SDB: Filtering Mail in eMail Server 3

Filtering Mail in eMail Server 3

Support knowledgebase (rsimai_imap_content_filter)

Applies to

eMail Server: Version 3

Aim

Filtering incoming mail in eMail Server 3 for protection agains SPAM

What is SPAM?

SPAM or UCE (Unsolicited Commercial E-mail) are unsolicited e-mail messages that are sent to recipients in great quantities (usually advertising). SPAM senders need a mail server (relay) by means of which the messages can be sent. For this purpose they look for servers that will forward mail to other domains without checking them (relaying).

What is relaying?

Relaying means that the eMail Server accepts mail that is addressed to domains that do not exist in the system and forwards it to its relay host or the respective mx host.
The receipt of mail addressed to the own domain does not constitute mail relaying and should always work.

What is open relay?

Open relay is a mail server that accepts mail via SMTP and forwards it to other domains, even if the sender is not authorized to do this.
By default, SuSE eMail Server is configured to block relaying. Relaying is only permitted in the following cases:

You have set up pop before smtp and the client has authenticated itself to the server within the set period by means of a POP or IMAP connection.
The sender is in the address range specified in $mynetworks (see /etc/postfix/main.cf). This is always the case if you use the web frontend for sending messages.
eMail Server is configured for SMTP-AUTH and this is supported/made use of by the client.
eMail Server has been configured for the use of certificates; you have assigned a certificate to the client and the client supports this feature.

If you are not sure if you have generated an open relay and do not no how to check it, you can have your server checked by an anti-SPAM initiative that offers this kind of services, such as http://www.abuse.net/ (though we can not make any statement regarding the reliability of the service).

What to do if the SPAM goes on and on?

You could try to trace the sender of a SPAM message. The sender can usually be identified by means of the header. However, clever SPAM senders insert a number of fake header lines that makes it look as though the message comes from a different sender. In this case the sender does not appear in the first (lower) header lines but in the later ones (further up).
Once you have tracked down the correct sender (IP address/host name), send a polite message to abuse@domain.com (insert the header of the SPAM message), domain.com being the domain of the first (correct) mail server. The administrator of this domain should take care of the problem.
In order to avoid the dreary task of dealing with SPAM every other day, there is the possibility of taking well-aimed measures.

Implementing anti-SPAM measures

The following section draws attention to several filtering methods. Decide for yourself which filter or which combination of filters you want to employ in order to achieve a maximum level of protection. However, SuSE can not guarantee success or prevent problems that may occur due to an incorrect configuration. You should be aware that the measures could also cause approved messages to be rejected!
The following steps have been designed to our best knowledge. Nevertheless, we can not exclude the possibility that an error may have crept in. Of course we are grateful for any feedback and error reports!

Filtering the header

Method
Searching the mail header for 'suspicious' contents that identify the message as SPAM.
How it works
Postfix includes a feature that enables searching the header. The message is scanned for a specific expression when it is received via SMTP. This method exclusively searches the mail header.
Configuration
1. Create the file /etc/postfix/header_checks.
  In this file, define rules for use by Postfix. For this purpose, use Perl Compatible Regular Expressions (PCRE; for a description please refer to the manpage man 5 pcre_table). Example:
```
		/^(To|From):*friend@(public.com|localhost.net)/ REJECT
		/^From:.*infowatch\.net/ REJECT
		/^To: ListMembers@theneffect/ REJECT
		
```
2. Edit /etc/postfix/main.cf and insert the following line:
```
		header_checks = pcre:/etc/postfix/header_checks
		
```
3. Reload the configuration:
```
		rcpostfix reload
		
```
Advantages
SPAM can often be identified from the header. This method enables you to filter out specific senders or subjects and reject a large portion of the undesired mail. All header lines can be used. For example, you can use the header of a SPAM message as template.
Disadvantages
You need to keep the list up to date. As soon as you receive a new SPAM you need to set up a suitable rule. Take care not to keep the rules too general, since this may cause even approved messages to be rejected, e.g. because the sender uses a subject that you blocked with a filter.

Filtering the mail body

Method
Searching the mail body for 'suspicious' expressions. The check can also be performed for the purpose of rejecting certain attachments.
How it works
Postfix includes a feature that enables searching the mail body when it is received via SMTP. This method exclusively searches the mail body.
Configuration
1. Create the file /etc/postfix/body_checks.
  In this file, define rules for use by Postfix. For this purpose, use Perl Compatible Regular Expressions (PCRE; for a description please refer to the manpage man 5 pcre_table). Example:
```
		/^Hi! How are you/ REJECT
		/(usa\.net|hotmail\.com|yahoo\.com)\?subject=remove/ REJECT
		/(filename|name)=".*\.(asd|chm|exe|doc|dll|hlp|hta|js|ocx|pif)"/ REJECT
		
```
2. Edit /etc/postfix/main.cf and insert the following line:
```
		body_checks = pcre:/etc/postfix/body_checks
		
```
3. Reload the configuration:
```
		rcpostfix reload
		
```
Advantages
Longer text passages can be filtered, thus avoiding approved messages from being rejected by mistake. Attachments, too, can be filtered. In the above example, the last rule causes messages accompanied by attachments with the respective extensions to be rejected.
Disadvantages
Here, too, there is the danger that you reject messages that are not SPAM. Furthermore, attachment filters can be circumvented by the sender by simply using other extensions that are not blocked by filters.

Blocking hosts or domains

Method
Selective blocking of hosts or domains that have previously sent SPAM.
How it works
Postfix includes a feature for keeping a list of hosts for which special arrangements can be made. In this case this means rejecting mail. Postfix checks the host names by means of DNS.

Configuration

Edit the file /etc/postfix/access and add rules as follows:

		#Blocking a domain, no host of this domain (including subdomains) is permitted to submit mail
		spammers.com REJECT
		#Blocking an individual IP address with error notification to the sender
		213.95.15.200 550 Keep your SPAM
		#Blocking an entire subnet (213.95.x.x)
		213.95 REJECT

Help is provided in the comments in the file or on the manpage man 5 access

Generate a db file:
```
		postmap /etc/postfix/access
		
```
Reload the configuration:
```
		rcpostfix reload
		
```

Advantages
The rejection or permission of mail from specific hosts or domains is easy to configure.
Disadvantages
The danger is that you block too many hosts. No mail can be delivered to you by way of a relay host in a blocked domain. Thus, instead of blocking the sender of the SPAM mail, you may block a mail server that is vital for your mail delivery.

Realtime Blackhole Lists (RBL)

Method
Blocking senders listed in a 'blacklist'. These blacklists require the ongoing maintenance of an up-to-date database where SPAM senders are listed.
How it works
Making use of the name service (reverse look-up), Postfix submits a query to a blacklist server in order to check whether the sender is listed. If the DNS check with the blacklist server is positive, the mail is rejected.
Some blacklist server operators offer the possibility of setting up a slave zone on the local name server in order to speed up DNS queries (e.g. http://www.mail-abuse.org/).
Configuration
Edit /etc/postfix/main.cf and insert the following lines. Modify the rbl_domains to the server(s) you want to use. Before you do so, check which servers are available. Some servers are subject to registration and payment of a fee. The servers used in this example may not work!
```
		smtpd_helo_restrictions = reject_maps_rbl
		maps_rbl_domains = blackholes.mail-abuse.org, relays.osirusoft.com
		
```
Reload the configuration:
```
		rcpostfix reload
		
```
Advantages
Little to configure and effective. The lists are updated by the respective server operator.
Disadvantages
Increased network load, as an additional name server query needs to be issued for every SMTP connection. There are some reports about a non working mailing system in case eg. the nameservice is not working. Furthermore, there is the possibility that some senders have been wrongly included. The contents of the blacklist are beyond your reach.

Additional measures

There are several other ways how you can make things difficult for SPAM senders. For example, you can use so-called 'teergrubing', which keeps connections from suspected SPAM senders open for a long period, thus making the dispatch ineffective. However, this method does not provide any advantages apart from annoying the SPAM sender.
If you use a productive system, do not embark on any experiments.
Make sure that your system is secure and can not be abused as a relay.

See also:

Activating SMTP Authentication To Other Mail Servers (Postfix)

Keywords: IMAP3, MAIL, POSTFIX, FILTER, CONTENT, HEADER, BODY, CHECK, ACCESS, UCE, RBL, SPAM

Categories: SuSE Linux IMAP Server

Feedback welcome: Send Mail to srsimai@suse.de (Please give the following subject: SDB-rsimai_imap_content_filter)

SDB-rsimai_imap_content_filter, Copyright SuSE Linux AG, Nürnberg, Germany - Version: 24. Apr 2002
SuSE Linux AG - Last generated: 14. Mai 2002 by ip (sdb_gen 1.40.0)