メールサーバで行なうスパム対策

以下のテキストは、執筆時当時の情報を元に書いたものであり、 現在の情勢にそぐわないことを含む場合があるので注意されたい。 また、テキストは最終提出原稿で校正を経る前のものなので、実際にUNIXUSER 本誌に記載されたものとは異なる。誤字脱字等そのままである。

致命的な誤り以外は加筆修正等は行なわないので情報の鮮度に気をつけつつ 利用して欲しい。

目次

======================================================================
Part4 
======================================================================






  ?

SMTP
LAN
PC
Part4




 













  * UBE(Unsolicited Bulk Email; email)spam
  * Windows-PC
    ()

2



  

	

  
  
  
  
  

  
  
  99%
  SMTP



SMTP
SMTP

  +--+                                             +--+
  ||  (1)HELO				   ||
  ||       HELO mail.example.com           ||
  ||   250 ok ()		   ||
  ||  (2)envelope-from			   ||
  ||       MAIL FROM:    ||
  ||   250 ok				   |  |
  |  |  (3)Recipient address		   |  |
  |  |       RCPT TO:      |  |
  |  |   250 ok				   |  |
  |  |  (4)			   |  |
  |  |       DATA			         |  |
  |  |   354 ok				   |  |
  |  |  (5)			   |  |
  |  |        	         |  |
  |  |        		   |  |
  |  |   250 ok			         |  |
  +--+                                             +--+

SMTP3
(HELO)(MAIL FROM)
(RCPT TO)


spam
spam


spam
SMTP3
IP


PC


SMTP
SMTP




2

	* SMTP

	  SMTPIPSMTP3
	  /
	  CPUspam
	  
	  SMTP(
	  )

	* 

	  
	  
	  CPUSMTP
	  
	   

---[ ]------------------------------------------------------------
 Envelope-from 

 Envelope-from 
()
----------------------------------------------------------------------

SMTPspam

SMTP



Part3SMTP
 Qmail-Scanner 

SMTP

2002spam
200212 qmail-smptd 
SMTP
SMTP(SMTP5xx)
 qmail
patches 
qmail MTA
 antibadmail 
---[ ]------------------------------------------------------------
http://www.gentei.org/~yuuji/software/qmpatch/
----------------------------------------------------------------------

antibadmailqmail
MTASMTP


antibadmailRFC
RFC
(
)
antibadmail


  antibadmail

  antibadmailSMTP()SMTP()
  
   
  SMTP "DATA" 
  SMTP
---[ ]------------------------------------------------------------

  +------+					+------+
  | SMTP |					| SMTP |
  |    |           +-------------+		|    |
  | 	 |  -------  | antibadmail | ---------> |    |
  | 	 |           |             |		|    |
  | 	 |  <------  |		   | ---------	|      |
  | 	 |	     +-------------+		|      |
  | 	 |					|      |
  +------+					+------+
 
----------------------------------------------------------------------

  antibadmail
  /()

	* DNS
	* IP
	* HELO
	* MAIL FROM
	* MAIL FROM
	* RCPT TO

  
  
  
  

  
  

  antibadmail

  antibadmail

	1. ucspi-tcp(tcpserver)&
	2. antibadmail&
	3. SMTP
	4. 

  antibadmail(13)
  antibadmailSMTP
  

  -------------------------------------
   		mail.ymzk.org
   IP		192.168.0.25
   LAN	192.168.0.0/24
  -------------------------------------

  (1) ucspi-tcp(tcpserver)&
      =============================================

  ucspi-tcpqmailTCP
  antibadmailucspi-tcp
  3

	* tcpserver

	  TCPIP
	  /
	  
	  antibadmail

	* tcprules

	  TCP
	  cdb 
	  tcpserver

	* mconnect

	  (MTAqmail)
	  SMTPSMTP
	  SMTP
	  
---[ ]------------------------------------------------------------


http://cr.yp.to/cdb.html 
----------------------------------------------------------------------

  ucspi-tcp http://cr.yp.to/ucspi-tcp/install.html 
  
  http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz CD
  

	# gzip -dc ucspi-tcp-0.88.tar.gz | tar xpf -

  fefeIPv6(IPv4) 
  IPv6
  CD-ROM

	# bzip2 ucspi-tcp-0.88-ipv6.diff10.bz2 | patch -p0

---[ ]------------------------------------------------------------
fefediff 14*BSD

*BSD diff 10 
----------------------------------------------------------------------

  tcprulesantibadmail
  

	# patch -p0 < ut088fefe10-paranoid.diff

   conf-* 
  1

	# cd ucspi-tcp-0.88
	# rm *.orig
	# head conf-*

   /usr/local/bin 
  /usr/local/bin 
  

	# make && make setup check

  (2) antibadmail&
      ========================================

  URL
  

	http://www.gentei.org/~yuuji/software/antibadmail/

  antibadmailcvs
  

	% cvs -d :pserver:anonymous@yatex.org:/qmail co antibadmail

  &

	# cd antibadmail
	# make all install

  make install antibadmail  f2d  /usr/local/bin
  antibadmail
   Makefile 

	CFLAGS  = -DSYSLOG -g

  

	CFLAGS  = -DSYSLOG -g -D=

  

  antibadmail 
   /var/qmail/control  CONTROLDIR 
  
  $CONTROLDIR  
---[ ]------------------------------------------------------------
qmail antibadmail 
 /var/qmail/control 
qmail

 CONTROLDIR 
antibadmail
----------------------------------------------------------------------


---[ ]------------------------------------------------------------
 antibadmail

  				
  CONTROLDIR	/var/qmail/control	
					
  LOG_FACI	LOG_LOCAL1		syslog
----------------------------------------------------------------------


---[ netqmail-1.05]--------------------------------------------- 
MTA
 netqmail-1.05 

http://www.qmail.org/netqmail/

netqmailqmail-1.03
 netqmail-1.05.tar.gz 


	# ./collate.sh
	# cd netqmail-1.05
	# make setup check

 qmail-1.03 
qmail-1.03

	* mfcheck patch(MAIL FROM)
	  http://www.qmail.org/qmail-1.03-mfcheck.3.patch
	* badrcptto patch(RCPTTObadrcptto)
	  http://patch.be/qmail/badrcptto.html

antibadmail
qmail

netqmail
----------------------------------------------------------------------

  (3) SMTP
      ==========================

  MTAqmail

  SMTP(25)antibadmailMTALISTEN
  255

    i. SMTPD
       ---------------------------
  Sendmail sendmail.cf  DaemonPortOptions 
  

	O DaemonPortOptions=Name=MTA
	
	O DaemonPortOptions=Name=MTA, Port=10025

  10025
  SMTP10025
    %%
    %% Postfix?
    %%

   ii. antibadmail/
       ----------------------------------------
   antibadmail 
  / "abm" 
  

	(Linux/NetBSD/SunOS)
	# groupadd abm
	# useradd -g abm abm
	(FreeBSD)
	# pw groupadd abm
	# pw useradd abm -g abm

  iii. TCP
       ---------------------------------

  (v)tcpserver
  /etc/abm 

	  /etc/abm/smtp
	cdb   /etc/abm/smtp.cdb

  

	* LANSMTP
	* 

   
---[  /etc/abm/smtp]------------------------------------------
127.0.0.1:allow,RELAYCLIENT=""
192.168.0.:allow,RELAYCLIENT=""
all:allow
----------------------------------------------------------------------

  cdb 
  Makefile 
---[  /etc/abm/Makefile]--------------------------------------
TCPRULES = /usr/local/bin/tcprules
smtp.cdb:  smtp
	cat smtp | ${TCPRULES} smtp.cdb smtp.tmp
----------------------------------------------------------------------

  /etc/abm  make cdb
  

	# (cd /etc/abm; make)

   iv. SMTP
       --------------------------------
  
  
  foo.ymzk.org  example.com 
  *.example.com 

	# mkdir -p $CONTROLDIR     ( /var/qmail/control)
	# cd $CONTROLDIR
	# mkdir rcpthostsdir
	# cd rcpthostsdir
	# touch foo.ymzk.org example.com .example.com

  
   rcpthostsdir/ 
  RCPT TO

  SMTP
  SMTP-AUTH POP before SMTP 
  IPRELAYCLIENT
  tcpserver 
---[ ]------------------------------------------------------------
antibadmail
abmusers-ML
----------------------------------------------------------------------

   
    v. tcpserverantibadmail
       --------------------------------

   
  abmUIDabmGID
   /etc/passwd, /etc/group  abm 3
  ID

---[  /etc/abm/start-abm.sh]----------------------------------
#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/bin:/usr/local/bin
UID=abmUID
GID=abmGID
exec env - \
PATH="$PATH" \
UID=$UID \
GID=$GID \
RELAYCHECK=1 \
tcpserver -x /etc/abm/smtp.cdb -p -U 0 25 \
antibadmail mconnect 192.168.0.25 10025
----------------------------------------------------------------------

  MTAqmail

  qmail qmail-smtpd 
   qmail-smtpd
  antibadmail qmail-smtpd 

	[[ () ]]
	PATH=/usr/local/bin:$PATH
	UID=qmaildUID \
	GID=qmaildGID \
	tcpserver -vR -c40 -p -U -x /somewhere/smtp.cdb 0 25 \
	  qmail-smtpd 2>&1

	[[  ]]
	PATH=/usr/local/bin:$PATH
	UID=qmaildUID \
	GID=qmaildGID \
	tcpserver -vR -c40 -p -U -x /somewhere/smtp.cdb 0 25 \
	  antibadmail qmail-smtpd 2>&1
	  
	  
---[ ]------------------------------------------------------------
qmail-smptd  inetd 
daemontools+tcpserver daemontools 
tcpserver20027 PartII 
http://www.gentei.org/~yuuji/support/uu/200207/part2.html

----------------------------------------------------------------------

   qmail-smtpd  tcpserver 
  qmailMTA
  

		-	-	-	-	-

   antibadmail 
  
  

  

  SMTPantibadmail
  syslog
   /etc/syslog.conf 

	local1.info			/var/log/smtp-stat
	()

   syslogd HUP

	# touch /var/log/smtp-stat
  	# killall -1 syslogd		(FreeBSD)
  	# pkill -1 syslogd		(Linux/NetBSD/Solaris)

  
  newsyslog(*BSD)/etc/newsyslog.conf 
  logrotate(Linux) /etc/logroate.conf 
  logadm(Solaris)
  /etc/logadm.conf 

  

  antibadmail4

	* HELO

	  - $CONTROLDIR/badhelodir/ 
	  -localhost.localdomain
	   hotmail.com
	   hotmail.comHELO

	* MAIL FROM

	  - $CONTROLDIR/badmailfromdir/ 
	  - (MAIL FROM)
	     @hotmail.com 

	* RCPT TO

	  - $CONTROLDIR/badrcpttodir/ 
	  - (RCPT TO)

	* 

	  - tcpserver(/etc/abm/smtp)
	  - spam
	    


  SMTP3

  HELO/MAIL FROM/RCPT TO 3datadir
   x 
   x ()

  HELO localhost.localdomain 
	 $CONTROLDIR/badhelodir/localhost.localdomain 

  HELO *.example.com (*)
	 $CONTROLDIR/badhelodir/.example.com 

  MAIL FROM *@hotmail.com (*)
	 $CONTROLDIR/badmailfromdir/@hotmail.com 

  RCPT TO sales@ymzk.org 
	 $CONTROLDIR/badrcpttodir/sales@ymzk.org 

  /

  tcpserver
  
  

	 		
	---------------------------------------------------------------------
	 BADHOST		
	 REQPTR			IP
				PTR
				
	 GOODMAILFROM		MAIL FROM
				MAIL FROM
	 PASSONLY		MAIL FROM
	 GOODHELO		HELO
				HELO
	 RELAYCLIENT		(
				)
	 RELIABLECLIENT		RELAYCLIENT
	---------------------------------------------------------------------

  /etc/abm/smtp 

    *.adsl.example.net (*)
  	
	=.adsl.example.net:allow,BADHOST=""

    10.0.0.*  10.0.2.*10.0.5.* PTR
  	
	10.0.0.:allow,REQPTR=""
	10.0.2-5.:allow,REQPTR=""

    *.msn.com  MAIL FROM  *@msn.com
     *@*.msn.com 
    (: $CONTROLDIR/badmailfromdir/  @msn.com  .msn.com )
	
	=.msn.com:allow,GOODMAILFROM="@msn.com/.msn.com"

    oldmail.ymzk.org  MAIL FROM  *@ymzk.org *@*.ymzk.org 
    ()
	
	=oldmail.ymzk.org:allow,PASSONLY="@ymzk.org/.ymzk.org"

    *.docomo.ne.jp  HELO docomo.ne.jp 
    (: $CONTROLDIR/badhelodir/  docomo.ne.jp  )
	
	=.docomo.ne.jp:allow,GOODHELO="docomo.ne.jp"

    *.tomodachi.example.org MTA
    
	
	=.tomodachi.example.org:allow,RELIABLECLIENT=""

  tcpserverallow
  denyTCP
  
   
---[ ]------------------------------------------------------------
docomo.ne.jpSMTPHELO "docomo.ne.jp" 
FQDNau(ezweb.ne.jp)vodafone
HELO
----------------------------------------------------------------------
---[ ]------------------------------------------------------------
SMTP

----------------------------------------------------------------------

  

  tcpserver $CONTROLDIR 
  cvssubversion
  

  
  ( spamdb
  ) anonymous cvs 
  ()
  
  
  

  $CONTROLDIR( /var/qmail/control) anoncvs 
  spamdb

	# cd $CONTROLDIR
	# cvs -d :pserver:anonymous@yatex.org:/qmail co spamdb

  $CONTROLDIR/spamdb 

	badhelo		HELO11
	badmailfrom	MAIL FROM11
	badrcptto	HELO11
	smtp-badhost	TCP/
			
	Makefile	 bad*  bad*dir 
			 Makefile
	Makefile.tcprule  smtp 
			smtp-badhostcdb
			 Makefile 

   make datadir
   $CONTROLDIR 
  
  
	# cd /var/qmail/control/spamdb
	# make
	# cd ..
	# ln -s spamdb/bad*dir .

   cvs up  datadir 

	# (cd /var/qmail/control/spamdb; cvs up; make)

  spamdbBADHOST 
   smtp-badhost 
   tcpserver 
  Makefile.tcprule  Makefile 

	# cp spamdb/Makefile.tcprule /etc/abm/Makefile
	# cd /etc/abm
	# ln -s /var/qmail/control/spamdb/smtp-badhost .
	# make

  spamdb
  

  

  antibadmail

  	* Null-Sender 2RCPT TO
	* 
	*  RCPT TO 
	* (qmail)  RCPT TO SMTP

   http://www.gentei.org/~yuuji/software/antibadmail/ 
  antibadmailqmail patch
  URL

http://www.gentei.org/~yuuji/software/qmpatch/publication/nospam200312.pdf
http://www.gentei.org/~yuuji/software/antibadmail/publication/abm-dsm35.pdf



yuuji@gentei.org
Fingerprint16 = FF F9 FF CC E0 FE 5C F7 19 97 28 24 EC 5D 39 BA
HIROSE Yuuji - ASTROLOGY / BIKE / EPO / GUEST BOOK / YaTeX [Tweet]