Date: Thu, 26 Apr 2007 12:04:52 -0400 From: Christopher Sean Hilton <chris@vindaloo.com> To: Ted Mittelstaedt <tedm@toybox.placo.com>, User Questions <freebsd-questions@freebsd.org> Subject: Re: Greylisting -- Was: Anti Spam Message-ID: <4630CDA4.30201@vindaloo.com> In-Reply-To: <BMEDLGAENEKCJFGODFOCEEADCAAA.tedm@toybox.placo.com> References: <BMEDLGAENEKCJFGODFOCEEADCAAA.tedm@toybox.placo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Ted Mittelstaedt wrote:
[snip...]
>> Greylisting works because many, and I'd like to say most, spam programs
>> never retry message delivery.
>
> Actually, no. Greylisting works because it delays the spam injector
> long enough that the injector will get blacklisted by the time that the
> greylist opens the door for the mail to come in. Greylisting alone
> by itself is getting less and less effective every day. Spammers are now
> starting to setup spam injectors to retry. If you think about it, it is
> very easy to program. Simply create a list of victims, iterate through
> the list once, deleting all the victims that accept, then wait several
> hours and iterate through the list again. It didn't take a rocket scientist
> to figure that one out.
>
> Since SA has a lot of the major blacklist servers as score-feeders, the
> spam that gets past the greylist just gets tagged by SA.
>
When I scan my maillogs I find that 22% of the hosts that generate a
greylisting entry retry the mail delivery and thus get whitelisted. The
other 78% don't attempt redelivery within the greylisting window. The
reason that I'm using greylisting is to reduce the load on SA so I can
continue to use spam bayes. Quite honestly spam bayes is either the most
or second most effective spam filtering technique that I'm using but its
a CPU hog.
If I had to rank the effectiveness of the filtering that I'm doing I
would say that greylisting is probably the most effective. I'm using
spamd with tarpitting and that alone is responsible for filtering 90% of
my spam. Spam bayes is probably second but I haven't counted the number
of messages that are getting filed as spam based on the bayes classifier.
Some numbers from crunching my combined maillogs (primary and secondary
mx) from Apr 24th 20:00:00 ~ Apr 25th 20:00:00.
1566 hosts generated 1907 connections to my primary and secondary MXers.
155 hosts generated 192 greylisting entries on either one or both of my
mailservers.
34 hosts attempted to retry mail generating 40 whitelist transactions on
one or both of my mailservers.
-- Chris
__o "All I was doing was trying to get home from work."
_`\<,_ -Rosa Parks
___(*)/_(*)___________________________________________________________
Christopher Sean Hilton chris | at | vindaloo.com
pgp: f5:30:0a:54:e1:55:76:9b:1f:47:0b:07:e9:75:0e:14
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4630CDA4.30201>