
> >
> Since it is clearly an issue that is not related to a specific host,
> since multiple systems (inbound and servers) had the same problem I do
> not find it usefull or necessary to disclose that information. Also see
> the email below I received from securitysage (can also be found on the
> wiki link):

of course the client IP is essential information - how else are we, who
you have asked for help, to check whether it IS actually listed in any
RBLs?

munging the recipient address is OK, that is privacy-sensitive
information, but revealing the client IP a) doesn't infringe anyone's
privacy (because it doesn't identify an individual) and b) is essential
for diagnostic purposes.

craig

--
craig sanders

BOFH excuse #187: Reformatting Page. Wait...

--

»

Blacklisting (postfix rbl) - recent issue with blackhole.securit

Submitted by martin f krafft on Fri, 2007-03-16 06:00.

also sprach Robert Hensel (Hensel Hosting) [2007.03.15.2034 +0100]:
> reject_rbls but the host blackhole.securitysage.com was just
> unreacheable (also see this page
> http://wiki.openrbl.org/wiki/Blackhole.securitysage.com). Now it
> seems weird that if the rbl host is unreachable Postfix decides to
> simply take that as a "ah well, just block everything then", or
> maybe something else was going on?

The domain was returned to networksolutions.com, which answer every
A query. Not nice. Stop using it.

--
Please do not send copies of list mail to me; I read the list!

.''`. martin f. krafft
: :' : proud Debian developer, author, administrator, and user
`. `'` http://people.debian.org/~madduck - http://debiansystem.info
`- Debian - when you have better things to do than fixing systems

NP: Rage Against The Machine / Rage Against The Machine

»
Syndicate content