IP monitoring in blacklists using Zabbix

Some theory

Public spam databases or “black lists” of IP addresses contain information about IP, which for some reason has been declared unfriendly to users. We will not delve into the technological details; It is important that email programs and services use information from these and their own databases in order to protect recipients' email inboxes from unwanted mailings and from spam.

The essence of the problem

If your IP address is blacklisted, the recipients will not receive your emails.

IP penetration into public spam databases threatens the onset of a corporate mail collapse. This is unpleasant, even if the e-mail address on the domain is only 5 and all users can be temporarily “transplanted” to “regular” mail on Yandex or Mail.ru. But, when more than 50 mailboxes integrated with the CRM system are “nailed” to the internal mail server, the problem becomes catastrophic.
')

Decision

“To know, to foresee; foresee to rule. " O. Comte

Calculate the looming threat can and should be before the client feels the punitive measures of mail servers, and the sales department in a panic will make a collective lynch of the local administrator. To do this, we have created an automatic IP monitoring script, notifying the user of possible problems. We chose Powershell as the monitoring platform, and used zabbix 2.4 for the notification.

A little bit about creating a script

The most obvious option seemed to be parsing the web pages of famous IP search engines in the mxtoolbox and 2ip.ru databases. To solve this problem, the .NET and XPATH technologies were used - the most effective tool for parsing XML and WEB, especially for regular expression haters. The first pancake, in some way, turned out to be lumpy, and after a long and exhausting testing, we decided to abandon this decision. The reason was, above all, the dependence on third-party services: if the creators of the site change the structure of the code, then at best, you will need to re-test the software, at worst - rewrite the code.

After a thorough analysis of the existing technologies and developments in this field, we came to a more interesting and practical solution. Development of software based on powershell 3.0, which will independently check for the presence of IP in public spam databases.

How does it work?

Checking the IP address for the presence in the blacklist (DNSBL) is carried out as follows: specify the checked IP in the DNS PTR notation (that is, vice versa “front to back”) and add the DNSBL domain name of the server. If a response from the server is received, then the address being checked is blocked: that is, the IP is seen in one or more blacklists. Regardless of the specifics of the response (it can be any), its very fact indicates that the IP is in the spam database.


In zabbix, data is transmitted via trapper. To use the trapper item, we must:

- have a configured trapper data item in Zabbix
- send data to Zabbix.

Create a blacklistcheck host:



Now you need to configure the trapper:

Create a data item.

Name - can be any
The key is the main element when creating a trapper, this element is case sensitive. The key KEY and key are two different keys.
Type of information : there are 3 options that are suitable for our task: a number, symbol or text. But since we excluded regular expressions, we preferred integer value to text arrays.
The data type is logical; 2 IP values ​​are important for us: it is present (1), or it is not present in the spam lists (0).
The display of values can be left as is, but you can create your own conversion, something like this: 1 = ip is listing, 0 = ip isn`t listing - these values ​​do not affect the script operation, but the visualization of information in zabbix turns out to be interesting.



After that, the data element is ready to accept values. You can perform the check through the program zabbix_sender.

In the case of correct operation, a similar result will be obtained:


To view the diagnostic data, use the –vv parameter.
The speed of checking one IP is no more than 3 minutes.
Next, you need to configure the trigger for the alert.



You can specify any name. The expression corresponds to a change in the state of the data item from 0 to 1. In the event of a trigger triggering, a notification will appear in the main zabbix panel.

Practice use

We have created a compact, well-functioning script that automatically notifies the client about possible problems in the operation of the mail system. Agree that the prevention of this issue is much nicer and calmer compared to the need to solve the problem of "fallen off" mail in time trouble.

We have implemented this solution with our customers, and it shows itself well - especially in companies where the sales department works through commercial mailings. This script allows you to quickly localize the problem that caused the IP to enter the spam database and continue to work without damage.

We wish the number of e-mail takeoffs coincided with the number of touchdowns!