Keep Smiling, Waste Spammers' Time Peter N
Total Page：16
File Type：pdf, Size：1020Kb
How-Tos How-Tos Fight SPAM Fight SPAM Keep smiling, waste spammers' time Peter N. M. Hansteen When you are in the business of building the networks people need and the services they need to run on them, you may also be running a mail service. If you do, you will sooner or later need to deal with spam. This article is about how to waste spammers' time and have a good time while doing it. ssembling the parts: To take part of the fun somewhere in the default path of your incoming SMTP traffic. and useful things in this article, you need a A gateway with PF is usually an excellent choice, but if it suits system with PF, the OpenBSD packet filter. your needs better, it is quite feasible to do the filtering needed If you are reading this magazine you are for this article on the same host your SMTP server runs. Alikely to be running all important things on a BSD already, and all the fully open source BSDs by now include PF, Enter spamd developed by OpenBSD but also ported to the other OpenBSD's spamd, the spam deferral daemon (not to be BSDs. On OpenBSD, it is the packet filter, and if you are confused with the program with the same name from the running FreeBSD, NetBSD or DragonFlyBSD it is likely SpamAssassin content filtering system), first appeared in to be within easy reach, either as a loadable kernel module OpenBSD 3.3. The original spamd was a tarpitter with or as a kernel compile-time option. a very simple mission in life. Its spamd-setup program Getting started with PF is surprisingly easy. The official would take a list of known bad IP addresses, that is, the IP documentation such as the PF FAQ is very comprehensive, addresses of machines known to have sent spam recently, but you may be up and running faster if you buy The Book and load it into a table. The main spamd program would of PF [1] or do what about 30,000 others have done before then have any smtp traffic from hosts in that table redirected you: Download or browse the free forerunner from http: to it, and spamd would answer those connections s-l-o-w-l- //home.nuug.no/~peter/pf/. Or do both, if you like. y, by default one byte per second. Network design issues A minimal PF config A PF setup can be, and to my mind should be, quite As man spamd will tell you, the bare minimum to get unobtrusive. For the activities in this article it does not spamd running in a useful mode on systems with PF matter much where you run your PF filtering, as long as it is version 4.1 or later is: 2 BSD 1/2008 www.bsgmag.org 3 How-Tos How-Tos Fight SPAM Fight SPAM table <spamd-white> persist For each new trick a spam producer Spammers do not retry. So if we set up our no rdr inet proto tcp from chooses to implement, the content filtering system to say essentially My admin told me not <spamd-white> to any port smtp becomes incrementally more complex and to talk to strangers – we should be getting rid rdr pass inet proto tcp from any to computationally expensive. of anything the sending end does not consider any port smtp -> 127.0.0.1 port spamd In sharp contrast to the content filtering, important enough to retry delivering. The which is based on message content, greylisting practical implementation is to record for each This means, essentially, that any smtp traffic is based on studying spam senders' behavior incoming delivery attempt at least: from hosts that are not already in the table on the network level. The 2003 paper [3] spamd-white will be redirected to localhost, by Evan Harris noted that the vast majority 1) Sender's IP address port spamd, where you have set up the of spam appeared to be sent by software 2) The From: address spam deferral daemon spamd to listen for specifically developed to send spam messages, 3) The To: address connections. Enabling spamd, on the other and those systems typically operated in a fire 4) Time of first delivery attempt matching hand, is as easy as adding spamd_flags="" and forget mode, only trying to deliver each 1) through 3) to your /etc/rc.conf.local if you run message once. The delivery software on real 5) Time delivery of retry will be allowed OpenBSD or /etc/rc.conf if you run mail servers, however, are proper SMTP 6) Time to live for the current entry FreeBSD [2], and starting it with: implementations, and since the relevant RFCs state that you MUST retry delivery in At the first attempt, the delivery is rejected $ sudo /usr/libexec/spamd case you encounter some classes of delivery with temporary error code, typically errors, in almost all cases real mail servers 451 temporary local problem, try again or if you are on FreeBSD, will retry after a reasonable amount of time. later, and the data above is recorded. Any $ sudo /usr/local/libexec/spamd It is also worth noting that if you add the -d for Debug flag to your spamd flags, spamd will generate slightly more log information, of the type shown in the log excerpts later in this article. While earlier versions of spamd required a slightly different set of redirection rules and ran in blacklists-only mode by default, spamd from OpenBSD 4.1 onwards runs in greylisting mode by default. Let's have a look at what greylisting means and how it differs from other spam detection techniques before we exlore the finer points of spamd configuration. Content versus behavior: Greylisting When the email spam deluge started Figure 1. Number of hosts in the uatraps list happening during the late 1990s and early 2000s, observers were quick to note that the messages in at least some cases could be fairly easily classified by looking for certain keywords, and the bulk of the rest fit well in familiar patterns. Various kinds of content filtering have stayed popular and are the mainstays of almost all proprietary and open source antispam products. Over the years the products have develped from fairly crude substring match mechanisms into multi-level rule based systems that incorporate a number of sophisticated statistical methods. Generally the products are extensively customizeable and some even claim the ability to learn based on the users' preferences. Those sophisticated and even beautiful algorithms do have a downside, however: Figure 2. SMTP connections to smamd by connetion length 2 BSD 1/2008 www.bsgmag.org 3 How-Tos How-Tos Fight SPAM Fight SPAM subsequent delivery attempts matching occasionally encounter some sites that do not probably seen spam messages offering lists of fields 1) through 3) that happen before the play well with greylisting, see the references millions of verified email addresses available. time specified in field 5) are essentially for tips on how to deal with those. However, verification goes only so far. You ignored, treated to the same temporary error. can get a reasonable idea of the quality of that When a delivery matching fields 1) through Do we need blacklists? verification if you take some time to actually 3) is attempted after the specified time, the With greylisting taking care of most of the browse mail server logs for failed deliveries to IP address (or in some implementations, spam, is there still a place for blacklists? It's a addresses in your domain. In most cases you the whole subnet) is whitelisted, meaning fair question. The answer depends in a large part will find a number of attempts at delivering to that any subsequent deliveries from that on how the blacklists you are considering are addresses that either have never existed or at IP address will be passed on to the mail constructed and how much you trust the people least have no valid reason to receive mail. service. who generate them and the methods they use. The OpenBSD spamd developers saw this The first release of OpenBSD's spamd The theory behind all good blacklists is too. They also realized that what addresses are to support greylisting was OpenBSD 3.5. that once an IP address has been confirmed deliverable or not in your own domain is spamd's greylisting implementation operates as a source of spam, it is unlikely that there something you have complete control over, only on individual IP addresses, and by will be any valid mail send from that IP and they formulated the following rule to default sets the minimum time before a address in the foreseeable future. guide a new feature to be added to spamd: delivery attempt passes to 25 minutes, With a bit of luck, by the time the spam the time to live for a greylist entry to 4 sender gets around to trying to deliver spam "if we have one or more addresses that we hours, while a whitelisted entry stays in the to addresses in your domain, the spam sender are quite sure will never receive valid email, whitelist for 36 days after the delivery of will already be on the blacklist and will in we can safely assume that any mail the last message from that IP address. With turn treated to the s-l-o-w SMTP dialogue. sent to those addresses is spam" a properly configured setup, machines that Knowing how a host makes it into a receive mail from your outgoing mail servers blacklist is important, but a clear policy for that feature was dubbed greytrapping, and will automatically be whitelisted, too.