Saturday, May 10, 2008

Stop the Backscatter, er Joe Jobs!

Vbounce is the weapon!

What ever you are going to call it as some call it backscatter and some call it Joe Jobs, well it is annoying. People where complaining, it was an direct attack of this junk. No fear tho, I have added to my Ninja weapons. This time, I have activated.... vbounce. It was really that easy since it comes with Spamassassin 3.2.x and you are using that version right? Well you should be.

Configure

/etc/mail/spamassassin/v320.pre

Change:

# VBounce - anti-bounce-message rules, see rules/20_vbounce.cf
#
#loadplugin Mail::SpamAssassin::Plugin::VBounce

to

# VBounce - anti-bounce-message rules, see rules/20_vbounce.cf
#
loadplugin Mail::SpamAssassin::Plugin::VBounce

and then turn on if you have not shortcircuit see Justin Mason's entry at the Spamassassin Wiki here.

Then in /etc/mail/spamassassin/local.cf add
whitelist_bounce_relays myrelay.myhost.net you should add every server that sends email on your behalf. You must enable this or none of this will work correctly. Now also in /etc/mail/spamassassin/local.cf add score BOUNCE_MESSAGE 5.0.

What it does

So now when backscatter comes in, we are going to check and see if it came from one of our servers. If it does then we are going to mark it with vbounce and send it on in. Now if it is not from one of our servers it is going to hit BOUNCE_MESSAGE and get marked spam. I have enabled this on all my servers and have not yet got another complaint. This is one of those tools I think are going to be very important.