GenerationIP

Type : System
Operating System : Redhat,Fedora,Centos

In this how to, i want to present you sqlgrey a very simple greylisting solution for the limitation of your spam.

How it works from wikipedia explanation :

Typically, a server employing greylisting will record the three pieces of data known as a "triplet" for each incoming mail message:

• The IP address of the connecting host
• The envelope sender address
• The envelope recipient address

This is checked against the mail server's internal database. If this triplet has not been seen before (within some configurable period), the email is greylisted for a short time (also configurable), and it is refused with a temporary rejection. The assumption is that since temporary failures are built into the RFC specifications for email delivery, a legitimate server will attempt to connect again later on to deliver the email.

In practice, most greylisting systems do not require an exact match on the IP address and the sender address. Because large senders often have a pool of machines that can send (and resend) email, IP addresses that have the most-significant 24 bits (/24) the same are treated as equivalent, or in some cases SPF records are used to determine the sending pool. Similarly, with mailing lists which use unique per-message return-paths (via variable envelope return path or VERP), if an exact match on the sender address is required, each post from such a mailing list will be delayed. Instead, some greylisting systems try to eliminate the variable parts of the VERP by using only the sender domain and the beginning of the local-part of the sender address.

Greylisting is effective because many mass email tools used by spammers will not bother to retry a failed delivery, so the spam is never delivered. When a spammer does retry a delivery after the waiting period has expired, however, it will likely be after a number of automated honeypots have detected the spam source and listed both the source and the particular message in their databases. Thus, these subsequent attempts are more likely to be detected as spam by other mechanisms than they were at first.

• INSTALLATION
• CONFIGURATION
• POSTFIX
• Mysql Structure
  

INSTALLATION

The first thing is to find the package for your distribution i proposed you this link pbone.net

For the installation you need some perl dependency:

perl-Net-Server

perl-Date-Calc

For postgreysql connector you need this perl dependency :

perl-DBD-pg

perl-IO-Multiplex

After the dependency you have to install sqlgrey.

rpm -i  sqlgrey-1.*.*-*.noarch.rpm

CONFIGURATION

For your the configuration you have to edit this file:

/etc/sqlgrey/sqlgrey.conf

For the mysql connection you have change the configuration file to enable mysql connection.

You have to create a user and database, after that sqlgrey create the schema below for you.

You must have this value in your config file.

db_type = mysql

Now you have to init your daemon : chkconfig sqlgrey on

By default sqlgrey bind on this port 2501

POSTFIX

Please Edit your main.cf

Now please cherche this option : smtpd_recipient_restrictions

smtpd_recipient_restrictions =
              ...
              reject_unauth_destination
              check_policy_service inet:127.0.0.1:2501

Mysql Structure

CREATE TABLE IF NOT EXISTS `config` (
`parameter` varchar(255) NOT NULL,
`value` varchar(255) default NULL,
PRIMARY KEY  (`parameter`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

INSERT INTO `config` (`parameter`, `value`) VALUES
('version', '3');

CREATE TABLE IF NOT EXISTS `connect` (
`sender_name` varchar(64) NOT NULL,
`sender_domain` varchar(255) NOT NULL,
`src` varchar(39) NOT NULL,
`rcpt` varchar(255) NOT NULL,
`first_seen` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
KEY `connect_idx` (`src`,`sender_domain`,`sender_name`),
KEY `connect_fseen` (`first_seen`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE IF NOT EXISTS `domain_awl` (
`sender_domain` varchar(255) NOT NULL,
`src` varchar(39) NOT NULL,
`first_seen` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
`last_seen` timestamp NOT NULL default '0000-00-00 00:00:00',
PRIMARY KEY  (`src`,`sender_domain`),
KEY `domain_awl_lseen` (`last_seen`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE IF NOT EXISTS `from_awl` (
`sender_name` varchar(64) NOT NULL,
`sender_domain` varchar(255) NOT NULL,
`src` varchar(39) NOT NULL,
`first_seen` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
`last_seen` timestamp NOT NULL default '0000-00-00 00:00:00',
PRIMARY KEY  (`src`,`sender_domain`,`sender_name`),
KEY `from_awl_lseen` (`last_seen`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE IF NOT EXISTS `optin_domain` (
`domain` varchar(255) NOT NULL,
PRIMARY KEY  (`domain`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE IF NOT EXISTS `optin_email` (
`email` varchar(255) NOT NULL,
PRIMARY KEY  (`email`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;


CREATE TABLE IF NOT EXISTS `optout_domain` (
`domain` varchar(255) NOT NULL,
PRIMARY KEY  (`domain`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE IF NOT EXISTS `optout_email` (
`email` varchar(255) NOT NULL,
PRIMARY KEY  (`email`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;