Changes

From SME Server
Jump to navigationJump to search

Greylisting (view source)

Revision as of 13:53, 17 July 2017

6,477 bytes added ,  13:53, 17 July 2017
Add perldoc output to existing page
Line 50: Line 50:  
  signal-event email-update
 
  signal-event email-update
    +
= PERLDOC =
       +
 +
<span id="_top">[[Qpsmtpd#Plugins]]</span>
 +
== [[#___top|NAME]] ==
 +
 +
greylisting - delay mail from unknown senders
 +
 +
== [[#___top|DESCRIPTION]] ==
 +
 +
Plugin implementing the 'greylisting' algorithm proposed by Evan Harris in http://projects.puremagic.com/greylisting/ and defined in RFC 6647: http://tools.ietf.org/html/rfc6647
 +
 +
Greylisting is a form of denysoft filter, where unrecognised new connections are temporarily denied for some initial period, to foil spammers using fire-and-forget spamware, http_proxies, etc.
 +
 +
Greylisting tracks incoming connections using a triplet (see TRIPLET). It has configurable timeout periods (black/grey/white) to control whether connections are allowed, instead of using connection counts or rates.
 +
 +
Automatic whitelisting is enabled for relayclients, whitelisted hosts, whitelisted senders, TLS connections, p0f matches, and geoip matches.
 +
 +
== [[#___top|TRIPLETS]] ==
 +
 +
In greylisting, ''remote_ip'', ''sender'', and ''recipient'' are referred to as the triplet that connections are deferred based on. This plugin allows tracking on any or all of the three, using only the IP address by default. A simple dbm database is used for tracking connections.
 +
 +
How that works is best explained by example:
 +
 +
A new connection arrives from the host shvj1.jpmchase.com. The sender is chase@alerts.chase.com and the recipient is londonwhale@example.com. This is the first connection for that triplet so the connection is deferred for ''black_timeout'' minutes. After the timeout elapses, shvj1.jpmchase.com retries and successfully delivers the mail. For the next ''white_timeout'' days, emails for that triplet are not delayed.
 +
 +
The next day, shvj1.jpmchase.com tries to deliver a new email from alerts@alerts.chase.com to jdimon@example.com. Since this triplet is new, it will be delayed as our initial connection in the last scenario was. This delay could end up costing over US $4B.
 +
 +
By default, this plugin does not enable the sender or recipient in the triplet. Once an email from a remote server has been delivered to anyone on our server, that remote server is whitelisted for any sender and any recipient. This is a policy that delays less mail and is less likely to impoverish your bank.
 +
 +
== [[#___top|CONFIG]] ==
 +
 +
The following parameters can be passed to greylisting:
 +
 +
==== [[#___top|remote_ip &lt;bool&gt;]] ===
 +
 +
Include the remote ip in the connection triplet? Default: 1
 +
 +
==== [[#___top|sender &lt;bool&gt;]] ===
 +
 +
Include the sender in the connection triplet? Default: 0.
 +
 +
==== [[#___top|recipient &lt;bool&gt;]] ===
 +
 +
Include the recipient in the connection triplet? Default: 0.
 +
 +
==== [[#___top|deny_late &lt;bool&gt;]] ===
 +
 +
Whether to defer denials during the 'mail' hook or later during 'data_post' e.g. to allow per-recipient logging. Default: 0.
 +
 +
==== [[#___top|black_timeout &lt;timeout_seconds&gt;]] ===
 +
 +
The initial period during which we issue DENYSOFTs for connections from an unknown (or timed out) 'connection triplet'. Default: 50 minutes.
 +
 +
==== [[#___top|white_timeout &lt;timeout_seconds&gt;]] ===
 +
 +
The period after which a known connection triplet will be considered stale, and we will issue DENYSOFTs again. New deliveries reset the timestamp on the address and renew this timeout. Default: 36 days.
 +
 +
==== [[#___top|reject &lt;bool&gt;]] ===
 +
 +
Whether to issue deferrals (DENYSOFT) for black connections. Having reject disabled is useful for seeding the database and testing without impacting deliveries. It is recommended to begin with ''reject 0'' for a week or two before enabling ''reject''.
 +
 +
Default: 1
 +
 +
==== [[#___top|db_dir &lt;path&gt;]] ===
 +
 +
Path to a directory in which the greylisting DB will be stored. This directory must be writable by the qpsmtpd user. By default, the first usable directory from the following list will be used:
 +
 +
/var/lib/qpsmtpd/greylisting
 +
 +
''BINDIR''/var/db (where BINDIR is the location of the qpsmtpd binary)
 +
 +
''BINDIR''/config
 +
 +
==== [[#___top|redis &lt;host[:port]&gt;]] ===
 +
 +
Location of redis server where the greylisting DB will be stored.
 +
 +
Redis can be used as a scalable and clusterable alternative to a simple DBM file. For more information, see http://redis.io
 +
 +
When Redis is in use, this plugin will wait up to 1 second to connect; when Redis is unavailable, clients will not be greylisted.
 +
 +
==== [[#___top|per_recipient &lt;bool&gt;]] ===
 +
 +
Flag to indicate whether to use per-recipient configs.
 +
 +
==== [[#___top|nfslock &lt;bool&gt;]] ===
 +
 +
Flag to indicate the database is stored on NFS. Uses File::NFSLock instead of flock.
 +
 +
==== [[#___top|p0f]] ===
 +
 +
Enable greylisting only when certain p0f criteria is met. The required argument is a comma delimited list of key/value pairs. The keys are the following p0f TCP fingerprint elements: genre, detail, uptime, link, and distance.
 +
 +
To greylist emails from computers whose remote OS is windows:
 +
 +
<pre>  greylisting p0f genre,windows</pre>
 +
To greylist only windows computers on DSL links more than 3 network hops away:
 +
 +
<pre>  greylisting p0f genre,windows,link,dsl,distance,3</pre>
 +
==== [[#___top|geoip]] ===
 +
 +
Do not greylist connections that are in the comma separated list of countries.
 +
 +
<pre>  greylisting geoip US,UK</pre>
 +
Prior to adding GeoIP support, I greylisted all connections from windows computers. That deters the vast majority of spam connections, but it also delays legit mail from @msn, @live.com, and a small handful of other servers. Since adding geoip support, I haven't seen a single valid mail delivery delayed.
 +
 +
==== [[#___top|loglevel]] ===
 +
 +
Adjust the quantity of logging for this plugin. See docs/logging.pod
 +
 +
== [[#___top|CHANGES]] ==
 +
 +
The per_recipient_db configuration option has been removed. It relied on a note that was not set anywhere in upstream QP. The latest version of this plugin that supported this configuration option can be found here:
 +
 +
https://github.com/smtpd/qpsmtpd/blob/ea2f1e89dd6b72f1c06191425e2bd8d98bea2ac6/plugins/greylisting
 +
 +
== [[#___top|AUTHOR]] ==
 +
 +
Written by Gavin Carr &lt;gavin@openfusion.com.au&gt;.
 +
 +
2007-01-22 - nfslock feature by JT Moree &lt;jtmoree@kahalacorp.com&gt;
 +
 +
2010-05-03 - p0f feature by Matt Simerson &lt;msimerson@cpan.org&gt;
 +
 +
2012-05 - geoip, loglevel, reject added. Refactored into subs by Matt Simerson
 +
 +
<!-- Generated Mon Jul 17 07:51:37 EDT 2017 using
 +
perldoc -T -ohtml /usr/share/qpsmtpd/plugins/greylisting |pandoc -f html -t mediawiki |sed 1 i\\n\n\n<span id="_top">[[Qpsmtpd#Plugins]]</span> |sed -e s#</d.>##
 +
-->
 
----
 
----
 +
[[Category:Qpsmtpd]]
 
[[Category:Howto]]
 
[[Category:Howto]]
 
[[Category:Mail]]
 
[[Category:Mail]]
Retrieved from "https://wiki.koozali.org/Special:MobileDiff/33729"

Navigation menu