SDB: Mail Filtering on Openexchange Server (Protection Against SPAM)

Mail Filtering on Openexchange Server (Protection Against SPAM)

Support knowledgebase (rsimai_slox_anti_spam)

Situation

You want to filter the incoming mail on the Openexchange Server as a protection measure against SPAM

Some parts of these instructions are usable on any current Postfix system. The principle is the same. The Procmail/Spamassassin filter is only available on the Openexchange Server in this form.

What is SPAM?

SPAM or UCE (Unsolicited Commercial E-mail) are unsolicited e-mail messages that are sent to recipients in great quantities (usually advertising). SPAM senders need a mail server (relay) by means of which the messages can be sent. For this purpose they look for servers that will forward mail to other domains without checking them (relaying).

What is relaying?

Relaying means that the eMail Server accepts mail that is addressed to domains that do not exist in the system and forwards it to its relay host or the respective mx host.
The receipt of mail addressed to the own domain does not constitute mail relaying and should always work.

What is open relay?

Open relay is a mail server that accepts mail via SMTP and forwards it to other domains, even if the sender is not authorized to do this.
By default, SuSE eMail Server is configured to block relaying. Relaying is only permitted in the following cases:

You have set up pop before smtp and the client has authenticated itself to the server within the defined time limit by means of a POP or IMAP connection.
The sender is in the address range specified in $mynetworks (see /etc/postfix/main.cf). This is always the case if you use the web frontend for sending messages.
eMail Server is configured for SMTP-AUTH and this is supported/made use of by the client.
eMail Server has been configured for the use of certificates; you have assigned a certificate to the client and the client supports this feature.

What to do if the SPAM goes on and on?

You could try to trace the sender of a SPAM message. The sender can usually be identified by means of the header. However, clever SPAM senders insert a number of fake header lines that makes it look as though the message comes from a different sender. In this case the sender does not appear in the first (lower) header lines but in the later ones (further up).
Once you have tracked down the correct sender (IP address/host name), send a polite message to abuse@domain.com (insert the header of the SPAM message), domain.com being the domain of the first (correct) mail server. The administrator of this domain should take care of the problem.
In order to avoid the dreary task of dealing with SPAM every other day, there is the possibility of taking well-aimed measures.

Implementing anti-SPAM measures

The following section draws attention to several filtering methods. Decide for yourself which filter or which combination of filters you want to employ in order to achieve a maximum level of protection. However, SuSE can not guarantee success or prevent problems that may occur due to an incorrect configuration. You should be aware that the measures could also cause approved messages to be rejected! The following steps have been designed to our best knowledge. Nevertheless, we can not exclude the possibility that an error may have crept in. Of course we are grateful for any feedback and error reports!

Activating Openexchange Server's built-in protection (SPAM filter)

Method
Incoming mesages are examined but not on the basis of fixed expressions.

How it works
Incoming messages are sent through a 'content_filter' (Procmail/Spamassassin) and furnished with additional header lines. The evaluation is continuous. Initially, the messages are not filtered or rejected, but merely marked.
For example, a marked message with this content includes the following additional header lines:

X-Spam-Status: Yes, hits=8.7 required=5.0
        tests=UNDISC_RECIPS,NO_REAL_NAME,CLICK_BELOW,UPPERCASE_25_50,
              CLICK_HERE_LINK
        version=2.31
X-Spam-Flag: YES
X-Spam-Level: ********
X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $)
X-Spam-Report:   8.7 hits, 5 required;
  *  4.0 -- Valid-looking To "undisclosed-recipients"
  *  0.5 -- From: does not include a real name
  *  1.5 -- BODY: Asks you to click below
  *  1.9 -- BODY: message body is 25-50% uppercase
  *  0.8 -- BODY: Tells you to click on a URL

Configuration
To activate this function as administrator, login as cyrus and select the option 'SPAM Filter' under 'Mail', 'Postfix'.
Normal users can activate this function under 'Setup', 'Mailfilter', 'SPAM'. Alternatively, a SIEVE filter can be used to filter separate units.
Advantages
The evaluation is performed by the system without having to define explicit rules. Each user can decide whether he/she wants to receive or filter marked messages. The system does not depend on other servers such as RBLs.
Disadvantages
Some messages might be wrongly marked and this method does not offer a total security either. It is only possible to clearly identify a message be checking a great number of criteria. If the mail traffic is very high, the system load will be enormous!

Using Procmail to filter messages (only with activated SPAM filter)

Method
Searching the mail (header and/or body) for 'suspicious' entries; triggering actions.
How it works
When the SPAM filter is activated, messages are sent through Procmail as described above. Then it is possible to define rules in the configuration file to handle the messages.
Configuration
The SPAM filter previously described must be activated. The configuration file can be found at /etc/imap/procmailrc
Please refer to the Procmail man page 'man procmailrc' for a complete description of all procmail features.
Advantages
It offers comprehensive filtering possibilities that cannot be achieved with the Postfix solutions described below.
Disadvantages
A wrong configuration will result in the loss of messages! Use this method only if you are well acquainted with the operation of Procmail!

Filtering the header

Method
Searching the mail header for 'suspicious' contents that identify the message as SPAM.
How it works
Postfix includes a feature that enables searching the header. The message is scanned for a specific expression when it is received via SMTP. This method exclusively searches the mail header.

Configuration

Create the file /etc/postfix/header_checks.
man 5 pcre_table). Example:

            In this file, define rules for use by Postfix. For this purpose, use Perl Compatible Regular Expressions (PCRE; for a description please refer to the manpage
                /^(To|From):*friend@(public.com|localhost.net)/ REJECT
                /^From:.*infowatch\.net/ REJECT
                /^To: ListMembers@theneffect/ REJECT

Edit /etc/postfix/main.cf and insert the following line:

                header_checks = pcre:/etc/postfix/header_checks

Reload the configuration:

                rcpostfix reload

Advantages
SPAM can often be identified from the header. This method enables you to filter out specific senders or subjects and reject a large portion of the undesired mail. All header lines can be used. For example, you can use the header of a SPAM message as template.
Disadvantages
You need to keep the list up to date. As soon as you receive a new SPAM you need to set up a suitable rule. Take care not to keep the rules too general, since this may cause even approved messages to be rejected, e.g. because the sender uses a subject that you blocked with a filter.

Filtering the mail body

Method
Searching the mail body for 'suspicious' expressions. The check can also be performed for the purpose of rejecting certain attachments.
How it works
Postfix includes a feature that enables searching the mail body when it is received via SMTP. This method exclusively searches the mail body.

Configuration

Create the file /etc/postfix/body_checks.
In this file, define rules for use by Postfix. For this purpose, use Perl Compatible Regular Expressions (PCRE; for a description please refer to the manpage man 5 pcre_table). Example:

                /^Hi! How are you/ REJECT
                /(usa\.net|hotmail\.com|yahoo\.com)\?subject=remove/ REJECT
                /(filename|name)=".*\.(asd|chm|exe|doc|dll|hlp|hta|js|ocx|pif)"/ REJECT

Edit /etc/postfix/main.cf and insert the following lines:

                body_checks = pcre:/etc/postfix/body_checks

Reload the configuration:

                rcpostfix reload

Advantages
Longer text passages can be filtered, thus avoiding approved messages from being rejected by mistake. Attachments, too, can be filtered. In the above example, the last rule causes messages accompanied by attachments with the respective extensions to be rejected.
Disadvantages
Here, too, there is the danger that you reject messages that are not SPAM. Furthermore, attachment filters can be circumvented by the sender by simply using other extensions that are not blocked by filters.

Blocking hosts or domains

Method
Selective blocking of hosts or domains that have previously sent SPAM.
How it works
Postfix includes a feature for keeping a list of hosts for which special arrangements can be made. In this case this means rejecting mail. Postfix checks the host names by means of DNS.

Configuration

Edit the file /etc/postfix/access and add rules as follows:

                #Blocking a domain, no host of this domain (including subdomains) is permitted to submit mail
                spammers.com REJECT
                #Blocking an individual IP address with error notification to the sender
                213.95.15.200 550 Keep your SPAM
                #Blocking an entire subnet (213.95.x.x)
                213.95 REJECT

Help is provided in the comments in the file or on the manpage man 5 access

Generate a db file:

                postmap /etc/postfix/access

Reload the configuration:

                rcpostfix reload

Advantages
The rejection or permission of mail from specific hosts or domains is easy to configure.
Disadvantages
The danger is that you block too many hosts. No mail can be delivered to you by way of a relay host in a blocked domain. Thus, instead of blocking the sender of the SPAM mail, you may block a mail server that is vital for your mail delivery.

Realtime Blackhole Lists (RBL)

Method
Blocking senders listed in a 'blacklist'. These blacklists require the ongoing maintenance of an up-to-date database where SPAM senders are listed.
How it works
Making use of the name service (reverse look-up), Postfix submits a query to a blacklist server in order to check whether the sender is listed. If the DNS check with the blacklist server is positive, the mail is rejected. Some blacklist server operators offer the possibility of setting up a slave zone on the local name server in order to speed up DNS queries (e.g. http://www.mail-abuse.org/).
Configuration
Edit /etc/postfix/main.cf and insert the following lines. Modify the rbl_domains to the server(s) you want to use. Before you do so, check which servers are available. Some servers are subject to registration and payment of a fee. The servers used in this example may not work!
```
                smtpd_helo_restrictions = reject_maps_rbl
                maps_rbl_domains = blackholes.mail-abuse.org, relays.osirusoft.com
                
```
Reload the configuration:
```
                rcpostfix reload
                
```
Advantages
Little to configure and effective. The lists are updated by the respective server operator.
Disadvantages
Increased network load, as an additional name server query needs to be issued for every SMTP connection. There are some reports about a non working mailing system in case eg. the nameservice is not working. Furthermore, there is the possibility that some senders have been wrongly included. The contents of the blacklist are beyond your reach.

Additional measures

There are several other ways how you can make things difficult for SPAM senders. For example, you can use so-called 'teergrubing', which keeps connections from suspected SPAM senders open for a long period, thus making the dispatch ineffective. However, this method does not provide any advantages apart from annoying the SPAM sender.

If you use a productive system, do not embark on any experiments. Make sure that your system is secure and can not be abused as a relay.

Keywords: OPENEXCHANGE SERVER, SLOX, SPAMASSASSIN, PROCMAIL, MAIL, POSTFIX, FILTER, CONTENT, HEADER, BODY, CHECK, ACCESS, UCE, RBL, SPAM

Categories: SuSE Linux IMAP Server

Feedback welcome: Send Mail to srsimai@suse.de (Please give the following subject: SDB-rsimai_slox_anti_spam)

SDB-rsimai_slox_anti_spam, Copyright SuSE Linux AG, Nürnberg, Germany - Version: 06. Dec 2002
SuSE Linux AG - Last generated: 06. Dec 2002 by ip (sdb_gen 1.40.0)