Copyright (c) 2002 Theo de Raadt. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.Dd December 18, 2002 .Dt SPAMD 8 .Os .Sh NAME .Nm spamd .Nd spam deferral daemon .Sh SYNOPSIS .Nm spamd .Op Fl 45d .Op Fl c Ar maxcon .Op Fl n Ar name .Op Fl p Ar port .Op Fl r Ar reply .Op Fl s Ar secs .Op Fl w Ar window .Sh DESCRIPTION .Nm is a fake .Xr sendmail 8 Ns -like daemon which rejects false mail. If the .Xr pf 4 packet filter is configured to redirect port 25 (SMTP) to this daemon, it will attempt to waste the time and resources of the spam sender.
p The options are as follows: l -tag -width Ds
p t Fl 4 Return error code 450 to the spammer (default). t Fl 5 Return error code 550 to the spammer. t Fl c Ar maxcon The maximum number of concurrent connections to allow. The default is 800. t Fl d Debug mode. .Nm does not .Xr fork 2 into the background. t Fl n Ar name The SMTP version banner that is reported upon initial connection. t Fl p Ar port Specify a different port number from the default port that .Nm should listen for redirected SMTP connections on. The default port is found by looking for the named service .Em spamd using .Xr getservbyname 3 . t Fl r Ar reply The SMTP error to return to the spammer, i.e. 450, 451, 550. This defaults to 450. t Fl s Ar secs Delay each character sent to the client by the specified amount of seconds. Defaults to 1. t Fl w Ar window Set the socket receive buffer to this many bytes, adjusting the window size. .El
p .Nm is designed to be very efficient so that it does not slow down the receiving machine. Spam is never accepted, but always rejected with either a 450 or 550 error message. The normal way that spam has been dealt with in the past is to either accept and drop, or outright block. When configured to use 450 responses, .Nm takes neither of these actions: it rejects the mail back to the senders' queue.
p .Nm is best started from .Xr rc 8 in conjunction with the .Xr spamd-setup 8 which processes a list of spammers' addresses, and applies appropriate .Xr pfctl 8 .Em rdr rules. .Xr spamd-setup 8 is run from .Xr cron 8 . .Sh REDIRECTING SMTP CONNECTIONS With .Xr pf 4 , connections to port 25 (SMTP) can be redirected to another host or port, based on the source address of the sender. The .Em rdr rules used for this purpose are described in .Xr pf.conf 5 . The rules can be loaded into a .Em table to simplify handling. d -literal table <spamd> persist rdr inet proto tcp from <spamd> to any port smtp -> 127.0.0.1 port 8025 .Ed
p Any addresses in table .Em <spamd> are then redirected to .Nm running on port 8025. Addresses can be loaded into the .Em table , like: d -literal # pfctl -q -t spamd -T replace -f /usr/local/share/spammers .Ed
p .Xr spamd-setup 8 can also be used to load addresses into the .Em <spamd> table. .Xr spamd-setup 8 also has the added benefit of being able to remove addresses from blacklists, and will connect to .Nm over a localhost socket, giving .Nm information about each source of blacklist addresses, as well as custom rejection messages for each blacklist source that can be used to let any real person whose mail is deferred by spamd know why their address has been listed from sending mail. This is important as it allows legitimate mail senders to pressure spam sources into behaving properly so that they may be removed from the relevant blacklists. .Sh CONFIGURATION CONNECTIONS .Nm listens for configuration connections on the port identified by the named service .Em spamd-cfg (see .Xr services 5 ) . The configuration socket listens only on the INADDR_LOOPBACK address. Configuration of spamd is done by connecting to the configuration socket, and sending blacklist information, one blacklist per line. Each blacklist consists of a name, a message to reject mail with, and addresses in CIDR format, all separated by semicolons (;): d -literal tag;"rejection message";aaa.bbb.ccc.ddd/mm;aaa.bbb.ccc.ddd/mm .Ed
p The rejection message must be inside double quotes. A \e" will produce a double quote in the output. \en will produce a newline. %A will expand to the connecting IP address in dotted quad format. %% may be used to produce a single % in the output. \e\e will produce a single \e. .Nm will reject mail by displaying all the messages from all blacklists in which a connecting address is matched. .Xr spamd-setup 8 is normally used to configure this information. .Sh LOGGING .Nm sends log messages to .Xr syslogd 8 using .Em facility daemon and, with increasing verbosity, .Em level err, warn, info and debug. The following .Xr syslog.conf 5 section can be used to log connection details to a dedicated file: d -literal !spamd daemon.err;daemon.warn;daemon.info /var/log/spamd .Ed .Sh FILES /etc/spamd.conf .Sh SEE ALSO .Xr pf.conf 5 , .Xr services 5 , .Xr spamd.conf 5 , .Xr syslog.conf 5 , .Xr pfctl 8 , .Xr spamd-setup 8 , .Xr syslogd 8 .Sh HISTORY The .Nm command appeared in .Ox 3.3 .