Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung | |||
| centos:mail_c6:spam_1 [22.11.2013 11:31. ] – [postgrey Administration] django | centos:mail_c6:spam_1 [20.04.2018 10:44. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| + | ====== SPAM-Abwehr mit Hilfe von Greylisting ====== | ||
| + | Ein auf SPAM-Versand optimiertes System, wird in aller Regel sehr viel daran gelegen sein, möglichst eine große Anzahl von Nachrichten in möglichst kürzester Zeit zu verschicken. Jede Verzögerung beim SPAM-Versand wird sich äußerst ungünstig auf die Erfolgsquote des Versenders auswirken. Hintergrund beim Thema greylisting ist nun, unbekannte Einlieferer mit einem temporären Fehler abzuweisen und so eine erneute **erstmalige** Zeitverzögerung zu erzwingen. Vergleichbar mit einer //belegten Rufnummer// bei einem Faksimilegerät. | ||
| + | |||
| + | Lediglich der aus den einschlägigen **BSI**((**B**otnet **S**pam **I**P-Ranges)) verschickten SPAMs lässt sich so nicht beikommen. Hier kann aber mit dem [[centos: | ||
| + | |||
| + | Beides, **// | ||
| + | |||
| + | |||
| + | Für den ersten groben SPAM-Schutz setzen wir auf **greylisting**-Mechanismen. Greylisting macht es sich zu eigen, das unterschiedliche Verhalten von SPAMern und richtigen Mailservern zu betrachten. Beim greylisting werden folgende vier Schritte durchlaufen bzw. bewertet: | ||
| + | - Der MTA bewertet die drei folgenden technischen Eckdaten eines Zustellversuches, | ||
| + | * **Absender-IP-Adresse** | ||
| + | * **eMail-Adresse des Absenders** | ||
| + | * **eMail-Adresse des Empfängers** | ||
| + | - Das Tripple aus IP-Adresse, Sender- und Empfänger-eMail-Adresse speichert der MTA nun in einer separaten Berkley-DB ab. Ist dieses Tripple neu, d.h. es wurde noch keine eMail von dem Absender an unseren Empfänger von diesem Mailserver eingeliefert, | ||
| + | - Ist der einliefernde Host ein SPAMer wird er die Nachricht verwerfen und sein Glück bei anderen weniger geschützten MTTAs versuchen. Ein richtiger Mailserver wird seine eMail in die deferred-Queue einstellen und nach wenigen Minuten einen erneuten Zustellversuch unternehmen. | ||
| + | - Kommt der einliefernde Mailserver erneut, wird nun das Tripple aus IP-Adresse, Sender- und Empfänger-eMail-Adresse positiv bewertet und unser MTA wird mit der weiteren Prüfung und Bewertung der eMail fortfahren. | ||
| + | |||
| + | ===== postgrey Installation ===== | ||
| + | Für das Thema greylisting greifen wir auf das Paket **postgrey** von [[http:// | ||
| + | |||
| + | Wir installieren also zu erst einmal das betreffende Paket mit Hilfe von **YUM**. | ||
| + | # yum install postgrey -y | ||
| + | |||
| + | |||
| + | ===== postfix Konfiguration ===== | ||
| + | Eigentlich muss man nicht **postgrey** sondern **postfix** konfigurieren. | ||
| + | |||
| + | Wir fügen also in unsere **/ | ||
| + | <code bash>... | ||
| + | # RBL überprüfen (Kapitel 10.11 Realtime Blackhole Lists) | ||
| + | reject_rbl_client zen.spamhaus.org, | ||
| + | reject_rbl_client ix.dnsbl.manitu.net, | ||
| + | reject_rbl_client bl.spamcop.net, | ||
| + | reject_rbl_client dnsbl.njabl.org, | ||
| + | reject_rhsbl_client multi.uribl.com, | ||
| + | # Greylisting via postgrey checken via Unix-Socket | ||
| + | check_policy_service unix: | ||
| + | |||
| + | # Dynamische Prüfung auf existente Relay-Empfänger | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | ===== postgrey starten ===== | ||
| + | Beim vorliegenden postgrey-RPM ist neben der Festlegung von User- und Dateirechten auch gleich ein passendes Startupscript installiert worden. Somit reicht ein einfaches **service postgrey start** aus: | ||
| + | # service postgrey start | ||
| + | Mit einem Blick in die Prozessliste können wir uns vergewissern, | ||
| + | # ps auxw | grep postgrey | ||
| + | < | ||
| + | </ | ||
| + | |||
| + | Selbstverständlich " | ||
| + | <code bash> | ||
| + | Jun 8 16:34:03 vml000080 postgrey[20808]: | ||
| + | Jun 8 16:34:03 vml000080 postgrey[20808]: | ||
| + | Jun 8 16:34:03 vml000080 postgrey[20808]: | ||
| + | Jun 8 16:34:03 vml000080 postgrey[20808]: | ||
| + | Jun 8 16:34:03 vml000080 postgrey[20808]: | ||
| + | </ | ||
| + | |||
| + | ===== automatisches Starten des Dienste beim Systemstart | ||
| + | Damit der postgrey-Daemon automatisch bei jedem Systemstart startet, denn ohne laufenden **postgrey** verweigert nun unser **postfix** die Annahme der Nachrichten, | ||
| + | # chkconfig postgrey on | ||
| + | |||
| + | Die Überprüfungung ob die beiden Dienste (Daemons) postfix und postgrey wirklich bei jedem Systemstart automatisch mit gestartet werden, kann durch folgenden Befehle erreicht werden: | ||
| + | # chkconfig --list | grep post* | ||
| + | < | ||
| + | postgrey | ||
| + | </ | ||
| + | |||
| + | Wichtig sind jeweils die Schalter **on** bei den Runleveln - **2 3 4 5**. | ||
| + | |||
| + | ===== postgrey Administration ===== | ||
| + | Die Konfigurationsdateien rund um postgrey befinden sich im Verzeichnis // | ||
| + | # ll / | ||
| + | < | ||
| + | -rw-r--r-- 1 root root 75 Mar 15 09:53 / | ||
| + | -rw-r--r-- 1 root root 194 Mar 7 15:54 / | ||
| + | </ | ||
| + | |||
| + | Die Konfigurationsdateien im Verzeichnis / | ||
| + | |||
| + | * **postgrey_whitelist_clients** Tabelle zur Definition von Ausnahmeregeln beim Greylisting-Daemon, | ||
| + | # -------------------------------------------- | ||
| + | # put this file in / | ||
| + | # with --whitelist-clients=xxx | ||
| + | # | ||
| + | # postgrey version: 1.34, build date: 2011-05-04 | ||
| + | |||
| + | # greylisting.org: | ||
| + | southwest.com | ||
| + | # greylisting.org: | ||
| + | isp.belgacom.be | ||
| + | # greylisting.org: | ||
| + | ameritradeinfo.com | ||
| + | # greylisting.org: | ||
| + | amazon.com | ||
| + | # 2004-05-20: Linux kernel mailing-list (unique sender with letters) | ||
| + | vger.kernel.org | ||
| + | # 2004-06-02: karger.ch, no retry | ||
| + | karger.ch | ||
| + | # 2004-06-02: lilys.ch, (slow: 4 hours) | ||
| + | server-x001.hostpoint.ch | ||
| + | # 2004-06-09: roche.com (no retry) | ||
| + | gw.bas.roche.com | ||
| + | # 2004-06-09: newsletter (no retry) | ||
| + | mail.hhlaw.com | ||
| + | # 2004-06-09: no retry (reported by Ralph Hildebrandt) | ||
| + | prd051.appliedbiosystems.com | ||
| + | # 2004-06-17: swissre.com (no retry) | ||
| + | swissre.com | ||
| + | # 2004-06-17: dowjones.com newsletter (unique sender with letters) | ||
| + | returns.dowjones.com | ||
| + | # 2004-06-18: switch.ch (works but personnel is confused by the error) | ||
| + | domin.switch.ch | ||
| + | # 2004-06-23: accor-hotels.com (slow: 6 hours) | ||
| + | accor-hotels.com | ||
| + | # 2004-06-29: rr.com (no retry, reported by Duncan Hill) | ||
| + | / | ||
| + | # 2004-06-29: cox.net (no retry, reported by Duncan Hill) | ||
| + | / | ||
| + | # 2004-06-29: motorola.com (no retry) | ||
| + | mot.com | ||
| + | # 2004-07-01: nic.fr (address verification, | ||
| + | nic.fr | ||
| + | # 2004-07-01: verizon.net (address verification, | ||
| + | / | ||
| + | # 2004-07-02: cs.columbia.edu (no retry) | ||
| + | cs.columbia.edu | ||
| + | # 2004-07-02: papersinvited.com (no retry) | ||
| + | 66.216.126.174 | ||
| + | # 2004-07-02: telekom.de (slow: 6 hours) | ||
| + | / | ||
| + | # 2004-07-04: tiscali.dk (slow: 12 hours, reported by Klaus Alexander Seistrup) | ||
| + | / | ||
| + | # 2004-07-04: freshmeat.net (address verification) | ||
| + | freshmeat.net | ||
| + | # 2004-07-11: zd-swx.com (unique sender with letters, reported by Bill Landry) | ||
| + | zd-swx.com | ||
| + | # 2004-07-11: lockergnome.wc09.net (unique sender with letters, reported by Bill Landry) | ||
| + | lockergnome.wc09.net | ||
| + | # 2004-07-19: mxlogic.net (no retry, reported by Eric) | ||
| + | p01m168.mxlogic.net | ||
| + | p02m169.mxlogic.net | ||
| + | # 2004-09-08: intel.com (pool on different subnets) | ||
| + | / | ||
| + | # 2004-09-17: cox-internet.com (no retry, reported by Rod Roark) | ||
| + | / | ||
| + | # 2004-10-11: logismata.ch (no retry) | ||
| + | logismata.ch | ||
| + | # 2004-11-25: brief.cw.reum.de (no retry, reported by Manuel Oetiker) | ||
| + | brief.cw.reum.de | ||
| + | # 2004-12-03: ingeno.ch (no retry) | ||
| + | qmail.ingeno.ch | ||
| + | # 2004-12-06: rein.ch (no retry) | ||
| + | mail1.thurweb.ch | ||
| + | # 2005-01-26: tu-ilmenau.de (no retry) | ||
| + | piggy.rz.tu-ilmenau.de | ||
| + | # 2005-04-06: polymed.ch (no retry) | ||
| + | mail.polymed.ch | ||
| + | # 2005-06-08: hu-berlin.de (slow: 6 hours, reported by Joachim Schoenberg) | ||
| + | rz.hu-berlin.de | ||
| + | # 2005-06-17: gmail.com (big pool, reported by Beat Mueller) | ||
| + | proxy.gmail.com | ||
| + | # 2005-06-23: cacert.org (address verification, | ||
| + | cacert.org | ||
| + | # 2005-07-27: polytech.univ-mrs.fr (no retry, reported by Giovanni Mandorino) | ||
| + | polytech.univ-mrs.fr | ||
| + | # 2005-08-05: gnu.org (address verification, | ||
| + | gnu.org | ||
| + | # 2005-08-17: ciphirelabs.com (needs fast responses, reported by Sven Mueller) | ||
| + | cs.ciphire.net | ||
| + | # 2005-11-11: lufthansa (no retry, reported by Peter Bieringer) | ||
| + | / | ||
| + | # 2005-11-23: arcor-online.net (slow: 12 hours, reported by Bernd Zeimetz) | ||
| + | / | ||
| + | # 2005-12-29: netsolmail.com (no retry, reported by Gareth Greenaway) | ||
| + | netsolmail.com | ||
| + | # mail.likopris.si (no retry, reported by Vito Robar) | ||
| + | 193.77.153.67 | ||
| + | # jcsw.nato.int (several servers, no retry, reported by Vito Robar) | ||
| + | 195.235.39 | ||
| + | # tesla.vtszg.hr (no retry, reported by Vito Robar) | ||
| + | tesla.vtszg.hr | ||
| + | # mailgw*.iai.co.il (pool of several servers, reported by Vito Robar) | ||
| + | / | ||
| + | # gw.stud-serv-mb.si (no retry, reported by Vito Robar) | ||
| + | gw.stud-serv-mb.si | ||
| + | # mail.commandtech.com (no retry, reported by Vito Robar) | ||
| + | 216.238.112.99 | ||
| + | # duropack.co.at (no retry, reported by Vito Robar) | ||
| + | 193.81.20.195 | ||
| + | # mail.esimit-tech.si (no retry, reported by Vito Robar) | ||
| + | 193.77.126.208 | ||
| + | # mail.resotel.be (ocasionally no retry, reported by Vito Robar) | ||
| + | 80.200.249.216 | ||
| + | # mail2.alliancefr.be (ocasionally no retry, reported by Vito Robar) | ||
| + | mail2.alliancefr.be | ||
| + | # webserver.turboinstitut.si (no retry, reported by Vito Robar) | ||
| + | webserver.turboinstitut.si | ||
| + | # mil.be (pool of different servers, reported by Vito Robar) | ||
| + | 193.191.218.141 | ||
| + | 193.191.218.142 | ||
| + | 193.191.218.143 | ||
| + | 194.7.234.141 | ||
| + | 194.7.234.142 | ||
| + | 194.7.234.143 | ||
| + | # mail*.usafisnews.org (no retry, reported by Vito Robar) | ||
| + | / | ||
| + | # odk.fdv.uni-lj.si (no retry, reported by Vito Robar) | ||
| + | / | ||
| + | # rak-gentoo-1.nameserver.de (no retry, reported by Vito Robar) | ||
| + | rak-gentoo-1.nameserver.de | ||
| + | # dars.si (ocasionally no retry, reported by Vito Robar) | ||
| + | mx.dars.si | ||
| + | # cosis.si (no retry, reported by Vito Robar) | ||
| + | 213.143.66.210 | ||
| + | # mta? | ||
| + | / | ||
| + | # pim-N-N.quickinspirationsmail.com (unique sender, reported by Vito Robar) | ||
| + | / | ||
| + | # flymonarch (no retry, reported by Marko Djukic) | ||
| + | flymonarch.com | ||
| + | # wxs.nl (no retry, reported by Johannes Fehr) | ||
| + | / | ||
| + | # ibm.com (big pool, reported by Casey Peel) | ||
| + | ibm.com | ||
| + | # messagelabs.com (big pool, reported by John Tobin) | ||
| + | / | ||
| + | # ptb.de (slow, reported by Joachim Schoenberg) | ||
| + | berlin.ptb.de | ||
| + | # registrarmail.net (unique sender names, reported by Simon Waters) | ||
| + | registrarmail.net | ||
| + | # google.com (big pool, reported by Matthias Dyer, Martin Toft) | ||
| + | google.com | ||
| + | # orange.fr (big pool, reported by Lo�c Le Loarer) | ||
| + | / | ||
| + | # citigroup.com (slow retry, reported by Michael Monnerie) | ||
| + | / | ||
| + | # cruisingclub.ch (no retry) | ||
| + | mail.ccs-cruising.ch | ||
| + | # digg.com (no retry, Debian #406774) | ||
| + | diggstage01.digg.com | ||
| + | # liberal.ca (retries only during 270 seconds, Debian #406774) | ||
| + | smtp.liberal.ca | ||
| + | # pi.ws (pool + long retry, Debian #409851) | ||
| + | / | ||
| + | # rambler.ru (big pool, reported by Michael Monnerie) | ||
| + | rambler.ru | ||
| + | # free.fr (big pool, reported by Denis Sacchet) | ||
| + | / | ||
| + | / | ||
| + | # thehartford.com (pool + long retry, reported by Jacob Leifman) | ||
| + | / | ||
| + | # abb.com (only one retry, reported by Roman Plessl) | ||
| + | / | ||
| + | # 2007-07-27: sourceforge.net (sender verification) | ||
| + | lists.sourceforge.net | ||
| + | # 2007-08-06: polytec.de (no retry, reported by Patrick McLean) | ||
| + | polytec.de | ||
| + | # 2007-09-06: qualiflow.com (no retry, reported by Alex Beckert) | ||
| + | / | ||
| + | # 2007-09-07: nrl.navy.mil (no retry, reported by Axel Beckert) | ||
| + | nrl.navy.mil | ||
| + | # 2007-10-18: aliplast.com (long retry, reported by Johannes Feigl) | ||
| + | mail.aliplast.com | ||
| + | # 2007-10-18: inode.at (long retry, reported by Johannes Feigl) | ||
| + | / | ||
| + | # 2008-02-01: bol.com (no retry, reported by Frank Breedijk) | ||
| + | / | ||
| + | # 2008-06-05: registeredsite.com (no retry, reported by Fred Kilbourn) | ||
| + | / | ||
| + | # 2008-07-17: mahidol.ac.th (no retry, reported by Alex Beckert) | ||
| + | saturn.mahidol.ac.th | ||
| + | # 2008-07-18: ebay.com (big pool, reported by Peter Samuelson) | ||
| + | ebay.com | ||
| + | # 2008-07-22: yahoo.com (big pool, reported by Juan Alonso) | ||
| + | yahoo.com | ||
| + | # 2008-11-07: facebook (no retry, reported by Tim Freeman) | ||
| + | / | ||
| + | # 2009-02-10: server14.cyon.ch (long retry, reported by Alex Beckert) | ||
| + | server14.cyon.ch | ||
| + | # 2009-08-19: 126.com (big pool) | ||
| + | / | ||
| + | # 2010-01-08: tifr.res.in (no retry, reported by Alex Beckert) | ||
| + | home.theory.tifr.res.in | ||
| + | # 2010-01-08: 1blu.de (long retry, reported by Alex Beckert) | ||
| + | ms4-1.1blu.de | ||
| + | # 2010-03-17: chello.at (big pool, reported by Jan-willem van Eys) | ||
| + | / | ||
| + | # 2010-05-31: nic.nu (long retry, reported by Ivan Sie) | ||
| + | mx.nic.nu | ||
| + | # 2010-06-10: Microsoft servers (long/no retry, reported by Roy McMorran) | ||
| + | bigfish.com | ||
| + | frontbridge.com | ||
| + | microsoft.com | ||
| + | # 2010-06-18: Google/ | ||
| + | postini.com | ||
| + | # 2011-02-04: evanzo-server.de (no retry, reported by Andre Hoepner) | ||
| + | / | ||
| + | # 2011-05-02: upcmail.net (big pool, reported by Michael Monnerie) | ||
| + | upcmail.net | ||
| + | </ | ||
| + | * **postgrey_whitelist_clients.local** Tabelle zur Definition von lokalen Ausnahmeregeln beim Greylisting-Daemon. Bei Bedarf wird man hier in dieser Tabelle individuelle Definitionen vornehmen. < | ||
| + | # | ||
| + | / | ||
| + | </ | ||
| + | * **postgrey_whitelist_recipients** Tabelle zur Definition von Ausnahmeregeln beim Greylisting-Daemon, | ||
| + | # -------------------------------------- | ||
| + | # put this file in / | ||
| + | # with --whitelist-recipients=xxx | ||
| + | |||
| + | postmaster@ | ||
| + | abuse@ | ||
| + | </ | ||
| + | |||
| + | <WRAP round important> | ||
| + | Nach Änderungen an den Postgrey Ausnahmelisten **postgrey_whitelist_clients.local** und **postgrey_whitelist_recipients** ist der Daemon von den Änderungen mit einem reload in Kenntnis zu setzen! < | ||
| + | </ | ||
| + | |||
| + | ===== erfolgreiches Greylisting | ||
| + | Am nachfolgenden Beispiel sehen wir, dass ein Connectversuch von einem uns unbekanntem Mailserver erst einmal mit einem **450er** abgewiesen wird und später nocheinmal zugestellt werden soll. | ||
| + | < | ||
| + | Oct 12 04:35:41 nss postgrey[8228]: | ||
| + | Oct 12 04:35:41 nss postgrey[8228]: | ||
| + | Oct 12 04:35:41 nss postfix/ | ||
| + | Oct 12 04:35:41 nss postfix/ | ||
| + | Beim nächsten Zustellversuch wird die eMail dann entsprechend akzeptiert: | ||
| + | < | ||
| + | Oct 12 11:28:41 nss postgrey[8228]: | ||
| + | Oct 12 11:28:41 nss postfix/ | ||
| + | Oct 12 11:28:41 nss postfix/ | ||
| + | Oct 12 11:28:41 nss postfix/ | ||
| + | Oct 12 11:28:41 nss postfix/ | ||
| + | Oct 12 11:28:41 nss postfix/ | ||
| + | Oct 12 11:31:13 nss postfix/ | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **[[centos: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||