Cygwin anti-spam techniques

[Christopher Faylor]

On Thu, Jan 25, 2007 at 07:05:45PM -0800, Jim Kleckner wrote:
>The presence of a little bit of spam on this list reminds
>me how little normally gets through.
>
>I know it might be considered a little OT, but do you have
>a pointer to what techniques are used these days?

Spamassassin:	http://spamassassin.apache.org/
qpsmtpd:	http://smtpd.develooper.com/
clamav:		http://www.clamav.net/

mlcheck - a homegrown filter which stops certain types of predictable
spam from coming through if it clears the above.  This is the program
which stops html mail and various "harmful" attachments.  It operates in
a slightly more relaxed mode if you're subscribed.

I use a bunch of "rules du jour" rules with spamassassin:

  BLACKLIST_URI
  BOGUSVIRUS
  RANDOMVAL
  SARE_ADULT
  SARE_BAYES_POISON_NXM
  SARE_BML
  SARE_EVILNUMBERS0
  SARE_FRAUD
  SARE_GENLSUBJ
  SARE_HEADER
  SARE_HIGHRISK
  SARE_HTML
  SARE_OBFU0
  SARE_OBFU1
  SARE_OEM
  SARE_RANDOM
  SARE_REDIRECT_POST300
  SARE_SPAMCOP_TOP200
  SARE_SPECIFIC
  SARE_SPOOF
  SARE_STOCKS
  SARE_UNSUB
  SARE_URI0
  SARE_URI1
  TRIPWIRE

and will be adding a couple more soon.

spamassassin is run during the smtp connection phase courtesy of qpsmtpd.  I
use a number of spam blocks in qpsmtpd, too.

But, actually, despite all of the above, I think the thing that keeps
the lists relatively spam free is my constant retraining of both the
spamassassin bayes filter and the mlcheckd keyword filter.  I update
those 5-10 times a day - whenever I get spam.  The postmaster account at
sourceware.org gets a lot of spam and it often seems to be a heads up
for spam that will soon be flooding the mailing lists.  So, if I can
catch spam that shows up there before it hits the mailing lists you
never see it.

Oh, and there's also the "aaaspam" honeypot as well as a bunch of other
email aliases at sourceware.org/gcc.gnu.org.  Mail sent there
automatically causes the email address to be added to a black list.  I
scan the black list hourly for accidental additions from mailing list
subscribers and remove any that show up.

That's it in a nutshell.

Any further questions about this should probably go to cygwin-talk.
I've set the cc there.

cgf

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/