From owner-freebsd-questions@FreeBSD.ORG Fri Apr 27 21:44:47 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 6FAD116A401 for ; Fri, 27 Apr 2007 21:44:47 +0000 (UTC) (envelope-from chris@vindaloo.com) Received: from corellia.vindaloo.com (corellia.vindaloo.com [64.51.148.100]) by mx1.freebsd.org (Postfix) with ESMTP id 3EC8213C44C for ; Fri, 27 Apr 2007 21:44:47 +0000 (UTC) (envelope-from chris@vindaloo.com) Received: from [172.24.145.69] (endor.vindaloo.com [172.24.145.69]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by corellia.vindaloo.com (Postfix) with ESMTP id 6F0B15D09; Fri, 27 Apr 2007 17:44:46 -0400 (EDT) Message-ID: <46326ECD.8060604@vindaloo.com> Date: Fri, 27 Apr 2007 17:44:45 -0400 From: Christopher Hilton User-Agent: Thunderbird 1.5.0.10 (Macintosh/20070221) MIME-Version: 1.0 To: Ted Mittelstaedt References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: User Questions Subject: Re: Greylisting -- Was: Anti Spam X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Apr 2007 21:44:47 -0000 Ted Mittelstaedt wrote: [snip] >> When I scan my maillogs I find that 22% of the hosts that generate a >> greylisting entry retry the mail delivery and thus get whitelisted. The >> other 78% don't attempt redelivery within the greylisting window. > > That's probably par. > > However, the reason your putting so much faith in the delaying, is simply > that you aren't getting a lot of spam. > > I have published e-mail addresses. Without greylisting I got about > 1500-2000 mail messages a day to each of them. > > Greylisting isn't just about delaying. IIRC greylisting is filtering for spam/ham based on behaviour in the message originators MTA. My greylister is using two behavioural assumptions: Spamming MTA's don't have the capability to queue and retry mail. Asking them to queue and retry will cause them to drop the mail on the floor thus filtering spam. Spamming MTA's don't like to be tarpitted. Stuttering at them and sizing the TCP Windows so they must wait will result in them disconnecting before they can exchanged mail thus filtering spam. I may not receive as much spam as you but I do think that I receive "a lot of spam". For mail vindaloo.com is a small domain. I'm a mail reflector for a couple of .orgs and I have a handful of addresses for which I'm the endpoint. My greylister trapped 1907 connections from 1566 hosts on Tuesday. I assume that without my greylister this would have been 1566 delivered messages and nearly all of them would have been spam. In a nutshell here's my math: Tuesday's spam statistics: 1907 connections from 1566 hosts to the greylister. 1411 hosts hung up before getting to an SMTP RCPT TO. (rejected by Tarpitting) 121 hosts worked with pf-spamd and sent an SMTP RCPT TO generating a greylisting tuple. None of these hosts attempted redelivery. (rejected by delay/queue) 34 hosts worked with pf-spamd as above enough to generate a whitelist transaction. For roughly the next month these 34 hosts can deliver mail to me. Assuming that the each host wanted to send one message and that the one message was spam my greylister has achieved a rejection rate of 97.8% over 1566 messages. The real beauty of this is that it comes with little resource cost to me. Without Greylisting those 1566 messages would have to be scanned by Spam Assassin. I use SA's bayes filter. Last time I looked at it SA was averaging 2 ~ 4 seconds per message scanned. I'm not sure it would have to be done how well SA works when concurrently scanning messages but if I just do the simple math that's 1.3 hours of real time scanning messages for spam. Without greylisting I'd have to buy new hardware for my mailserver and that's just not worth it. -- Chris -- __o "All I was doing was trying to get home from work." _`\<,_ -Rosa Parks ___(*)/_(*)___________________________________________________________ Christopher Sean Hilton pgp key: D0957A2D/f5 30 0a e1 55 76 9b 1f 47 0b 07 e9 75 0e 14