Copyright (c) 2002 Theo de Raadt. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.Dd December 18, 2002 .Dt SPAMD 8 .Os .Sh NAME .Nm spamd .Nd spam deferral daemon .Sh SYNOPSIS .Nm spamd k -words .Op Fl 45bdv .Op Fl B Ar maxblack .Op Fl c Ar maxcon .Oo .Fl G .Ar passtime : Ns Ar greyexp : Ns Ar whiteexp .Oc .Op Fl h Ar hostname .Op Fl l Ar address .Op Fl n Ar name .Op Fl p Ar port .Op Fl r Ar reply .Op Fl S Ar secs .Op Fl s Ar secs .Op Fl w Ar window .Ek .Sh DESCRIPTION .Nm is a fake .Xr sendmail 8 Ns -like daemon which rejects false mail. It is designed to be very efficient so that it does not slow down the receiving machine.
p .Nm considers sending hosts to be of three types:
p .Em blacklisted hosts are redirected to .Nm and .Em tarpitted i.e. they are communicated with very slowly to consume the sender's resources. Mail is rejected with either a 450 or 550 error message. A blacklisted host will not be allowed to talk to a real mail server.
p .Em whitelisted hosts do not talk to .Nm . Their connections are instead sent to a real mail server, such as .Xr sendmail 8 .
p .Em greylisted hosts are redirected to .Nm , but .Nm has not yet decided if they are likely spammers. They are given a temporary failure message by .Nm when they try to deliver mail.
p When .Nm is run in default mode, it will greylist connections from new hosts. Depending on its configuration, it may choose to blacklist the host or, if the checks described below are met, eventually whitelist it. When .Nm is run in blacklist-only mode, using the .Fl b flag, it will consult a pre-defined set of blacklist addresses to decide whether to tarpit the host or not.
p The options are as follows: l -tag -width Ds t Fl 4 For blacklisted entries, return error code 450 to the spammer (default). t Fl 5 For blacklisted entries, return error code 550 to the spammer. t Fl B Ar maxblack The maximum number of concurrent blacklisted connections to allow. This value may not be greater than maxcon (see below). The default is .Ar maxcon - 100. t Fl b Run in blacklist-only mode. t Fl c Ar maxcon The maximum number of concurrent connections to allow. .Ar maxcon may not exceed 800 (the default). t Fl d Debug mode. .Nm does not .Xr fork 2 into the background. t Xo .Fl G .Ar passtime : Ns Ar greyexp : Ns Ar whiteexp .Xc Adjust the three time parameters for greylisting. .Ar passtime defaults to 25 (minutes), .Ar greyexp to 4 (hours), and .Ar whiteexp to 864 (hours, approximately 36 days). t Fl h Ar hostname The hostname that is reported in the SMTP banner. t Fl l Ar address Specify the local address to which .Nm is to .Xr bind 2 . By default .Nm listens on all local addresses. t Fl n Ar name The SMTP version banner that is reported upon initial connection. t Fl p Ar port Specify a different port number from the default port that .Nm should listen for redirected SMTP connections on. The default port is found by looking for the named service .Dq spamd using .Xr getservbyname 3 . t Fl r Ar reply For blacklisted entries, the SMTP error to return to the spammer, e.g. 450, 451, 550. This defaults to 450. t Fl S Ar secs Stutter at greylisted connections for the specified amount of seconds, after which the connection is not stuttered at. Defaults to 10. t Fl s Ar secs Delay each character sent to the client by the specified amount of seconds. Defaults to 1. t Fl v Enable verbose logging. By default .Nm logs connections, disconnections and blacklist matches to .Xr syslogd 8 at .Dv LOG_INFO level. With verbose logging enabled, message detail including subject and recipient information is logged at .Dv LOG_INFO , along with the message body and SMTP dialogue being logged at .Dv LOG_DEBUG level. t Fl w Ar window Set the socket receive buffer to this many bytes, adjusting the window size. .El
p When run in default mode, connections receive the pleasantly innocuous temporary failure of: d -literal -offset 4n 451 Temporary failure, please try again later. .Ed
p This happens in the SMTP dialogue immediately after the DATA command is received from the client. .Nm will use the db file in
a /var/db/spamd to track these connections to .Nm by connecting IP address, HELO/EHLO, envelope-from, and envelope-to, or .Em tuple for short.
p A previously unseen tuple is added to the
a /var/db/spamd database, recording the time an initial connection attempt was seen. After .Em passtime minutes if .Nm sees a retried attempt to deliver mail for the same tuple, .Nm will whitelist the connecting address by adding it as a whitelist entry to
p .Nm regularly scans the
a /var/db/spamd database and configures all whitelist addresses as the .Aq spamd-white .Xr pf 4 table. The .Aq spamd-white table .Em must be used to allow connections to pass to the real MTA as in the following .Xr pf.conf 5 example: d -literal -offset 4n table \*(Ltspamd-white\*(Gt persist no rdr inet proto tcp from \*(Ltspamd-white\*(Gt to any \e port smtp rdr pass inet proto tcp from any to any \e port smtp -\*(Gt 127.0.0.1 port spamd .Ed
p Connections from addresses not listed in the .Aq spamd-white table are redirected to .Nm .
p .Nm removes tuple entries from the
a /var/db/spamd database if delivery has not been retried within .Em greyexp hours from the initial time a connection is seen. The default is 4 hours as this is the most common setting after which MTAs will give up attempting to retry delivery of a message.
p .Nm removes whitelist entries from the
a /var/db/spamd database if no mail delivery activity has been seen from the whitelisted address by .Xr spamlogd 8 within .Em whiteexp hours from the initial time an address is whitelisted. The default is 36 days to allow for the delivery of monthly mailing list digests without greylist delays every time.
p .Xr spamd-setup 8 should be run periodically by .Xr cron 8 . Use .Xr crontab 1 to uncomment the entry in root's crontab.
p .Xr spamlogd 8 should be used to update the whitelist entries in
a /var/db/spamd when connections are seen to pass to the real MTA on the .Em smtp port.
p .Xr spamdb 8 can be used to examine and alter the contents of
a /var/db/spamd . See .Xr spamdb 8 for further information. .Sh GREYTRAPPING When running .Nm in default mode, it may be useful to define .Em spamtrap destination addresses to catch spammers as they send mail from greylisted hosts. Such .Em spamtrap addresses affect only greylisted connections to .Nm and are used to temporarily blacklist a host that is obviously sending spam. Unused email addresses or email addresses on spammers' lists are very useful for this. When a host that is currently greylisted attempts to send mail to a .Em spamtrap address, it is blacklisted for 24 hours by adding the host to the .Nm blacklist .Aq spamd-greytrap . Spamtrap addresses are added to the
a /var/db/spamd database with the following .Xr spamdb 8 command:
p .Dl # spamdb -T -a 'spamtrap@mydomain.org'
p See .Xr spamdb 8 for further details.
p The file
a /etc/mail/spamd.alloweddomains can be used to specify a list of domainname suffixes, one per line, one of which must match each destination email address in the greylist. Any destination address which does not match one of the suffixes listed in
a /etc/mail/spamd.alloweddomains will be trapped, exactly as if it were sent to a .Em spamtrap address above.
p For example, if
a /etc/mail/spamd.alloweddomains contains: d -literal -offset 4n @humpingforjesus.com obtuse.com .Ed
p the destination addresses .Em beardedclams@humpingforjesus.com , .Em beck@obtuse.com , and .Em beck@snouts.obtuse.com would not cause the sending host to be trapped. However the addresses .Em peter@apostles.humpingforjesus.com or .Em bigbutts@bofh.ucs.ualberta.ca would cause the sending host to be trapped. .Sh BLACKLISTING The normal way that spam has been dealt with in the past is to either accept and drop, or outright block. When configured to use 450 responses, .Nm takes neither of these actions: it rejects the mail back to the senders' queue.
p With .Xr pf 4 , connections to port 25 (SMTP) can be redirected to another host or port, based on the source address of the sender. The .Em rdr rules used for this purpose are described in .Xr pf.conf 5 . The rules can be loaded into a .Em table to simplify handling. d -literal -offset 4n table \*(Ltspamd\*(Gt persist rdr pass inet proto tcp from \*(Ltspamd\*(Gt to any \e port smtp -\*(Gt 127.0.0.1 port spamd .Ed
p Any addresses in table .Aq spamd are then redirected to .Nm . Addresses can be loaded into the .Em table , like: d -literal -offset 4n # pfctl -q -t spamd -T replace -f /usr/local/share/spammers .Ed
p .Xr spamd-setup 8 can also be used to load addresses into the .Aq spamd table. .Xr spamd-setup 8 also has the added benefit of being able to remove addresses from blacklists, and will connect to .Nm over a localhost socket, giving .Nm information about each source of blacklist addresses, as well as custom rejection messages for each blacklist source that can be used to let any real person whose mail is deferred by .Nm know why their address has been listed from sending mail. This is important as it allows legitimate mail senders to pressure spam sources into behaving properly so that they may be removed from the relevant blacklists. .Sh CONFIGURATION CONNECTIONS .Nm listens for configuration connections on the port identified by the named service .Dq spamd-cfg (see .Xr services 5 ) . The configuration socket listens only on the INADDR_LOOPBACK address. Configuration of spamd is done by connecting to the configuration socket, and sending blacklist information, one blacklist per line. Each blacklist consists of a name, a message to reject mail with, and addresses in CIDR format, all separated by semicolons (;): d -literal -offset indent tag;"rejection message";aaa.bbb.ccc.ddd/mm;aaa.bbb.ccc.ddd/mm .Ed
p The rejection message must be inside double quotes. A \e" will produce a double quote in the output. \en will produce a newline. %A will expand to the connecting IP address in dotted quad format. %% may be used to produce a single % in the output. \e\e will produce a single \e. .Nm will reject mail by displaying all the messages from all blacklists in which a connecting address is matched. .Xr spamd-setup 8 is normally used to configure this information. .Sh LOGGING .Nm sends log messages to .Xr syslogd 8 using .Em facility daemon and, with increasing verbosity, .Em level err, warn, info and debug. The following .Xr syslog.conf 5 section can be used to log connection details to a dedicated file: d -literal -offset indent !spamd daemon.err;daemon.warn;daemon.info /var/log/spamd .Ed .Sh FILES l -tag -width "/etc/mail/spamd.alloweddomainsXX" -compact t /etc/mail/spamd.conf Default configuration file. t /etc/mail/spamd.alloweddomains Optional required suffixes for greytrapping. t /var/db/spamd Greylisting database. .El .Sh SEE ALSO .Xr pf.conf 5 , .Xr services 5 , .Xr spamd.conf 5 , .Xr syslog.conf 5 , .Xr pfctl 8 , .Xr spamd-setup 8 , .Xr spamdb 8 , .Xr spamlogd 8 , .Xr syslogd 8 .Sh HISTORY The .Nm command first appeared in .Ox 3.3 .
p Previous versions of .Nm required traps to be entered into the database including the enclosing \*(Lt\*(Gt characters; current versions expect only the email address without the enclosing \*(Lt\*(Gt characters. .Sh BUGS .Nm currently uses the user .Dq _spamd outside a chroot jail when running in default mode, and requires the greylisting database in
a /var/db/spamd to be owned by the .Dq _spamd user. This is wrong and should change to a distinct user from the one used by the chrooted .Nm process.