688
edits
Changes
From SME Server
Jump to navigationJump to searchCreated page with "<span id="_top">Qpsmtpd#Plugins</span> = NAME = karma - reward nice and penalize naughty mail senders = SYNOPSIS = Karma tracks sender history, ..."
<span id="_top">[[Qpsmtpd#Plugins]]</span>
= [[#___top|NAME]] =
karma - reward nice and penalize naughty mail senders
= [[#___top|SYNOPSIS]] =
Karma tracks sender history, allowing us to provide differing levels of service to naughty, nice, and unknown senders.
= [[#___top|DESCRIPTION]] =
Karma records the number of nice, naughty, and total connections from mail senders. After sending a naughty message, if a sender has more naughty than nice connections, they are penalized for ''penalty_days''. Connections from senders in the penalty box are rejected per the settings in ''reject''.
Karma provides other plugins with a karma value they can use to be more lenient, strict, or skip processing entirely.
Karma is small, fast, and ruthlessly efficient. Karma can be used to craft custom connection policies such as these two examples:
<blockquote>Hi there, well known and well behaved sender. Please help yourself to greater concurrency (hosts_allow), multiple recipients (karma), and no delays (early_sender).
Hi there, naughty sender. You get a max concurrency of 1, max recipients of 2, and SMTP delays.
</blockquote>
= [[#___top|CONFIG]] =
== [[#___top|negative <integer>]] ==
How negative a senders karma can get before we penalize them for sending a naughty message. Karma is the number of nice - naughty connections.
Default: 1
Examples:
<pre> negative 1: 0 nice - 1 naughty = karma -1, penalize
negative 1: 1 nice - 1 naughty = karma 0, okay
negative 2: 1 nice - 2 naughty = karma -1, okay
negative 2: 1 nice - 3 naughty = karma -2, penalize</pre>
With the default negative limit of one, there's a very small chance you could penalize a "mostly good" sender. Raising it to 2 reduces that possibility to improbable.
== [[#___top|strikes <integer>]] ==
How many strikes is needed to consider the mail nice or naughty. Various plugins can adjust the karma (see USING KARMA IN OTHER PLUGINS). For example, with the default value of 3, if the karma of this message is 3 or above, the mail is considered to be a nice one. If it's -3 or less, it's considered a naughty one. Between -2 and +2 it's neutral
Default: 3
== [[#___top|penalty_days <days>]] ==
The number of days a naughty sender is refused connections. Use a decimal value to penalize for portions of days.
<pre> karma penalty_days 1</pre>
Default: 1
== [[#___top|reject]] ==
<pre> karma reject [ 0 | 1 | connect | naughty ]</pre>
''0'' will not reject any connections.
''1'' will reject naughty senders.
''connect'' is the most efficient setting.
To reject at any other connection hook, use the ''naughty'' setting and the '''naughty''' plugin.
== [[#___top|db_dir <path>]] ==
Path to a directory in which the DB will be stored. This directory must be writable by the qpsmtpd user. If unset, the first usable directory from the following list will be used:
/var/lib/qpsmtpd/karma
''BINDIR''/var/db (where BINDIR is the location of the qpsmtpd binary)
''BINDIR''/config
== [[#___top|loglevel]] ==
Adjust the quantity of logging for this plugin. See docs/logging.pod
= [[#___top|CONFIG FILES]] =
This plugin uses the following configuration files. All are optional.
== [[#___top|karma_tlds]] ==
This file can contain semicolon separated tld and the corresponding karma adjustment to apply when the envelope sender match. It can be used to penalize "spammy" tlds, or to raise the karma from (mostly) good tlds.
jp:-4 ch:-3 fr:+1
= [[#___top|BENEFITS]] =
Karma reduces the resources wasted by naughty mailers. When used with ''reject connect'', naughty senders are disconnected in about 0.1 seconds.
The biggest gains to be had are by having heavy plugins (spamassassin, dspam, virus filters) set the '''karma''' connection note (see KARMA) when they encounter naughty senders. Reasons to send servers to the penalty box could include sending a virus, early talking, or sending messages with a very high spam score.
This plugin does not penalize connections with transaction notes ''relayclient'' or ''whitelisthost'' set. These notes would have been set by the '''relay''', '''whitelist''', and '''dns_whitelist_soft''' plugins. Obviously, those plugins must run before '''karma''' for that to work.
= [[#___top|KARMA]] =
No attempt is made by this plugin to determine karma. It is up to other plugins to reward well behaved senders with positive karma and smite poorly behaved senders with negative karma. See '''USING KARMA IN OTHER PLUGINS'''
After the connection ends, '''karma''' will record the result. Mail servers whose naughty connections exceed nice ones are sent to the penalty box. Servers in the penalty box will be tersely disconnected for ''penalty_days''. Here is an example connection from an IP in the penalty box:
<pre> 73122 Connection from smtp.midsetmediacorp.com [64.185.226.65]
73122 (connect) ident::geoip: US, United States
73122 (connect) ident::p0f: Windows 7 or 8
73122 (connect) earlytalker: pass: 64.185.226.65 said nothing spontaneous
73122 (connect) relay: skip: no match
73122 (connect) karma: fail
73122 550 You were naughty. You are cannot connect for 0.99 more days.
73122 click, disconnecting
73122 (post-connection) connection_time: 1.048 s.</pre>
If we only set negative karma, we will almost certainly penalize servers we want to receive mail from. For example, a Yahoo user sends an egregious spam to a user on our server. Now nobody on our server can receive email from that Yahoo server for ''penalty_days''. This should happen approximately 0% of the time if we are careful to also set positive karma.
= [[#___top|KARMA HISTORY]] =
Karma maintains a history for each IP. When a senders history has decreased below -5 and they have never sent a good message, they get a karma bonus. The bonus tacks on an extra day of blocking for every naughty message they send.
Example: an unknown sender delivers a spam. They get a one day penalty_box. After 5 days, 5 spams, 5 penalties, and 0 nice messages, they get a six day penalty. The next offense gets a 7 day penalty, and so on.
= [[#___top|USING KARMA]] =
To get rid of naughty connections as fast as possible, run karma before other connection plugins. Plugins that trigger DNS lookups or impose time delays should run after '''karma'''. In this example, karma runs before all but the ident plugins.
<pre> 89011 Connection from Unknown [69.61.27.204]
89011 (connect) ident::geoip: US, United States
89011 (connect) ident::p0f: Linux 3.x
89011 (connect) karma: fail, 1 naughty, 0 nice, 1 connects
89011 550 You were naughty. You are penalized for 0.99 more days.
89011 click, disconnecting
89011 (post-connection) connection_time: 0.118 s.
88798 cleaning up after 89011</pre>
Unlike RBLs, '''karma''' only penalizes IPs that have sent us spam, and only when those senders have sent us more spam than ham.
= [[#___top|USING KARMA IN OTHER PLUGINS]] =
This plugin sets the connection note ''karma_history''. Your plugin can use the senders karma to be more gracious or rude to senders. The value of ''karma_history'' is the number of nice connections minus naughty ones. The higher the number, the better you should treat the sender.
To alter a connections karma based on its behavior, do this:
<pre> $self->adjust_karma( -1 ); # lower karma (naughty)
$self->adjust_karma( 1 ); # raise karma (good)</pre>
= [[#___top|EFFECTIVENESS]] =
In the first 24 hours, '''karma''' rejected 8% of all connections. After one week of running with ''penalty_days 1'', karma has rejected 15% of all connections.
This plugins effectiveness results from the propensity of naughty senders to be repeat offenders. Limiting them to a single offense per day(s) greatly reduces the resources they can waste.
Of the connections that had previously passed all other checks and were caught only by spamassassin and/or dspam, '''karma''' rejected 31 percent. Since spamassassin and dspam consume more resources than others plugins, this plugin seems to be a very big win.
= [[#___top|DATABASE]] =
Connection summaries are stored in a database. The database key is the integer value of the remote IP. The DB value is a : delimited list containing a penalty box start time (if the server is/was on timeout) and the count of naughty, nice, and total connections. The database can be listed and searched with the karma_tool script.
= [[#___top|BUGS & LIMITATIONS]] =
This plugin is reactionary. Like the FBI, it doesn't do anything until after a crime has been committed.
There is little to be gained by listing servers that are already on DNS blacklists, send to invalid users, earlytalkers, etc. Those already have very lightweight tests.
= [[#___top|TODO]] =
<pre> * Avoid storing results for DNSBL listed IPs
* some type of ASN integration, for tracking karma of 'neighborhoods'</pre>
= [[#___top|AUTHOR]] =
<pre> 2013 - MS - Addeded penalty for spammy TLDs
2012 - Matt Simerson - msimerson@cpan.org</pre>
= [[#___top|ACKNOWLEDGEMENTS]] =
Gavin Carr's DB implementation in the greylisting plugin.
<!-- Generated Sun Jul 30 08:27:36 EDT 2017 using
perldoc -T -ohtml /usr/share/qpsmtpd/plugins/karma |pandoc -f html -t mediawiki |sed 1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span> |sed -e s#</d.>##
-->
----
[[Category:Qpsmtpd|karma]]
= [[#___top|NAME]] =
karma - reward nice and penalize naughty mail senders
= [[#___top|SYNOPSIS]] =
Karma tracks sender history, allowing us to provide differing levels of service to naughty, nice, and unknown senders.
= [[#___top|DESCRIPTION]] =
Karma records the number of nice, naughty, and total connections from mail senders. After sending a naughty message, if a sender has more naughty than nice connections, they are penalized for ''penalty_days''. Connections from senders in the penalty box are rejected per the settings in ''reject''.
Karma provides other plugins with a karma value they can use to be more lenient, strict, or skip processing entirely.
Karma is small, fast, and ruthlessly efficient. Karma can be used to craft custom connection policies such as these two examples:
<blockquote>Hi there, well known and well behaved sender. Please help yourself to greater concurrency (hosts_allow), multiple recipients (karma), and no delays (early_sender).
Hi there, naughty sender. You get a max concurrency of 1, max recipients of 2, and SMTP delays.
</blockquote>
= [[#___top|CONFIG]] =
== [[#___top|negative <integer>]] ==
How negative a senders karma can get before we penalize them for sending a naughty message. Karma is the number of nice - naughty connections.
Default: 1
Examples:
<pre> negative 1: 0 nice - 1 naughty = karma -1, penalize
negative 1: 1 nice - 1 naughty = karma 0, okay
negative 2: 1 nice - 2 naughty = karma -1, okay
negative 2: 1 nice - 3 naughty = karma -2, penalize</pre>
With the default negative limit of one, there's a very small chance you could penalize a "mostly good" sender. Raising it to 2 reduces that possibility to improbable.
== [[#___top|strikes <integer>]] ==
How many strikes is needed to consider the mail nice or naughty. Various plugins can adjust the karma (see USING KARMA IN OTHER PLUGINS). For example, with the default value of 3, if the karma of this message is 3 or above, the mail is considered to be a nice one. If it's -3 or less, it's considered a naughty one. Between -2 and +2 it's neutral
Default: 3
== [[#___top|penalty_days <days>]] ==
The number of days a naughty sender is refused connections. Use a decimal value to penalize for portions of days.
<pre> karma penalty_days 1</pre>
Default: 1
== [[#___top|reject]] ==
<pre> karma reject [ 0 | 1 | connect | naughty ]</pre>
''0'' will not reject any connections.
''1'' will reject naughty senders.
''connect'' is the most efficient setting.
To reject at any other connection hook, use the ''naughty'' setting and the '''naughty''' plugin.
== [[#___top|db_dir <path>]] ==
Path to a directory in which the DB will be stored. This directory must be writable by the qpsmtpd user. If unset, the first usable directory from the following list will be used:
/var/lib/qpsmtpd/karma
''BINDIR''/var/db (where BINDIR is the location of the qpsmtpd binary)
''BINDIR''/config
== [[#___top|loglevel]] ==
Adjust the quantity of logging for this plugin. See docs/logging.pod
= [[#___top|CONFIG FILES]] =
This plugin uses the following configuration files. All are optional.
== [[#___top|karma_tlds]] ==
This file can contain semicolon separated tld and the corresponding karma adjustment to apply when the envelope sender match. It can be used to penalize "spammy" tlds, or to raise the karma from (mostly) good tlds.
jp:-4 ch:-3 fr:+1
= [[#___top|BENEFITS]] =
Karma reduces the resources wasted by naughty mailers. When used with ''reject connect'', naughty senders are disconnected in about 0.1 seconds.
The biggest gains to be had are by having heavy plugins (spamassassin, dspam, virus filters) set the '''karma''' connection note (see KARMA) when they encounter naughty senders. Reasons to send servers to the penalty box could include sending a virus, early talking, or sending messages with a very high spam score.
This plugin does not penalize connections with transaction notes ''relayclient'' or ''whitelisthost'' set. These notes would have been set by the '''relay''', '''whitelist''', and '''dns_whitelist_soft''' plugins. Obviously, those plugins must run before '''karma''' for that to work.
= [[#___top|KARMA]] =
No attempt is made by this plugin to determine karma. It is up to other plugins to reward well behaved senders with positive karma and smite poorly behaved senders with negative karma. See '''USING KARMA IN OTHER PLUGINS'''
After the connection ends, '''karma''' will record the result. Mail servers whose naughty connections exceed nice ones are sent to the penalty box. Servers in the penalty box will be tersely disconnected for ''penalty_days''. Here is an example connection from an IP in the penalty box:
<pre> 73122 Connection from smtp.midsetmediacorp.com [64.185.226.65]
73122 (connect) ident::geoip: US, United States
73122 (connect) ident::p0f: Windows 7 or 8
73122 (connect) earlytalker: pass: 64.185.226.65 said nothing spontaneous
73122 (connect) relay: skip: no match
73122 (connect) karma: fail
73122 550 You were naughty. You are cannot connect for 0.99 more days.
73122 click, disconnecting
73122 (post-connection) connection_time: 1.048 s.</pre>
If we only set negative karma, we will almost certainly penalize servers we want to receive mail from. For example, a Yahoo user sends an egregious spam to a user on our server. Now nobody on our server can receive email from that Yahoo server for ''penalty_days''. This should happen approximately 0% of the time if we are careful to also set positive karma.
= [[#___top|KARMA HISTORY]] =
Karma maintains a history for each IP. When a senders history has decreased below -5 and they have never sent a good message, they get a karma bonus. The bonus tacks on an extra day of blocking for every naughty message they send.
Example: an unknown sender delivers a spam. They get a one day penalty_box. After 5 days, 5 spams, 5 penalties, and 0 nice messages, they get a six day penalty. The next offense gets a 7 day penalty, and so on.
= [[#___top|USING KARMA]] =
To get rid of naughty connections as fast as possible, run karma before other connection plugins. Plugins that trigger DNS lookups or impose time delays should run after '''karma'''. In this example, karma runs before all but the ident plugins.
<pre> 89011 Connection from Unknown [69.61.27.204]
89011 (connect) ident::geoip: US, United States
89011 (connect) ident::p0f: Linux 3.x
89011 (connect) karma: fail, 1 naughty, 0 nice, 1 connects
89011 550 You were naughty. You are penalized for 0.99 more days.
89011 click, disconnecting
89011 (post-connection) connection_time: 0.118 s.
88798 cleaning up after 89011</pre>
Unlike RBLs, '''karma''' only penalizes IPs that have sent us spam, and only when those senders have sent us more spam than ham.
= [[#___top|USING KARMA IN OTHER PLUGINS]] =
This plugin sets the connection note ''karma_history''. Your plugin can use the senders karma to be more gracious or rude to senders. The value of ''karma_history'' is the number of nice connections minus naughty ones. The higher the number, the better you should treat the sender.
To alter a connections karma based on its behavior, do this:
<pre> $self->adjust_karma( -1 ); # lower karma (naughty)
$self->adjust_karma( 1 ); # raise karma (good)</pre>
= [[#___top|EFFECTIVENESS]] =
In the first 24 hours, '''karma''' rejected 8% of all connections. After one week of running with ''penalty_days 1'', karma has rejected 15% of all connections.
This plugins effectiveness results from the propensity of naughty senders to be repeat offenders. Limiting them to a single offense per day(s) greatly reduces the resources they can waste.
Of the connections that had previously passed all other checks and were caught only by spamassassin and/or dspam, '''karma''' rejected 31 percent. Since spamassassin and dspam consume more resources than others plugins, this plugin seems to be a very big win.
= [[#___top|DATABASE]] =
Connection summaries are stored in a database. The database key is the integer value of the remote IP. The DB value is a : delimited list containing a penalty box start time (if the server is/was on timeout) and the count of naughty, nice, and total connections. The database can be listed and searched with the karma_tool script.
= [[#___top|BUGS & LIMITATIONS]] =
This plugin is reactionary. Like the FBI, it doesn't do anything until after a crime has been committed.
There is little to be gained by listing servers that are already on DNS blacklists, send to invalid users, earlytalkers, etc. Those already have very lightweight tests.
= [[#___top|TODO]] =
<pre> * Avoid storing results for DNSBL listed IPs
* some type of ASN integration, for tracking karma of 'neighborhoods'</pre>
= [[#___top|AUTHOR]] =
<pre> 2013 - MS - Addeded penalty for spammy TLDs
2012 - Matt Simerson - msimerson@cpan.org</pre>
= [[#___top|ACKNOWLEDGEMENTS]] =
Gavin Carr's DB implementation in the greylisting plugin.
<!-- Generated Sun Jul 30 08:27:36 EDT 2017 using
perldoc -T -ohtml /usr/share/qpsmtpd/plugins/karma |pandoc -f html -t mediawiki |sed 1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span> |sed -e s#</d.>##
-->
----
[[Category:Qpsmtpd|karma]]
