How to defend against spam in Linux

I believe that most people who use emails will receive a lot of spam every day. As a network manager, I receive more than hundreds of spam mails every day, so it is imperative to prevent spam.

I. Environment Description

The server of the organization uses RedHat Linux 9.0 and the mail server uses Sendmail 8.12.8. This server is placed on the Intranet and connected to the Internet through a Win2000 Server. The gateway software uses WinRoute pro 4.2.5.

Ii. Main modification measures

1. Disable the relay function of Sendmail.

The so-called relay means that someone else can use this SMTP mail server to send emails to anyone, so that spammers with ulterior motives can use this mail server of the author's organization to send a large number of spam mails, in the end, what others complain about is not the spammers, but the server of the Organization. Therefore, you must disable open relay by going to the/etc/mail directory of the Linux server, editing the access file, and removing settings such as "* relay, generally, only "localhost relay" and "127.0.0.1 relay" are available.

Note: After modifying the access file, run makemap hash access. DB <access to make the modification take effect.

2. Enable SMTP authentication for Sendmail

If the relay function is disabled, it doesn't matter if the teachers in the organization cannot use software such as oe to send emails. As long as the SMTP authentication function is configured for Sendmail, then enable SMTP authentication in OE, the SMTP server can be used anywhere.

It is very convenient to configure SMTP authentication in RedHat Linux 9.0. First, run the command rpm-Qa | grep SASL to check whether the cyrus-sasl software package is installed. (generally, the default installation is included ). If not, run the command rpm-IVH cyrus-sasl.rpm to install all packages, then open the/etc/mail/sendmail. Mc file, and put the following three lines:

DNL trust_auth_mech ('digest-MD5 CRAM-MD5 login plain ') DNL
DNL define ('confauth _ mechanisms ', 'digest-MD5 CRAM-MD5 login plain') DNL
Daemon_options ('port = SMTP, ADDR = 127.0.0.1, name = MTA ')
Change
Trust_auth_mech ('digest-MD5 CRAM-MD5 login plain ') DNL
Define ('confauth _ mechanisms ', 'digest-MD5 CRAM-MD5 login plain') DNL
Daemon_options ('port = SMTP, ADDR = 0.0.0.0, name = MTA ')

3. Add the RBL function to Sendmail.

RBL (Realtime blackhole list) is a real-time blacklist. Some foreign organizations provide RBL services. They add the IP addresses of the specially sent spam emails to their blacklists. We only need to add the RBL authentication function to Sendmail, in this case, our email server will automatically go to The RBL server for verification each time it receives the mail. If the mail comes from the blacklist, Sendmail will reject the mail, so that the users in the Organization will suffer less from spam.

The well-known RBL in foreign countries is http // www.ordb.org, whose RBL is available for free, and the domestic http // anti-spam.org.cn last year also provides similar services, but it must be registered before it can be used for free.

Add RBL authentication to Sendmail. MC adds the following statements (the first statement indicates that ordb is added. the RBL service of org. The second sentence indicates that the RBL service of anti-spam is added. Note that the second one must be registered with the website before it can be used. If you want to add other RBL certifications, you can add a few more words in this case. Generally, it is enough to add two RBL certifications ):

① Feature ('dnsbl', 'relays .ordb.org ', 'new email blocked using ordb.org-See ② Feature ('dnsbl', 'cblplus .anti-spam.org.cn ', '','' "451 temporary lookup failurefor" $ & {client_addr} "in cbl.anti-spam.org.cn ″')

Finally, run the M4 sendmail. MC> sendmail. CF and service Sendmail restart commands to make the Sendmail modification take effect.

4. Disable open proxy

The gateway of the organization uses the WinRoute software. In order to improve the speed of Internet access, the WinRoute proxy service is opened. However, most proxies are allowed to connect to any TCP port using the http connect method by default, in this way, when the proxy does not limit the user and the corresponding TCP port, it is easy to give the spam sender a chance. They only need to use the proxy of the Organization to connect to port 25 of another mail server and send specific SMTP commands to send a large number of spam messages.

I don't know, but I was shocked. As early as last December, the server was blacklisted abroad due to open proxy. What's more, because of the open proxy, the CPU usage of our gateway machine has been around 50%, and the gateway of our company has been obligated to do bad things for others.

The method to disable open proxy in WinRoute is also very simple, as long as you close the proxy port connecting to the Internet Nic.

The procedure is as follows: click "Settings → advanced → packet filter", select the incoming panel, find the NIC connected to the Internet, and click the Add button. The Add Item dialog box is displayed, and select protocol as TCP, in destination, select "Port = 3128" and "deny" in "action" (1 ).

5. Disable external port 25

I checked the sendmail log, but I didn't find many spam mails sent from the Organization. When I was depressed, it suddenly reminds me that during this time, the Internet sky "Netsky" and "Mydoom" viruses are making a lot of spam mails, especially in the network sky, it comes with the SMTP service function. You can send a mail directly without using Sendmail. Of course, no records are recorded in the sendmail log of the organization. Therefore, immediately go to the WinRoute of the gateway machine and add the limit that the NIC connected to the Intranet cannot connect to the port number 25 outward. The specific setting is shown in step 2.

Note: This setting is added to the Intranet Nic, while the setting to disable open proxy is added to the Internet Nic.

6. Remove from the blacklist

Some time ago, due to my negligence, the IP address of my organization had been blacklisted by RBL outside China. You can query and delete IP addresses in RBL to http://openrbl.org/and http://ordb.org, and domestic http://anti-spam.org.cn/cbl_minus/query.htmlcan also be queried.