Zero / Love

So this client runs an old server. This is not just any server, it is their main server. It has a MS SQL 6.5 database on it. We have been years telling them to upgrade and they refused. Finally they give us the go ahead and we are scheduled to do it on Friday. Well Wednesday two days before the upgrade they call and say the server is making a bad noise. I believe it is the hard drive.

Here are some stats from one day on a single spam server. There was a total of 45,963 emails. Of these only 11,585 where Ham or good emails. With a total of 34,378 Spam emails. Now remember we don't allow random email's, these where all for real users. I also received no false positives or emails that where marked spam that should not have been.

Now lets talk about what these spam messages contained.

8,443 of them have an adult subject, with 2573 talking about someone's penis
4,135 of them have a specific subjects
760 where about drugs
3863 where an We offer something type spams

But with all of these here are some better stats...

I started testing Justin Mason's auto generated rules. I update mine every morning. I have also re scored them all to 1.5 points from the 4.7 that they default to. This same day, it caught 11,139 of the spam messages.

While last time we talked about the mail hub, this time I'm going to talk about our Spam and Virus pass through server. This server also runs qmail but has no local mailboxes. With qmail we use smtp routes to deliver mail to clients that have their own mail server. This lets us be their front end to the internet and spam and virus scan. It is like a gateway spam and virus filter. Except it is on a larger scale. It will also allows all the clients with exchange servers to take their server down, and we will hold the mail for a time.

Incoming email is handled by magic mail smtpd. With this we are able to maintain a list of valid users and keep from just accepting email for any address. Once this is done it is handed off to qmail-scanner-queue.pl. This runs ClamAV and Spamassassin on the message. We quarantine virus and mark spam in the subject.

Why do we only mark spam? Well because all email must be delivered. While on the previous server we maintain the mailbox and can create a .Spam folder that is not downloaded via pop3 we can't do that with this server. All our servers are designed to fail open. To always give the client their email. With clients like law firms, financial institutes, and engineers we do not want to stop any email from getting to them.

Some clients are just to big to do this, or they have special circumstances and need a whole server by themselves. I also have several of these and I will in a later post go into detail as to what some of the custom setups.

I know your waiting on the configurations, and that is coming up. So hang in there.

So at work I maintain at the moment 4 Spam and Virus scanning servers. They run both ClamAV and SpamAssassin. Starting with our mail hub, i'm going to do a couple of post on what they do, what I use and why. If you have any questions feel free to email me or post a comment.

The first system is our mail hub, it runs Qmail and host mail for clients that check their E-Mail via Pop and or Imap. We use Vpopmail for this system so that we can host many domains. We have an base install of Qmail-Rocks but with some of our own changes. Currently the SMTP server is running Magic Mail but i'm wanting to switch over to John Simpsons Qmail Combined Patch Set. It does everything that Magic Mail does, but is still Qmail-Smtpd. I also like the SMTP Auth parts in his patch. This system is a hoss and does alot of work.

We do the scanning on this system at the very first part of the connection. Using valid user checking in Magic Mail we are able to drop many of the dictionary type attacks at the start. So what is a dictionary attack. Well this is when an spammer known from here on as a idiot tries to send an email to a domain using random letters, numbers, and words from a dictionary. This can also be taken care of with Jon Simpson's validrcpto patch. Once we do this we scan using a custom mailfilter. If the user wants spam and virus checking, and not everyone does. Yea I know that is weird but we have some travel agencies that sign up for every spam sight on the internet. We link a copy of our custom mailfilter into the domain or home directory and use it to do the scanning. First using another custom script, it uses clamav to scan the message and if it finds a virus it moves it to a virus quarantine. Then it hits spamassassin and runs against it. We only mark the subject with spam and then send it either to the users inbox or to a .Spam folder.

This server handles about 100,000 emails a day on a slow day. The sad part still is that %90 of it is spam or viruses.

Next time.. settings

Well I've gone and done it. I have registered a domain for my blog. It is now http://www.zerosource.org you can still reach it from the old http://zerosource.blogspot.com. I was registering a domain for my wife and GoDaddy gave me the option to get two for the price of one. I couldn't pass it up.

So this is Copper Leroy, he is a Beagle. We call him our special boy. He's special because a week after we got him he developed parvo and almost died. He spent a week in ICU at the Vet's. He loves Ice Cream! Oh and Laptop power cords...

Current projects I have going on. Well right now I have a Quad Core 64 box with 16 Gb ram I am testing running Xen on. So far the 4.0 release of Xen is where it is. We are going to be hosting Exchange on this box with about 500 users on different domains. We are going to use Exchange 2007 with the Dot.Net front end. We are in the final build out from final testing. The parts I'm really happy with is that instead of having the local disk or NFS (Network File System) we are using iscsi. This is being done using OpenFiler and a Dual Core 64 box with 2 Gb of ram and 1 Tb of disk. In our testing the Iscsi is 3 times faster then NFS and twice as fast as local disk. We are using a 1 Gb connection from the Xen machine and the OpenFiler machine. I have some other projects and as time permits I will post and give update on them. I've got a front end spam and virus project I'm working on as well as a hosted control panel for web hosting.

I'm not dead, I've just been real busy and have redone my home network. I will start posting stuff again.... and I have wrote the howto setup a music server, but then I broke it. More to come....

Ok so your developing software, and you have a great base to start with. Your going to add some GUI stuff to it. Your going to give users a way to control it without using several hundred command lines. This software will run on Linux, and it will be direct competition with a Microsoft Product. So you get together a team of programmers, and a support staff. You release a start product, and sell the hell out of it. Then it happens.

The next release you put out, is half finished. It has hundreds of bugs. Crashes randomly. Sometimes will not even load. Why? It makes no sense. Whats worse is you don't even tell people of the bugs till they find one or two themselves and contact you freaking out. Then you tell them...

Oh wait don't install that. Wait till Service Pack 1. Omg I can't believe you installed that.

It almost sounds like a Cheech & Chong movie Up In Smoke.

But I digress. Why could you not have waited to release it. Don't claim to be different. Then release the same garbage. At least if you do; have a support staff that knows what they are doing. Your only hurting yourself. I can always run the Microsoft Product. At least their support is dependable. Hell if nothing else I can step outside and find a MCSE somewhere, down at Jiffy Lube. Well thats what he said as he was putting oil in my car.

The Can Spam Act is not working. Most spammers either don't care, are not being tracked, there isn't enough people to go after them, or they are in another country. Either way it don't work. So here are some tips to help stop some of the spam in your Inbox.

First off, if you already have a email address that you use and it is being bombarded with spam. Sorry you should have read this first. You are going to need a filter, may I suggest V.Protect our filtering service. Now this will only work if you are the owner of your domain. If not you can setup your own email filtering solution using SpamAssassin.

Rules
1. Never ever use your real email address to sign up for anything. Do not trust the companies that say "We promise never to use or sell your address". If you give them your email address they can and some of them will sell it. Use a throw away service such as

• PookMail
• SpamHole
• MyTrashMail

I use PookMail most of the time, and the way it works. Instead of giving them your real email address you go to the PookMail Website and create a fake one in the form on the front page. Then hit the go button. Pookmail will work for 24 hours. Then the address is gone, just long enough for you to sign up and get anything you need. If you really needed anything in the first place.

If you use Gmail for your email. You can use it in a special way, in that you can assign a name to the email address you are using. For instance if I was to sign up for Hot Nerd Mailing List. I could use mygmail+hotnerd@Gmail.com then anything sent to my Gmail from Hot Nerd would be to mygmail+hotnerd@Gmail.com. I can use the Gmail filter to then filter anything sent to mygmail+hotnerd@Gmail.com. Pretty kewl huh!

2. Never ever under any circumstance use a mailto: link on your website. There are scripts and codes out there to hide your email address. Such as The Encoder form by Automatic. You can also use the same as above in 1 if you use gmail by giving it a distinctive name.

Another option is to generate an graphic image with your email on it, there are places on the internet for that too. Try Liquism or the Free E-Mail Signature Generator. These will both generate an image that you can place on your website. Neither of these options are fool proof. What we are stopping here is the bots that are hunting the web to get an email address.

3. Do NOT reply to any email that is Spam. Alot of spammers will try to guess at user names. They will even start at a, aa, aaa, aaaa, etc... to find a valid user. They will send email to every name possible hoping one is a real person. How do they know you are real? When you reply back to them and ask them to stop. They don't get that email and go, well they asked so I'm done. NO. They take it and they add it to their list. So if you get a spam email, delete it or feed it to your filter. Do not reply to it.


I will continue to add ways to avoid spam. This is a never ending battle. If you have a way that is not listed here let me know and I will add it.

Being I work at an Internet Service Provider that handles business only, I have to deal with alot of CIO/CEO types. The one thing that is a common problem with spam is it changes.

We use a mixture of custom rules, some custom pluggins, etc.. but mainly we use SpamAssassin. While the SARE Ninja's keep the best list of rules for spamassassin. The spammers are constantly changing. Till we figure out a way to not use "Signature" based rules, and find a way to know spam before it is sent we are always going to be behind.

One month the CEO of company X gets 1 Spam in his inbox, the next month he gets 4. All of the sudden he/she is thinking the world is coming to an end. The spammers have won. Then we tweak a rule, and then we do not hear from this CEO again. That is till the spammers change, again. Then it starts all over. So Mr/Mrs CEO remember it is a long waged fight. Not something that is going to be stopped for ever, just till they get repositioned for the next strike.