Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] anti-spam

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Steven Champeon <schampeo AT hesketh.com>
  • To: internetworkers AT lists.ibiblio.org
  • Subject: Re: [internetworkers] anti-spam
  • Date: Thu, 12 Jun 2003 14:31:40 -0400

on Sat, Jun 07, 2003 at 01:32:33AM -0400, Jay Cuthrell wrote:
> [snip]
> > The SpamAssassin and procmail folks have offered a lot of great
> > essentials recently, but I like that old phrase "nip it in the bud."
> > I'd rather the spammers not have the email addresses in the first place,
> > instead of trying to stem the tidal flood of incoming crap. I'm
> > curious; does anyone have any stats for any given server resources
> > allotted to dealing with spam (space, bandwidth, cputime, whatever)?
> [snip]
>
> "I have detailed files" -- Terminator
>
> We run ISP's here and aggregate +100k accounts. So, dealing with spam is
> something we know a great deal about. We greymail it all. i.e. we keep
> it for review.

After trying Razor, SpamAssassin, SpamBouncer, and a variety of other
services and DNSBLs, we've pretty much decided on a combination of the
DNSBLs and digitalanswers.de's check_local, plus the following:

1) ipchains - block certain spammers at the TCP level, using listings
from spews.org; I'll go in and add all the ROKSO spammers, too, as
time permits. Currently list 11067 netblocks.

2) sendmail - I started bouncing all of our spamtraps, instead of just
archiving them and using them to figure out where the spam was coming
from. I realized I didn't care - I just wanted it to stop. We
currently have 1546 spamtraps on serrano and habanero.

3) sendmail access.db - block/tag mail from or advertising known spammer
domains (currently 20537 known). Includes some mainsleaze spammers, too.

4) sendmail rulesets - started bouncing all mail sent direct from a dialup,
cable modem, or DSL line using 100+ different patterns.

5) procmail - tagged and quarantined everything sent to our low priority
MX; it was 99.999% spam. Quarantined everything that was sent from an
obviously forged domain (e.g., freemedz AT yahoo.com sent from a Russian
cable modem). Quarantined anything containing a known blacklisted
domain in the body. Quarantined everything containing the MIME header
'multipart/alternative' but only one HTML part.

Basically, gave up on Razor. Great idea, lousy implementation. They
can't keep their servers up, and I've got better things to do than wait
for them to come back so I can report mail other people pay them to block.

Eventually, I'll be bouncing most, if not all, of the spam that I'm
catching with procmail, gradually turning the procmail rules into
sendmail rules. For now, though, the logic is too complex (skip forgery
checks on mailing lists, for example) and I haven't written the sendmail
rules to do that yet. And when I do, I'll go back over the check_local
stuff and trash what I'm not using and integrate my rules into the set.

I estimate I've cut the spam down by 95% this way. More for our customers,
as most of the stuff I don't bounce gets quarantined, and I figure out how
to block it the next time. So they don't even see it.

You can see the dramatic results:

Jun 1 539
Jun 2 448
Jun 3 370
Jun 4 316
Jun 5 271
Jun 6 299
Jun 7 131
Jun 8 64
Jun 9 73
Jun 10 72

That's how many spams made it through, but were quarantined, on each day
on our primary mail server this month. Guess when I implemented the new
cable/dsl/dialup bounce rules ;) For comparison, here's the same stats
for May:

May 1 782
May 2 868
May 3 783
May 4 609
May 5 870
May 6 1039
May 7 1340
May 8 1344
May 9 1472
May 10 1268
May 11 1281
May 12 1248
May 13 1007
May 14 842
May 15 900
May 16 913
May 17 884
May 18 889
May 19 1168
May 20 1114
May 21 1064
May 22 936
May 23 1036
May 24 924
May 25 930
May 26 966
May 27 818
May 28 889
May 29 849
May 30 773
May 31 847

So, it's helping. From a peak of 1472/day in May, we're down to a 64/day
low in June. That's 96%.

And that is just the mail we /quarantine/. I figure we're bouncing /
rejecting over 2500 messages a day, total, mostly from our low priority
MX. Very low false positive rate - maybe .01%.

You can beat spam.

--
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier




Archive powered by MHonArc 2.6.24.

Top of Page