Linux.com

Finally, we deal with /etc/spamd.conf. If this file is not correct, spamd will complain in various ways -- it may not start, or it might ignore some or all of your configuration. One strong caution: you cannot use tab characters as whitespace in this file; you must use spaces. I tore my hair out trying to figure out why my /etc/spamd.conf wasn't working as I expected. I replaced the tab characters with spaces, and everything started working correctly.

Here is my entire /etc/spamd.conf file:

all:\
        :spews1:spews2:spamhausdroplist:china:korea:russia:mycustom-black:

# Mirrored from http://www.spews.org/spews_list_level1.txt
spews1:\
        :black:\
        :msg="SPAM. Your address %A is in the spews level 1 database\n\
        See http://www.spews.org/ask.cgi?x=%A for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/spews_list_level1.txt.gz:

# Mirrored from http://www.spews.org/spews_list_level2.txt
spews2:\
        :black:\
        :msg="SPAM. Your address %A is in the spews level 2 database\n\
        See http://www.spews.org/ask.cgi?x=%A for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/spews_list_level2.txt.gz:

spamhausdroplist:\
        :black:\
        :msg="SPAM. Your address %A is in the Spamhaus drop list\n\
        See http://www.spamhaus.org for more details":\
        :method=file:\
        :file=/etc/spamhaus.droplist.20071227.txt:

# Mirrored from http://www.okean.com/chinacidr.txt
china:\
        :black:\
        :msg="SPAM. Your address %A appears to be from China\n\
        See http://www.okean.com/asianspamblocks.html for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/chinacidr.txt.gz:

# Mirrored from http://www.okean.com/koreacidr.txt
korea:\
        :black:\
        :msg="SPAM. Your address %A appears to be from Korea\n\
        See http://www.okean.com/asianspamblocks.html for more details":\
        :method=http:\
        :file=www.openbsd.org/spamd/koreacidr.txt.gz:

# Mirrored from http://www.completewhois.com/statistics/data/ips-bycountry/rirstats/RU-cidr.txt
russia:\
        :black:\
        :msg="SPAM. Your address %A appears to be a source of spam email\n\
        Please contact your ISP regarding this issue":\
        :method=http:\
        :file=www.completewhois.com/statistics/data/ips-bycountry/rirstats/RU-cidr.txt:

# My custom blacklist
mycustom-black:\
        :black:\
        :msg="SPAM. Your address %A is in my spammers list. Please stop.":\
        :method=file:\
        :file=/etc/blacklist.txt:

End /etc/spamd.conf

Every address in here gets populated into the <spamd> PF table and thus gets automatically and immediately tarpitted the instant that it connects.

And now, the moment of truth: we are ready to turn on spamd. To do so, run /usr/libexec/spamd-setup now; whenever you make any changes to /etc/spamd.conf, you must run it again for the changes to take effect. spamd-setup does two things:

1. It tells PF what to do by loading every IP address or netblock referenced in any of the files mentioned in /etc/spamd.conf into the <spamd> table defined in /etc/pf.conf. Remember that we have a PF rule saying that if an address is in the <spamd> table, redirect it to spamd on TCP 8025 on localhost.
2. It tells spamd itself that, in the /etc/spamd.conf file, every IP address or netblock in the following lists is to be treated in blacklist mode once PF forwards that address's SMTP traffic to spamd's tarpit:
   • www.openbsd.org/spamd/spews_list_level1.txt.gz
   • /etc/spamhaus.droplist.20071227.txt
   • www.openbsd.org/spamd/chinacidr.txt.gz
   • www.openbsd.org/spamd/koreacidr.txt.gz
   • www.completewhois.com/statistics/data/ips-bycountry/rirstats/RU-cidr.txt
   • /etc/blacklist.txt

Since there are regular updates to the SPEWS Level 1 and Level 2 lists, you should fire off a cron job once a day that runs spamd-setup to download new files and put them into the <spamd> table for you.

Note that I added three sections to my spamd.conf file in order to tarpit and reject even more spammers than the default configuration does. I patterned these new spamhausdroplist, russia, and mycustom-black sections on existing ones in /etc/spamd.conf. You can also include the worst offenders from completewhois.com, which contains all the netblocks in the world, listed by country.

How well does it work?

Spamd has exceeded my expectations. The spam count in my mailbox has gone down to less than 2% of the amount I was receiving before I began running the utility. I've seen a total of only 10 spam messages over the last 10 days; that's a drop from more than 150 per day. Most days my inbox sees no spam whatsoever. My real mail server (mailhost), which does not run anything like SpamAssassin, is cruising along beautifully, and I continue to get all legitimate email.

Spamd's greytrapping is phenomenal and a significant part of why I get that huge reduction. My spamd logs show large numbers of folks attempting to spam my single fake email address, and all of them get tarpitted and rejected.

Copyright (c) 2007 C. Terrell Prudé, Jr.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.

Share    Print    Comments