DOCSLIB.ORG

Spam Filtering for Mail Exchangers How to Reject Junk Mail in In- Coming SMTP Transactions

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Spam Filtering for Mail Exchangers How to Reject Junk Mail in In- Coming SMTP Transactions Spam Filtering for Mail Exchangers How to reject junk mail in in- coming SMTP transactions. Tor Slettnes <[email protected]> Edited by Joost De Cock, Devdas Bhagat, and Tom Wright Spam Filtering for Mail Exchangers: How to reject junk mail in incom- ing SMTP transactions. by Tor Slettnes, Joost De Cock, Devdas Bhagat, and Tom Wright Table of Contents Introduction ...................................................................................................................... vii Purpose of this Document ........................................................................................... vii Audience .................................................................................................................. vii New versions of this document .................................................................................... vii Revision History ....................................................................................................... vii Credits .................................................................................................................... viii Feedback .................................................................................................................. ix Translations ............................................................................................................... ix Copyright information ................................................................................................. ix What do you need? ..................................................................................................... x Conventions used in this document ................................................................................ x Organization of this document ...................................................................................... xi 1. Background .................................................................................................................... 1 Why Filter Mail During the SMTP Transaction? .............................................................. 1 Status Quo ......................................................................................................... 1 The Cause .......................................................................................................... 1 The Solution ...................................................................................................... 2 The Good, The Bad, The Ugly ...................................................................................... 2 The SMTP Transaction ................................................................................................ 3 2. Techniques ..................................................................................................................... 6 SMTP Transaction Delays ............................................................................................ 6 DNS Checks .............................................................................................................. 7 DNS Blacklists ................................................................................................... 7 DNS Integrity Check ........................................................................................... 8 SMTP checks ............................................................................................................. 8 Hello (HELO/EHLO) checks ................................................................................. 9 Sender Address Checks ...................................................................................... 10 Recipient Address Checks ................................................................................... 11 Greylisting ................................................................................................................ 13 How it works .................................................................................................... 13 Greylisting in Multiple Mail Exchangers ............................................................... 14 Results ............................................................................................................. 15 Sender Authorization Schemes ..................................................................................... 15 Sender Policy Framework (SPF) .......................................................................... 15 Microsoft Caller-ID for E-Mail ............................................................................ 16 RMX++ ........................................................................................................... 16 Message data checks .................................................................................................. 17 Header checks ................................................................................................... 17 Junk Mail Signature Repositories ......................................................................... 18 Binary garbage checks ........................................................................................ 18 MIME checks ................................................................................................... 19 File Attachment Check ....................................................................................... 19 Virus Scanners .................................................................................................. 19 Spam Scanners .................................................................................................. 19 Blocking Collateral Spam ........................................................................................... 20 Bogus Virus Warning Filter ................................................................................ 20 Publish SPF info for your domain ........................................................................ 20 Enveloper Sender Signature ................................................................................. 20 Accept Bounces Only for Real Users .................................................................... 22 3. Considerations ............................................................................................................... 23 Multiple Incoming Mail Exchangers ............................................................................. 23 iii Spam Filtering for Mail Exchangers Blocking Access to Other SMTP Servers ....................................................................... 23 Forwarded Mail ......................................................................................................... 23 User Settings and Data ............................................................................................... 24 4. Questions & Answers ..................................................................................................... 25 A. Exim Implementation ..................................................................................................... 27 Prerequisites ............................................................................................................. 27 The Exim Configuration File ....................................................................................... 27 Access Control Lists .......................................................................................... 27 Expansions ....................................................................................................... 28 Options and Settings .................................................................................................. 28 Building the ACLs - First Pass .................................................................................... 29 acl_connect ....................................................................................................... 29 acl_helo ........................................................................................................... 30 acl_mail_from ................................................................................................... 30 acl_rcpt_to ........................................................................................................ 30 acl_data ........................................................................................................... 33 Adding SMTP transaction delays ................................................................................. 35 The simple way ................................................................................................. 35 Selective Delays ................................................................................................ 35 Adding Greylisting Support ......................................................................................... 38 greylistd ........................................................................................................... 38 MySQL implementation ...................................................................................... 39 Adding SPF Checks ................................................................................................... 43 SPF checks via Exiscan-ACL .............................................................................. 44 SPF checks via Mail::SPF::Query ......................................................................... 45 Adding MIME and Filetype Checks .............................................................................. 45 Adding Anti-Virus Software .......................................................................................
Load more

Recommended publications
  • Handling Unwanted Email What Are the Main Sources of Junk Email?
    Handling unwanted email Almost entirely based on a presentation by Brian Candler What are the main sources of junk email? · Spam Unsolicited, bulk email Often fraudulent ± penis enlargement, lottery scams, close relatives of African presidents, etc. Low response rate => high volume sent · Viruses, Trojan horses Infected machine sends out mails without the owner 's knowledge · Malicious bounces These are called ªcollateral spamº or ªJoe-jobsº Junk mail is sent with forged MAIL FROM Accepted by some intermediate MTA, but later it bounces Bounces go to innocent third party 1 What are the costs? · Important messages can be accidentally discarded The more junk, the higher the risk · Wasted time Deleting junk Setting up and maintaining ®lters Checking discarded mail for false positives · Wasted bandwidth and disk space Especially for users on modems Viruses and spam attachments can be large · Annoyance, offence, even fraud There are no easy answers! 2 Where can you ®lter? · At the end-user hosts ✓ Each client has full control and customization ✓ Distributes the processing cost ✗ Client must still download each message · On the ISP's mail server ✓ Easier for users ✓ Sometimes can be rejected before receiving the body ✓ Saves disk space on the server ✗ Hard to make ¯exible for users to customize The Joe-job problem · Don't accept a message and then bounce it later If its sender is forged, we are creating a Joe-job · Much better to reject at RCPT TO or DATA stages A real MTA sender will create a bounce Spamware will ignore the rejection · For
    [Show full text]
  • Set up Mail Server Documentation 1.0
    Set Up Mail Server Documentation 1.0 Nosy 2014 01 23 Contents 1 1 1.1......................................................1 1.2......................................................2 2 11 3 13 3.1...................................................... 13 3.2...................................................... 13 3.3...................................................... 13 4 15 5 17 5.1...................................................... 17 5.2...................................................... 17 5.3...................................................... 17 5.4...................................................... 18 6 19 6.1...................................................... 19 6.2...................................................... 28 6.3...................................................... 32 6.4 Webmail................................................. 36 6.5...................................................... 37 6.6...................................................... 38 7 39 7.1...................................................... 39 7.2 SQL.................................................... 41 8 43 8.1...................................................... 43 8.2 strategy.................................................. 43 8.3...................................................... 44 8.4...................................................... 45 8.5...................................................... 45 8.6 Telnet................................................... 46 8.7 Can postfix receive?..........................................
    [Show full text]
  • Abkürzungs-Liste ABKLEX
    Abkürzungs-Liste ABKLEX (Informatik, Telekommunikation) W. Alex 1. Juli 2021 Karlsruhe Copyright W. Alex, Karlsruhe, 1994 – 2018. Die Liste darf unentgeltlich benutzt und weitergegeben werden. The list may be used or copied free of any charge. Original Point of Distribution: http://www.abklex.de/abklex/ An authorized Czechian version is published on: http://www.sochorek.cz/archiv/slovniky/abklex.htm Author’s Email address: [email protected] 2 Kapitel 1 Abkürzungen Gehen wir von 30 Zeichen aus, aus denen Abkürzungen gebildet werden, und nehmen wir eine größte Länge von 5 Zeichen an, so lassen sich 25.137.930 verschiedene Abkür- zungen bilden (Kombinationen mit Wiederholung und Berücksichtigung der Reihenfol- ge). Es folgt eine Auswahl von rund 16000 Abkürzungen aus den Bereichen Informatik und Telekommunikation. Die Abkürzungen werden hier durchgehend groß geschrieben, Akzente, Bindestriche und dergleichen wurden weggelassen. Einige Abkürzungen sind geschützte Namen; diese sind nicht gekennzeichnet. Die Liste beschreibt nur den Ge- brauch, sie legt nicht eine Definition fest. 100GE 100 GBit/s Ethernet 16CIF 16 times Common Intermediate Format (Picture Format) 16QAM 16-state Quadrature Amplitude Modulation 1GFC 1 Gigabaud Fiber Channel (2, 4, 8, 10, 20GFC) 1GL 1st Generation Language (Maschinencode) 1TBS One True Brace Style (C) 1TR6 (ISDN-Protokoll D-Kanal, national) 247 24/7: 24 hours per day, 7 days per week 2D 2-dimensional 2FA Zwei-Faktor-Authentifizierung 2GL 2nd Generation Language (Assembler) 2L8 Too Late (Slang) 2MS Strukturierte
    [Show full text]
  • Canit-PRO User's Guide
    CanIt-PRO User’s Guide for Version 10.2.5 AppRiver, LLC 13 September 2018 2 CanIt-PRO — AppRiver, LLC Contents 1 Introduction 13 1.1 Organization of this Manual.............................. 13 1.2 Definitions........................................ 14 2 The Simplified Interface 19 3 The My Filter Page 21 3.1 Sender Rules...................................... 21 3.2 The Quarantine..................................... 22 3.3 Online Documentation................................. 22 4 The CanIt-PRO Quarantine 23 4.1 Viewing the Quarantine................................. 23 4.1.1 Message Summary Display........................... 23 4.1.2 Sort Order.................................... 24 4.1.3 Message Body Display............................. 25 4.1.4 Summary of Links............................... 25 4.2 Message Disposition.................................. 25 4.2.1 Quick Spam Disposal.............................. 26 4.3 Reporting Phishing URLs................................ 27 4.4 Viewing Incident Details................................ 27 4.4.1 Basic Details.................................. 28 4.4.2 Address Information.............................. 29 4.4.3 History..................................... 29 4.4.4 Spam Analysis Report............................. 29 4.5 Viewing Other Messages................................ 30 4.6 Viewing Specific Incidents............................... 30 CanIt-PRO — AppRiver, LLC 3 4 CONTENTS 4.7 Searching the Quarantine................................ 30 4.8 Closed Incidents....................................
    [Show full text]
  • JEAG Updates: 送信ドメイン認証技術の普及に向けて
    第7回迷惑メール対策カンファレンス JEAG Updates: 送信ドメイン認証技術の普及に向けて 2009.05.19 櫻庭 秀次 (SAKURABA Shuji) Internet Iniave Japan Inc. 1 Agenda • 迷惑メールと送信ドメイン認証技術 – 迷惑メールの現状 – 迷惑メール対策の難しさ • 送信ドメイン認証技術 – 概要 – 導入状況 – 導入に向けての課題 – 解決案 – 認証結果の利用 • まとめ 2 迷惑メールの現状 - I • 迷惑メールの割合の推移 (2008.06.02 - 2009.05.17) Internet Infrastructure Review より 3 迷惑メールの現状 - II • 迷惑メールの送信元分布 (2008.12.29 – 2009.03.29) Internet Infrastructure Review より 4 迷惑メールの現状 - III • 迷惑メールの主要送信元の割合の推移 (2008.09.01 – 2009.03.23) Internet Infrastructure Review より 5 迷惑メール対策の難しさ - I • 送信手法の高度化 – Botnet (Zombie PCs) を利用した少量大規模分散 → RBL (Realtime Black/Block List) では対応が難しい – 送信元の多くは海外 (Botnet, 海外への送信拠点の移動) → 苦情先，管理元が不明 – ISP/ESP のメールサーバーを踏台 指令サーバ に利用する Reputation Hijacking 攻撃者 インターネット 攻撃命令 • コンテンツの巧妙化 ボット ボット ボット ボット – 巧妙な画像添付 spam 指令サーバとIRCチャンネルで交信し、命令を実行 – URL による Web Site への誘導 DDoS フィッシング スピア 迷惑メール ウイルス (利用不能攻撃) （詐欺メール） フィッシング – 誘導先ドメインの巧妙化 (Fast Flux) – メールマガジンや SNS に似せる等 メールシステム ソーシャルテクニックの駆使 6 迷惑メール対策の難しさ - II • 安易な対策による弊害 – RBL (Realtime Block/Black List) 利用による受信拒否 → IP アドレスベースの受信拒否は手間に対対する効果が一見大きいが，送信側からの苦情が 来ないと誤判定がわからないなど弊害も大きい メール内容に基づいて自動的に BlackList 化するような仕組みも危険 (共有型サービス等) – Greylisting によるメールの遅延や不達 → 応答コードとして一時拒否を返すことにより再送を促すことにより正規のメールサーバかどう かを判定する greylisting は一時的な対策．送信側は技術的にいくらでも対応可能．むしろ メールの利点である即時性や不特定からの受信などを損なう場合が多い – エラーメール (Bounce Mail) の一律送信拒否や受信拒否 → 迷惑メール送信者は到達性を確保するために実在するドメイン名を詐称する場合が多いため， 宛先不明の場合に詐称元に bounce mail が送信される．有名ドメインの場合は膨大な量とな るため bounce mail の受信拒否が行われる 拒否の仕方によっては送信元にメール (bounce mail) が滞留するため，メールシステムの 構成によっては通常のメール配送にも影響を与えてしまう 正しいメールがきちんと到達できる環境作りが必要 7 送信ドメイン認証技術 – 概要 I •
    [Show full text]
  • Canit-Domain-PRO Administration Guide for Version 10.2.9 Appriver, LLC 11 December 2020 2
    CanIt-Domain-PRO Administration Guide for Version 10.2.9 AppRiver, LLC 11 December 2020 2 CanIt-Domain-PRO — AppRiver, LLC Contents 1 Introduction 19 1.1 Principles of Operation................................. 19 1.2 Handling False-Positives................................ 19 1.2.1 Spam-Control Delegation........................... 20 1.3 Organization of this Manual.............................. 20 1.4 Definitions........................................ 21 2 Operation 27 2.1 Principles of Operation................................. 27 2.2 Interaction between Allow Rules and Block Rules................... 28 2.2.1 RCPT TO: Actions............................... 28 2.2.2 Post-DATA Actions............................... 30 2.3 Streaming........................................ 32 2.4 How Addresses are Streamed.............................. 32 2.5 How Streaming Methods are Chosen.......................... 33 2.6 Status of Messages................................... 35 2.6.1 Secondary MX Relays............................. 36 2.7 The Database...................................... 36 2.8 Remailing Messages.................................. 37 3 Realms 39 3.1 Introduction to Realms................................. 39 3.2 Realm Names...................................... 40 3.2.1 The base Realm................................ 40 3.3 Creating Realms..................................... 40 3.4 Realm Mappings.................................... 41 3.5 Determining the Realm................................. 42 CanIt-Domain-PRO — AppRiver, LLC 3 4 CONTENTS
    [Show full text]
  • Trust in Email Begins with Authentication
    Trust in Email Begins with Authentication Issued by the Messaging Anti-Abuse Working Group (MAAWG) March 2008 Edited by Dave Crocker Brandenburg InternetWorking Abstract The Internet’s growth allows us to interact with people all over the world. Unfortunately, some of those people do not make good neighbors. Along with the effort to detect and filter the problematic traffic they generate, there is a complementary effort to identify trustworthy participants. In security technology parlance, the first seeks to identify Bad Actors whereas the second creates ways of distinguishing Good Actors. At its simplest, identifying Good Actors can be divided into two activities: A safe means of identifying a participant–such as an author or an operator of an email service–and then a useful means of assessing their trustworthiness. The first activity is called authentication and the second is usually called reputation. This white paper considers the first step: authenticating the identity that asserts responsibility for an email. In it, recent developments in standardized authentication mechanisms are reviewed that have been tailored for use in email anti- abuse efforts. This white paper provides background on authentication as a foundation for understanding current efforts to protect Internet mail. It then looks at the most popular mechanisms currently in use. The paper is intended for a general readership that has basic familiarity with Internet mail service. While this single document is unlikely to be the final word on the topic, MAAWG has striven to capture the current best practices and leading theories regarding email authentication. As a complement to enabling identification of Good Actors, authentication is expected to aid efforts in protecting business’ brands from forgery and phishing attacks.
    [Show full text]
  • Oracle Communications Messaging Server System Administrator's Guide, Release 8.0.2 E72265-01 Copyright © 2015, 2017, Oracle And/Or Its Affiliates
    [1]Oracle® Communications Messaging Server System Administrator’s Guide Release 8.0.2 E72265-01 October 2017 Oracle Communications Messaging Server System Administrator's Guide, Release 8.0.2 E72265-01 Copyright © 2015, 2017, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs.
    [Show full text]
  • Spam Filtering for Mail Exchangers
    Spam Filtering for Mail Exchangers How to reject junk mail in incoming SMTP transactions. Tor Slettnes <[email protected]> Edited by Joost De Cock Devdas Bhagat Tom Wright Version 1.0 −− Release Edition Spam Filtering for Mail Exchangers Table of Contents Introduction.........................................................................................................................................................1 1. Purpose of this Document....................................................................................................................1 2. Audience..............................................................................................................................................1 3. New versions of this document............................................................................................................1 4. Revision History..................................................................................................................................1 5. Credits..................................................................................................................................................2 6. Feedback..............................................................................................................................................3 7. Translations..........................................................................................................................................3 8. Copyright information.........................................................................................................................3
    [Show full text]
  • Diplomarbeit Penetrating Bayesian Spam Filters Using Redundancy in Natural Language
    Die approbierte Originalversion dieser Diplom-/Masterarbeit ist an der Hauptbibliothek der Technischen Universität Wien aufgestellt (http://www.ub.tuwien.ac.at). The approved original version of this diploma or master thesis is available at the main library of the Vienna University of Technology (http://www.ub.tuwien.ac.at/englweb/). Diplomarbeit Penetrating Bayesian Spam Filters Using Redundancy in Natural Language Ausgefuhrt¨ am Institut fur¨ Rechnergestutzte¨ Automation Arbeitsgruppe Automatisierungssysteme der Technischen Universitat¨ Wien unter der Anleitung von Ao.Univ.Prof. Dipl.-Ing. Dr.techn. Wolfgang Kastner und Privatdozent Dipl.-Ing. Dr.techn. Christopher Krugel¨ und Privatdozent Dipl.-Ing. Dr.techn. Engin Kirda als verantwortlich mitwirkenden Universitatsassistenten¨ durch Gunther¨ Bayler Am Wiesenweg 17 2403 Scharndorf 16. Oktober 2007 ii Abstract Today’s attacks against Bayesian spam filters attempt to keep the content of spam emails visible to humans, but obscured to filters, or they attempt to fool the filters with additional good words appended to the spam. Another conceivable approach is to substitute suspicious words in spam emails with innocent words to make them appear as legitimate emails (i.e., ham emails). A precondition for the success of such an attack is that Bayesian spam filters of different users assign similar spam probabilities to similar tokens. In this thesis, it is examined whether this precondition is met; afterwards, the effectivity of a substitution attack is measured by creating a test set of spam messages
    [Show full text]
  • Fortimail CLI Reference
    FortiMail - CLI Reference Version 7.0.1 FORTINET DOCUMENT LIBRARY https://docs.fortinet.com FORTINET VIDEO GUIDE https://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT https://support.fortinet.com FORTINET TRAINING & CERTIFICATION PROGRAM https://www.fortinet.com/support-and-training/training.html NSE INSTITUTE https://training.fortinet.com FORTIGUARD CENTER https://fortiguard.com/ END USER LICENSE AGREEMENT https://www.fortinet.com/doc/legal/EULA.pdf FEEDBACK Email: [email protected] September 8, 2021 FortiMail 7.0.1 CLI Reference 06-701-658582-20210908 TABLE OF CONTENTS Change Log 16 Using the CLI 17 Connecting to the CLI 17 Local console connection and initial configuration 18 Enabling access to the CLI through the network (SSH or Telnet) 20 Connecting to the CLI using SSH 21 Connecting to the CLI using Telnet 22 Logging out from the CLI console 23 Command syntax 23 Terminology 23 Indentation 25 Notation 25 Sub-commands 27 Permissions 31 Tips and tricks 36 Help 36 Shortcuts and key commands 36 Command abbreviation 37 Environment variables 37 Special characters 38 Language support 38 Screen paging 39 Baud rate 39 Editing the configuration file on an external host 40 config 41 antispam adult-image-analysis 42 Syntax 43 antispam behavior-analysis 43 Syntax 43 Related topics 43 antispam bounce-verification 44 Syntax 44 Related topics 44 antispam deepheader-analysis 44 Syntax 44 Related topics 45 antispam dmarc-report 45 Syntax 45 antispam endpoint reputation blocklist 46 Syntax 46 Related topics 46 antispam endpoint reputation exempt 47 Syntax 47 Related topics 47 FortiMail 7.0.1 CLI Reference 3 Fortinet Technologies Inc.
    [Show full text]
  • Securing 7 Layers of Insecurity
    Chapter 62 Simple Mail Transfer Protocol You've got Mail! D 7 eep L “President Bush said for ay security reasons, he's sworn off Se er all e-mail communication. He will s c not be using email at the White o V f I House at all. Is that a good idea? i e n I mean, it's not like that speaking nn thing was working out so good.” sec a 2007 urity -- Jay Leno Copyright Information Some rights reserved / Einige Rechte vorbehalten Michael Kafka, René Pfeiffer, Sebastian Mayer C.a.T. Consulting and Trainings, Vienna, Austria You may freely use, distribute and modify this work under following D agreement: 7 eep Diese Arbeit darf frei genutzt, verbreitet und bearbeitet werden unter L folgenden Bedingungen: ay Se Authors must be referenced (also for modification) er s Autoren müssen genannt werden (auch bei Bearbeitung) c o V Only for non commercial use f I i Nur für nichtkommerzielle Nutzung e n nn Derivative work under same licence sec Derivative Arbeit unter selber Lizenz a 2007 urity http://www.creativecommons.com © November 2007 62 - SMTP Chapter 62 Simple Mail Transfer Protocol Agenda SMTP Basics SMTP Security Risks D 7 eep Anti-Spam Frameworks L ay Se E-Mail Content er s c o V f I i e n nn sec a 2007 urity © November 2007 62 - SMTP SMTP Basics The Foundation of Mail Delivery. D 7 eep L ay Se er s c o V f I i e n nn sec a 2007 urity © November 2007 62 - SMTP SMTP Properties Text based protocol Commands use 7-bit ASCII Data may use 8-bit encodings D 7 eep Message transmission as header+body L ay Se Uses different TCP ports er s
    [Show full text]