Date: Sat, 14 Jul 2001 13:40:33 -0700 From: "Ted Mittelstaedt" <tedm@toybox.placo.com> To: "Brennan Stehling" <brennan@offwhite.net>, <freebsd-questions@FreeBSD.ORG> Subject: RE: outgoing spam detection Message-ID: <003801c10ca5$3ad72540$1401a8c0@tedm.placo.com> In-Reply-To: <20010714102047.K33522-100000@home.offwhite.net>
next in thread | previous in thread | raw e-mail | index | archive | help
One thing that is very characteristic of a spam run through a mailserver is lots and lots of failed deliveries to bogus addresses. Spammers aren't real particular about what they send to as long as it looks like an e-mail address. Generally, if you watch your mail queue and see a sudden and giant jump of spooled messages that's a good indication of a mailing problem like a spam run. You could even write a cron job that ran the mailq command once an hour and notify you if you had more than, say 100 queued messages. You might also consider that the thrust of anything you do to detect misuse from your own users should be detection, not prevention. You don't want a spammer on your network even if they are using someone else's mailserver on the Internet. If you lock down your own server then it just encourages the abusers to find someone else's server on the Internet to blow crud through. Better to make it easy as possible for your own users to spam through your own mailserver, in conjunction with close inspection of what your mailserver is doing, it will be much more effective at identifying the troublemakers so you can throw them off the server (or prosecute). The last thing you want is to push them underground it just makes it harder to root them out. After all, we aren't talking about real intelligent people here. :-) Ted Mittelstaedt tedm@toybox.placo.com Author of: The FreeBSD Corporate Networker's Guide Book website: http://www.freebsd-corp-net-guide.com >-----Original Message----- >From: owner-freebsd-questions@FreeBSD.ORG >[mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Brennan >Stehling >Sent: Saturday, July 14, 2001 8:27 AM >To: freebsd-questions@FreeBSD.ORG >Subject: outgoing spam detection > > >Is there an existing way to detect outgoing spam from a server? > >I run a FreeBSD server with qpopper and sendmail and would like to detect >if people are sending out large amounts of mail that could be considered >spam. I think it would also be useful to block this behavior >automatically by limiting a user to only 20 to 100 messages a day, or >maybe 3 a minute. This way I can be sure my server is not being misused >by my own users. It may also be useful to have a user by user quota so I >can adjust the bar for each user. > >I just updated my RBL lists for Sendmail... > >http://www.ordb.org/faq/#sendmail > >...and I would like to take it this extra step. Perhaps if there is no >system to do what I am asking, I could put something together to make this >happen. > >Brennan Stehling - software developer and system administrator > my projects: > home.offwhite.net (free personal hosting) > www.greasydaemon.com (bsd search) > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?003801c10ca5$3ad72540$1401a8c0>