Tired of Email Spam & Fighting Back…厭倦了垃圾電子郵件＆反擊…

Angsuman Chakraborty日由Angsuman Chakraborty

November 4th, 2007 2007年11月4日

I finally grew tired of email spams, having to delete several thousand spams a day while fishing out for valid emails is no fun.我終於長大厭倦了濫發電郵，而不必刪除數千垃圾郵件1天，而捕魚為有效的電子郵件是沒有樂趣。 Occasionally I deleted valid emails too in the process.偶爾我刪除了有效的電子郵件，太在這個過程中。 I realized I was wasting valuable productive hours dealing with junk from cretins and morons (aka spammers).我意識到我是浪費寶貴的生產時間，處理垃圾從cretins和低能（又名垃圾郵件發送者）。 I decided to fight back.我決定要反擊。

I implemented a series of anti-spam measures in postfix over the last couple of weeks and testing them to death. i實施了一系列反垃圾郵件措施，在postfix在過去的幾個星期和測試他們的死因。

Today is my first spam-free day in probably a decade or more.今天是我第一次的垃圾郵件免費的一天，大概10年或以上。

My crusade is so far with various RBL’s and email header & SMTP protocol compliance checks.我的十字軍東征，是迄今為止與各鄉的和電子郵件標題＆ SMTP協議的遵從性檢查。 I haven’t added spamassassin to the mix yet nor have I added clamav.我沒有要補充spamassassin目錄結構，但也不是我要補充的ClamAV 。 I seriously doubt if clamav is required on Linux. i嚴重懷疑，如果需要的ClamAV是在Linux上。

BTW: I never realized how effective RBL’s were till I tried them.的BTW ：我從來沒有意識到如何有效鄉的人到我嘗試。 Here is the stats from my latest mail log (from Oct 28 04:09:49):這裡是我的統計，從最新的郵件日誌（從10月28日4時09分49秒）：

Total mails rejected: 21141總的電子郵件駁回： 21141
Total mails blocked using RBL data: 16551總郵件的封鎖使用鄉數據： 16551

I am checking all my protection measures for effectiveness and more importantly false positives.我檢查我所有的保護措施的有效性和更重要的假陽性。 I plan to publish them in details soon.我打算將它們發布在細節很快。

You may also like to read您也可以想讀

James 詹姆斯 Says:說：
November 4th, 2007 at 1:40 am 2007年11月4日在上午01時40分

If you’re using RBLs for IP checks, are you checking the emails that are being blocked by RBL data?如果您使用的rbls為IP檢查，你檢查電子郵件，現正封鎖鄉數據？ They sure are great for blocking spam, but they also blacklist quite a few dynamic IPs and shared servers.他們肯定是偉大的，為攔截垃圾郵件，但它們也列入黑名單，也有不少的動態IP和共享服務器。 Here are a few scenarios to consider:這裡有一些情況，以考慮：

1. 1 。 One evening, a spammer sends a million spam emails and logs off his ISP.一個晚上，垃圾郵件發送100萬垃圾郵件，並註銷他的ISP 。 An RBL takes note of the spam, and adds his IP to its blacklist.一鄉注意到垃圾郵件，並增加了他的IP其列入黑名單。 The next morning, John logs on to email a report to his boss, but his boss never receives it.第二天早上，約翰登錄到電子郵件一份報告，他的老闆，但他的老闆從來沒有接受它。 Why?為什麼？ Because when John logged on, his ISP assigned him the very same IP that the spammer used the night before, and his boss uses an group of RBLs to block email from “known spammers”.因為當約翰未登錄，他的ISP指派他非常相同的IP ，該垃圾郵件發送者使用的前一天晚上，和他的老闆用一組rbls阻止電子郵件從“已知垃圾郵件發送者” 。

2. 2 。 John’s small, niche-market online retail site is hosted on a shared server with 100 other domains. John的小，利基市場的在線零售網站託管在一個共用的服務器擁有100其他領域。 Domain #93 begins to send massive amounts of spam emails.域＃ 93開始發送大量的垃圾郵件。 An RBL takes note and adds the server’s IP to its blacklist.一鄉注意到，並增加了服務器的IP其列入黑名單。 Suddenly, John’s invoice and shipping confirmation emails are not received by certain customers.突然，約翰的發票和航運確認電子郵件都沒有收到某些客戶。 It turns out that these customers are using RBLs to block emails from “known spammers”, and they are not receiving John’s critical emails because he (and 98 other domains) share a server (and therefore an IP) with the evil Domain #93.原來，這些客戶所使用的rbls座的電子郵件從“已知垃圾郵件發送者” ，他們沒有收到John的重要電子郵件，因為他（和其他領域98 ）共用一個服務器（因此，一個IP ）與邪惡域＃ 93 。

It was for these specific reasons that Bad Behavior scaled back its usage of RBLs to only those with a way for users to remove their own IP and provided instructions for how to do so on its block page.這是為這些特定的原因，不良行為縮減其使用rbls只有那些有辦法讓用戶刪除自己的IP和提供的指示怎麼做就其座頁。

Angsuman Chakraborty 日由Angsuman Chakraborty Says:說：
November 4th, 2007 at 9:44 pm 2007年11月4日在下午9點44分

I too am using RBL’s which provide an easy unpaid way of removal.我也利用鄉的，其中提供一種簡單的無酬的方式去除。 I would never use我絕不會使用 APEWS apews , for example, which doesn’t provide any way of removal for normal users. ，例如，這並沒有提供任何方式的罷免權，為一般使用者。

RBL’s have a definite issue with dynamic IP addresses and shared IP addresses in typical shared web hosting scenario as you well illustrated above.鄉郊建屋地段的有一定的問題與動態IP地址和共享的IP地址在典型的共享虛擬主機的情況正如你很好的證明以上。

I am spending hours trying to see if we hit any false positives.我消費時要看到，如果我們擊中任何假陽性。 None so far.到目前為止，沒有。 Still I am observing it closely, looking for errant patterns and such.我仍密切觀察，尋找錯誤的模式等。

Thanks for the clarifications and a much needed reminder.感謝的澄清和急需的提醒。

James 詹姆斯 Says:說：
November 5th, 2007 at 1:06 am 2007年11月5日在上午01時06分

You’re very welcome!您非常歡迎！ Thanks for clarifying your stance on RBLs, your careful attention to false positives, and for only supporting RBLs with easy removal systems.感謝您的澄清立場， rbls ，您小心留意假陽性，並只支持rbls容易去除系統。