You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Nick Gilbert <ni...@nickgilbert.com> on 2004/04/06 00:56:23 UTC
Rejecting spam with SpamAssassin and Qmail
Hi all,
Is there any way (with Qmail) to actually refuse delivery of a message
based on the output or score of SpamAssassin?
The problem is, if you accept a message, flag it as spam and shove it in
a spam folder, you haven't actually done a single thing to prevent spam
other than save yourself a couple of seconds of sorting time. You
haven't even told the spammer that you won't want his mail.
What would be nice is if you KNOW that a message is spam (ie it has a
REALLY high score or is in the Razor database or something, then it
could actually refuse to accept the message after the end of the DATA
transmission in the SMTP session. Some bulk-mailing software does
actually purge the mailing lists of addresses it couldn't deliver to
(after all - all it does is slow the program down).
I would really like to find a way to reject messages based on certain
criteria if at all possible. How would I go about doing this?
Please note that refusing to accept the message at SMTP delivery time is
different to "bouncing" the message. A bounce message is a seperate
message sent to the sender of the spam (which is almost always a fake or
forged address). Bouncing spam simply creates MORE of a problem.
Nick..
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Nick Gilbert <ni...@nickgilbert.com>.
> Umm, spammers won't care if you reject messages, they'll
> still keep sending it to you.
Spammers who've collected lots of addresses often resell 'filtered'
lists (after all, those addresses are worth money). These lists have
been purged for addresses which couldn't be contacted (domain no longer
exists or MX servers no longer operating). So even if you can't stop it
completely, you can certainly help prevent your addresses getting onto
next months CD. An address which I used to get 50 spams a day to about a
year ago, now gets absolutely NO spam whatsoever since I started
refusing all it's mail, so this technique obviously works. If you read
around the internet - you'll see that others have found the same thing,
and this is why entire anti-spam systems were written with their main
objective being to reject messages rather than just bounce them (eg ASSP).
You also seem to be assuming that all spammers send e-mail anonymously.
Some spam comes from a legitimate e-mail address with a working
'unsubscribe' service - yet your e-mail address was still just harvested
from the web. These sorts of people do tend to keep their lists clean
and take you off their lists if you ask them to (not that you should
ever reply to a spammer!).
> There is no evidence that spammers remove "undeliverable" email
> address from their lists
Actually there's quite a lot. Perhaps you haven't looked? Not all
spammers are the same - some will do this, some won't, but rejecting
their messages certainly doesn't do any harm. You don't really think
that if an address permanently bounces, that it people will still be
trying to send spam to it in 2, 20 or 50 years time do you? Eventually
90% of their lists would be obsolete addresses. Purging of the lists
DOES happen - just look at any bulk mailing software and look at the
options for purging the database. If no-one used the options, they
wouldn't be in there - but as it happens, purging is ON by default in
the only software I've seen. If you don't believe me - go and download some.
> Yes. Be aware however that if you have multiple MX entries for
> your domain(s) then you MUST run SpamAssassin on all of them,
> otherwise you WILL generate bounce messages even though you
> think you're only rejecting.
That's a good point which I probably wouldn't have thought of...
Thankfully I only have one MX so this won't affect me. My server only
hosts my mail so I don't really need a backup MX.
Nick...
Re: Rejecting spam with SpamAssassin and Qmail
Posted by jdow <jd...@earthlink.net>.
From: "Kiko Piris" <sp...@pirispons.net>
> And spammers, of course, don't care about bounces or rejects. I have an
> address that I used 2 (*two*) times in newsgroups in October'2001
> (didn't tell it to anyone and never again used it). My server rejects
> rcpt to that address at smtp stage. Today it keeps receiving attempts to
> deliver spam (several a week).
If the address was something like kikop@somethingorother.com then
at least one class of spammers will attempt to guess such names and
paper the net with mail to kikop@millionsofaddresses.com. If it was
something like f5788dqtrlj9@somethingorother.com then you have a
valid test of harvesting from a couple years ago.
{^_^}
Re: Rejecting spam with SpamAssassin and Qmail
Posted by "Peter H. Lemieux" <ph...@cyways.com>.
Nick Gilbert wrote:
>> Nope. Bounces have <> as return-path to prevent exactly this.
>
> So why do the bounces bounce back if you try and bounce your spam? (try
> it) I had to disable "doublebouncing" in qmail to stop this happening,
> but by default - the bounces were bouncing.
There's lots of reasons this can happen. One common case is where the
spammer sends from xyzzy@imadeupthisdomain.com, but doesn't accept inbound
mail to that domain. (I have one of those in my outbound queue right now.)
>> Having that, if you can't reject smtp transaction at the rcpt to
>> command, it's better to silently discard it rather than trying to bounce
>> anything (you would waste *YOUR* resources for nothing).
I don't let any standard MTA accept mail here. I use the store-and-forward
Obtuse smtpd proxy instead, which has an elaborate rules system to refuse
messages at the SMTP level depending on the identity of the sending server
and the mail from: and rcpt to: addresses sent during the SMTP handshake.
It also supports RBL lookups. In addition, smtpd runs in a chrooted "jail"
to protect the rest of the system from possible compromise. (I've run this
for at least 5-6 years with nary a problem.)
Obtuse no longer supports this software, but you can get a copy from
http://sd.inodes.org/. This version has even more elaborate anti-spam controls.
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Nick Gilbert <ni...@nickgilbert.com>.
> Nope. Bounces have <> as return-path to prevent exactly this.
So why do the bounces bounce back if you try and bounce your spam? (try
it) I had to disable "doublebouncing" in qmail to stop this happening,
but by default - the bounces were bouncing.
> Having that, if you can't reject smtp transaction at the rcpt to
> command, it's better to silently discard it rather than trying to bounce
> anything (you would waste *YOUR* resources for nothing).
My entire point was that you shouldn't bounce SPAMs. If you reject the
SMTP level, then you don't NEED to bounce it - the remote server (to
which the client is probably connected) will pass the failure message
directly to the application which is trying to send the messages. No
bounce messages will be involved unless the upstream SMTP server isn't
the only other SMTP server in the chain.
> And spammers, of course, don't care about bounces or rejects.
Most don't agreed. But many do. If rejecting messages didn't work, then
the amount of spam directed to accounts which reject all messages (as
opposed to bounce them) wouldn't decrease. But it does - both on my
accounts and the accounts of people who have done independant tests. A
lot of spammers DO purge their lists of undeliverable e-mail addresses.
(Hell, *some* spammers even honor remove requests!).
> I have an
> address that I used 2 (*two*) times in newsgroups in October'2001
> (didn't tell it to anyone and never again used it). My server rejects
> rcpt to that address at smtp stage. Today it keeps receiving attempts to
> deliver spam (several a week).
I don't think you actually read my message at all did you? I'm not
saying it again...
Nick...
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Kiko Piris <sp...@pirispons.net>.
On 06/04/2004 at 10:42, Nick Gilbert wrote:
> A lot of my spam arrives to accounts which don't exist. Therefore each
> spam that doesn't get rejected generates a bounce message. It will
> probably also receive a doublebounce message
Nope. Bounces have <> as return-path to prevent exactly this.
If the MX relay receiving the smtp transaction from the spammer can't
reject the message at rcpt to command (because, for example, that relay
host doesn't have a list of valid recipients for that domain), then you
have to swallow the whole message and relay it (possibly bouncing it
later). Period.
Having that, if you can't reject smtp transaction at the rcpt to
command, it's better to silently discard it rather than trying to bounce
anything (you would waste *YOUR* resources for nothing).
And spammers, of course, don't care about bounces or rejects. I have an
address that I used 2 (*two*) times in newsgroups in October'2001
(didn't tell it to anyone and never again used it). My server rejects
rcpt to that address at smtp stage. Today it keeps receiving attempts to
deliver spam (several a week).
--
Kiko
randomly fake / injected headers blunder
Posted by Cami <ca...@mweb.co.za>.
Hey All..
Check this one out:
Return-path: <Ca...@meds541.com>
Received: from msg-proxy7.mweb.co.za ([196.2.55.31])
by mailhost3.mweb.co.za (iPlanet Messaging Server 5.2 HotFix 1.21
(built Sep
8 2003)) with ESMTP id <0H...@mailhost3.mweb.co.za>; Sat,
03 Apr 2004 03:57:30 +0200 (SAST)
Received: from postwall07.mweb.co.za ([196.2.42.27])
by msg-proxy7.mweb.co.za (iPlanet Messaging Server 5.2 HotFix 1.09
(built Jan
7 2003)) with ESMTP id <0H...@msg-proxy7.mweb.co.za>; Sat,
03 Apr 2004 03:56:35 +0200 (SAST)
Received: from localhost (viruswall03.mweb.co.za [196.2.50.229])
by pwfilter02.mweb.co.za (Postfix) with ESMTP id 01FD31CB3; Sat,
03 Apr 2004 03:56:35 +0200 (SAST)
Received: from postwall07.mweb.co.za ([196.2.42.27])
by localhost (spamwall05.mweb.co.za [196.2.50.199]) (amavisd-new, port
10024)
with LMTP id 18356-01-93; Sat, 03 Apr 2004 03:56:34 +0200 (SAST)
Received: from A-MEI (unknown [203.74.132.134])
by postwall07.mweb.co.za (Postfix) with SMTP id 169B11CF9; Sat,
03 Apr 2004 03:56:20 +0200 (SAST)
Received: from combustiblebrandeis ([28.8.216.128])
by
%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO-.curl.hypotenuse.comprehend.%HEADER_SMTP_RDM
(%HEADER_RDM_MAILERS
%NEW_HEADER_RDM_DIGITS%NEW_HEADER_RDM_DIGITS%NEW_HEADER_RDM_DIGITS)
(qmail 20597 invoked by uid 0)
; id
<%THE2_HEADER_RND_DIGITS_2%THE2_HEADER_RND_DIGITS_2%THE2_HEADER_RND_DIGITS_2.%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO.%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO-.%HEADER_X_MSSG_INFO.%HEADER_X_MSSG_INFO.%HEADER_SMTP_RDM%HEADER_RANDOMIZER_TAGrevelcharcoal>
for
<iv...@iafrica.com>; Fri,
02 Apr 2004 04:01:08 +0200 (envelope-from <Ca...@meds541.com>)
Received: from contemporaneous7 ([22.184.92.112])
by
%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO-.yachtsman.rime.righteous.%HEADER_SMTP_RDM
(%HEADER_RDM_MAILERS
%NEW_HEADER_RDM_DIGITS%NEW_HEADER_RDM_DIGITS%NEW_HEADER_RDM_DIGITS)
with Microsoft SMTPSVC id
<%THE2_HEADER_RND_DIGITS_2%THE2_HEADER_RND_DIGITS_2%THE2_HEADER_RND_DIGITS_2.%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO.%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO-.%HEADER_X_MSSG_INFO.%HEADER_X_MSSG_INFO.%HEADER_SMTP_RDM%HEADER_RANDOMIZER_TAGarson8>
for
<iv...@iafrica.com>; Fri,
02 Apr 2004 04:04:08 +0200 (envelope-from <Ca...@meds541.com>)
Date: Thu, 01 Apr 2004 21:59:08 -0400
From: Marsha Hickman <Ca...@meds541.com>
Subject: Now you can watch any Payperview Movies-Free
To: ivorr@iafrica.com
Reply-to: Marsha Hickman <Ca...@meds541.com>
Message-id: <wn...@skinde2.com>
MIME-version: 1.0
Content-type: multipart/alternative; boundary=--1033944722731323610
X-Message-Info:
%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO%HEADER_RANDOMIZER_TAG%HEADER_X_MSSG_INFO%HEADER_X_MSSG_INFO
X-Spam-Status: No, hits=7.2 tagged_above=-999.0 required=7.5 tests=BAYES_99,
MIME_MISSING_BOUNDARY
X-Spam-Level: *******
----1033944722731323610
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable
OVZS7z61619556170423591r72t7,Fri, 02 Apr 2004 08:01:08 +0600
Attn:=20 Digital-Cable-TV Subscriber =20
These cable plugs permits you to get passed cable billing and allow you to=
watch-unlimited Cable-movies and Premium Channels. =20
Find =20It =20Here =20_ =20http://www.devidv.com?refid=3D100100008708036=
04&action=3D10&eid=3D2cab-srv5
Well =20If=20This=20isn't =20Your---Type=20http://www.devidv.com?unsub=3D=
10010000870803604&action=3D10&eid=3D2cab-srv-5
march broomcorn indiscretion bostonian newspapermen admire gasify metaphor=
jeannie blip chang lin interregnum grout project runoff breastwork birdie=
inset crosscut=20
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Simon Byrnand <si...@igrin.co.nz>.
> >> Also remember that even if you reject at an SMTP level,
>>> you have still received the ENTIRE contents of the message (the DATA
>>> phase
>>> of the SMTP transaction) BEFORE you reject it, so you don't save any
>>> network bandwidth.
>
> A lot of my spam arrives to accounts which don't exist. Therefore each
> spam that doesn't get rejected generates a bounce message. It will
Not so. Most MTA software will reject a message at the RCPT TO stage if
the email address is invalid, and the message never gets to the DATA
phase, let alone to the point of needing to generate a bounce.
(This assumes the message is being delivered to the primary MX of course,
a backup MX will happily accept a message to a non-existant address on
your domain, and THEN generate a bounce when it tries to deliver it to the
primary MX and the primary MX rejects it - depends a bit on your
mailserver software, it would be possible to set up a backup MX that
checks the same user database as the primary MX...)
> probably also receive a doublebounce message (because that bounce will
> probably have bounced as the address was spoofed) which probably
> contained an entire copy of the bounce message.
>
> So for these particular addresses, I'd save at least 66% of my bandwidth
> - and probably more like or 80-90% per rejected spam.
I don't see how...accepting a spam and then filing it into a users spam
folder, whilst more CPU and disk intensive, is LESS network intensive,
because you're still accepting the DATA phase of the message either way,
and if you try to reject messages, you'll sometimes generate bounces that
will then be retried over a period of days, and usually fail to be
delivered.
There is also the possibility that a spammer who gets a 550 reject will
think the message is undelivered and just keep hammering away trying to
get the message delivered, (trust me, I've *SEEN* this happen) whereas if
you accept it and then toss it into a spam folder they think it has got
through.
Rejecting looks good on the surface but when you get down to it, its got
many problems...
Regards,
Simon
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Nick Gilbert <ni...@nickgilbert.com>.
>> Also remember that even if you reject at an SMTP level,
>> you have still received the ENTIRE contents of the message (the DATA phase
>> of the SMTP transaction) BEFORE you reject it, so you don't save any
>> network bandwidth.
A lot of my spam arrives to accounts which don't exist. Therefore each
spam that doesn't get rejected generates a bounce message. It will
probably also receive a doublebounce message (because that bounce will
probably have bounced as the address was spoofed) which probably
contained an entire copy of the bounce message.
So for these particular addresses, I'd save at least 66% of my bandwidth
- and probably more like or 80-90% per rejected spam.
Nick...
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Jens Benecke <je...@spamfreemail.de>.
Simon Byrnand wrote:
> At 10:56 6/04/2004, Nick Gilbert wrote:
>
>>Hi all,
>>
>>Is there any way (with Qmail) to actually refuse delivery of a message
>>based on the output or score of SpamAssassin?
>>
>>The problem is, if you accept a message, flag it as spam and shove it in a
>>spam folder, you haven't actually done a single thing to prevent spam
>>other than save yourself a couple of seconds of sorting time. You haven't
>>even told the spammer that you won't want his mail.
>
> Umm, spammers won't care if you reject messages, they'll still keep
> sending it to you. Also remember that even if you reject at an SMTP level,
> you have still received the ENTIRE contents of the message (the DATA phase
> of the SMTP transaction) BEFORE you reject it, so you don't save any
> network bandwidth.
Yup. What you need to do (to hurt spammers) is to tarpit them. If you have
the resources. Meaning, accept the mail, but accept it r-e-a-l-l-y s-l-o-w.
Like one line every ten seconds.
This will hog the spammer's resources, which means s?he won't be able to
deliver more spam in the mean time. If you just reject the mail, they will
take the next SMTP server in their list and continue spamming.
QMail can do this (but only above a number of RCPT TO: lines, to prevent
mail bombing, it's not intended to stop spam). Exim can do this as well if
you are willing to patch and recompile.
--
Jens Benecke (jens at spamfreemail.de)
http://www.hitchhikers.de - Europaweite kostenlose Mitfahrzentrale
http://www.spamfreemail.de - 100% saubere Postfächer - garantiert!
http://www.rb-hosting.de - PHP ab 9? - SSH ab 19? - günstiger Traffic
.
Please DO NOT CC: me, I read the lists and newsgroups I post in!
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Simon Byrnand <si...@igrin.co.nz>.
At 10:56 6/04/2004, Nick Gilbert wrote:
>Hi all,
>
>Is there any way (with Qmail) to actually refuse delivery of a message
>based on the output or score of SpamAssassin?
>
>The problem is, if you accept a message, flag it as spam and shove it in a
>spam folder, you haven't actually done a single thing to prevent spam
>other than save yourself a couple of seconds of sorting time. You haven't
>even told the spammer that you won't want his mail.
Umm, spammers won't care if you reject messages, they'll still keep sending
it to you. Also remember that even if you reject at an SMTP level, you have
still received the ENTIRE contents of the message (the DATA phase of the
SMTP transaction) BEFORE you reject it, so you don't save any network
bandwidth.
>What would be nice is if you KNOW that a message is spam (ie it has a
>REALLY high score or is in the Razor database or something, then it could
>actually refuse to accept the message after the end of the DATA
>transmission in the SMTP session. Some bulk-mailing software does actually
>purge the mailing lists of addresses it couldn't deliver to (after all -
>all it does is slow the program down).
Sorry, but this simply isn't bourne out in practice. There is no evidence
that spammers remove "undeliverable" email address from their lists, and a
great deal of evidence that they don't remove email addresses at all.
>I would really like to find a way to reject messages based on certain
>criteria if at all possible. How would I go about doing this?
I'll let others help you on that point, there are a number of ways to do it...
>Please note that refusing to accept the message at SMTP delivery time is
>different to "bouncing" the message. A bounce message is a seperate
>message sent to the sender of the spam (which is almost always a fake or
>forged address). Bouncing spam simply creates MORE of a problem.
Yes. Be aware however that if you have multiple MX entries for your
domain(s) then you MUST run SpamAssassin on all of them, otherwise you WILL
generate bounce messages even though you think you're only rejecting.
EG - spammer delivers mail to your backup MX which is not running
SpamAssassin, so it accepts it, then tries to deliver it to your primary
MX. Your primary MX thinks its spam and rejects at the SMTP level,
unfortunately now it is the job of your backup MX to generate a bounce
message to the spammer and try and deliver it.
The only way to avoid this is to have the same SpamAssassin setup running
on all your incomming MX servers.
Regards,
Simon
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Steve Thomas <li...@sthomas.net>.
On Mon, Apr 05, 2004 at 11:56:23PM +0100, Nick Gilbert is rumored to have said:
>
> Is there any way (with Qmail) to actually refuse delivery of a message
> based on the output or score of SpamAssassin?
Don't know about Qmail, but exim does this extremely well using the exiscan patch.
--
"Well done is better than well said."
- Benjamin Franklin (1706-1790)
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Dave Sill <de...@sws5.ornl.gov>.
Nick Gilbert <ni...@nickgilbert.com> writes:
> Is there any way (with Qmail) to actually refuse delivery of a message
> based on the output or score of SpamAssassin?
I haven't tried it yet, but Len Budney's qscanq runs a virus checker
during the SMTP dialogue. I don't see any reason you couldn't write a
spamc wrapper that implements the same interface as the virus scanners
it's meant to work with.
See:
http://pobox.com/~lbudney/software/qscanq/
-Dave
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Simon Byrnand <si...@igrin.co.nz>.
At 12:00 6/04/2004, Burt wrote:
>As Simon Byrnand has already pointed out in a follow-up, secondary mail
>servers will still provide you with some of these headaches. Even having
>SpamAssassin functioning on the secondary server will not prevent all
>bounce messages, as, for example, the Bayes databases will be different.
>It's possible, and has happened in my network, that a message accepted
>on the secondary is bounced by the primary, once relayed. Of course, the
>net outcome is still far less bounce messages.
I didn't think of that..... one way to allieviate that would be to have a
seperate spamd server with the bayes database on it, and ALL MX servers use
spamc to connect to the same spamd server.... that way they all have a
coherant bayes database in effect. (Whether it would scale or not is
another issue)
Even then occasionally an RBL check might timeout on the backup but then
not on the primary and cause a bounce to be generated etc.... :/
Regards,
Simon
Re: Rejecting spam with SpamAssassin and Qmail
Posted by Burt <ng...@qogo.com>.
In article <40...@nickgilbert.com>, nick@nickgilbert.com
says...
> Is there any way (with Qmail) to actually refuse delivery of a message
> based on the output or score of SpamAssassin?
Nick,
Have a look at qpsmtpd (http://smtpd.develooper.com/), a drop-in
replacement for qmail-smtpd. With the spamassassin plugin, you can
perform the refusal that you are looking for. In fact, there are a
number of plugins that you can use to refuse delivery during the SMTP
session, as opposed to stock-qmail's method of accept-all-bounce-later.
> Please note that refusing to accept the message at SMTP delivery time is
> different to "bouncing" the message. A bounce message is a seperate
> message sent to the sender of the spam (which is almost always a fake or
> forged address). Bouncing spam simply creates MORE of a problem.
As Simon Byrnand has already pointed out in a follow-up, secondary mail
servers will still provide you with some of these headaches. Even having
SpamAssassin functioning on the secondary server will not prevent all
bounce messages, as, for example, the Bayes databases will be different.
It's possible, and has happened in my network, that a message accepted
on the secondary is bounced by the primary, once relayed. Of course, the
net outcome is still far less bounce messages.
Remember to make sure that your users are aware of the fact that you are
rejecting emails outright, and that it is possible, even if remote, that
they may lose ham messages.
Cheers,
Burt