1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
PPoossttffiixx BBaacckkssccaatttteerr HHoowwttoo
-------------------------------------------------------------------------------
OOvveerrvviieeww
This document describes features that require Postfix version 2.0 or later.
Topics covered in this document:
* What is backscatter mail?
* How do I block backscatter mail to random recipient addresses?
* How do I block backscatter mail to real recipient addresses?
o Blocking backscatter mail with forged HELO information
o Blocking backscatter mail with forged sender information
o Blocking backscatter mail with other forged information
o Blocking backscatter mail from virus scanners
WWhhaatt iiss bbaacckkssccaatttteerr mmaaiill??
When a spammer or worm sends mail with forged sender addresses, innocent sites
are flooded with undeliverable mail notifications. This is called backscatter
mail, and if your system is flooded then you will find out soon enough.
HHooww ddoo II bblloocckk bbaacckkssccaatttteerr mmaaiill ttoo rraannddoomm rreecciippiieenntt aaddddrreesssseess??
If your machine receives backscatter mail to random addresses, configure
Postfix to reject all mail for non-existent recipients as described in the
LOCAL_RECIPIENT_README and STANDARD_CONFIGURATION_README documentation.
If your machine runs Postfix 2.0 and earlier, disable the "pause before reject"
feature in the SMTP server. If your system is under stress then it should not
waste time.
/etc/postfix/main.cf:
# Not needed with Postfix 2.1 and later.
smtpd_error_sleep_time = 0
HHooww ddoo II bblloocckk bbaacckkssccaatttteerr mmaaiill ttoo rreeaall rreecciippiieenntt aaddddrreesssseess??
When backscatter mail passes the "unknown recipient" barrier, there still is no
need to despair. Many mail systems are kind enough to attach the message
headers of the undeliverable mail in the non-delivery notification. These
message headers contain information that you can use to recognize and block
forged mail.
BBlloocckkiinngg bbaacckkssccaatttteerr mmaaiill wwiitthh ffoorrggeedd HHEELLOO iinnffoorrmmaattiioonn
Although my email address is "wietse@porcupine.org", all my mail systems
announce themselves with the SMTP HELO command as "hostname.porcupine.org".
Thus, if returned mail has a Received: message header like this:
Received: from porcupine.org ...
Then I know that this is almost certainly forged mail (almost; see next section
for the fly in the ointment). Mail that is really sent by my systems looks like
this:
Received: from hostname.porcupine.org ...
For the same reason the following message headers are very likely to be the
result of forgery:
Received: from host.example.com ([1.2.3.4] helo=porcupine.org) ...
Received: from [1.2.3.4] (port=12345 helo=porcupine.org) ...
Received: from host.example.com (HELO porcupine.org) ...
Received: from host.example.com (EHLO porcupine.org) ...
Another frequent sign of forgery is the Message-ID: header. My systems produce
a Message-ID: of <stuff@hostname.porcupine.org>. The following are forgeries,
especially the first one:
Message-ID: <1cb479435d8eb9.2beb1.qmail@porcupine.org>
Message-ID: <yulszqocfzsficvzzju@porcupine.org>
To block such backscatter I use header_checks and body_checks patterns like
this:
/etc/postfix/main.cf:
header_checks = regexp:/etc/postfix/header_checks
body_checks = regexp:/etc/postfix/body_checks
/etc/postfix/header_checks:
/^Received: +from +(porcupine\.org) +/
reject forged client name in Received: header: $1
/^Received: +from +[^ ]+ +\(([^ ]+ +[he]+lo=|[he]+lo +)
(porcupine\.org)\)/
reject forged client name in Received: header: $2
/^Message-ID:.*@(porcupine\.org)/
reject forged domain name in Message-ID: header: $1
/etc/postfix/body_checks:
/^[> ]*Received: +from +(porcupine\.org) /
reject forged client name in Received: header: $1
/^[> ]*Received: +from +[^ ]+ +\(([^ ]+ +[he]+lo=|[he]+lo +)
(porcupine\.org)\)/
reject forged client name in Received: header: $2
/^[> ]*Message-ID:.*@(porcupine\.org)/
reject forged domain name in Message-ID: header: $1
Notes:
* The example is simplified for educational purposes. In reality my patterns
list multiple domain names, as "(domain|domain|...)".
* The "\." matches "." literally. Without the "\", the "." would match any
character.
* The "\(" and "\)" match "(" and ")" literally. Without the "\", the "(" and
")" would be grouping operators.
CCaavveeaattss
Netscape Messenger (and reportedly, Mozilla) sends a HELO name that is
identical to the sender address domain part. If you have such clients then the
above patterns would block legitimate email.
My network has only one such machine, and to prevent its mail from being
blocked I have configured it to send mail as user@hostname.porcupine.org. On
the Postfix server, a canonical mapping translates this temporary address into
user@porcupine.org.
/etc/postfix/main.cf:
canonical_maps = hash:/etc/postfix/canonical
/etc/postfix/canonical:
@hostname.porcupine.org @porcupine.org
This is of course practical only when you have very few systems that send HELO
commands like this, and when you never have to send mail to a user on such a
host.
An alternative would be to remove the hostname from "hostname.porcupine.org"
with address masquerading, as described in the ADDRESS_REWRITING_README
document.
BBlloocckkiinngg bbaacckkssccaatttteerr mmaaiill wwiitthh ffoorrggeedd sseennddeerr iinnffoorrmmaattiioonn
Like many people I still have a few email addresses in domains that I used in
the past. Mail for those addresses is forwarded to my current address. Most of
the backscatter mail that I get claims to be sent from these addresses. Such
mail is obviously forged and is very easy to stop.
/etc/postfix/main.cf:
header_checks = regexp:/etc/postfix/header_checks
body_checks = regexp:/etc/postfix/body_checks
/etc/postfix/header_checks:
/^(From|Return-Path):.*[[:<:]](user@domain\.tld)[[:>:]]/
reject forged sender address in $1: header: $2
/etc/postfix/body_checks:
/^[> ]*(From|Return-Path):.*[[:<:]](user@domain\.tld)[[:>:]]/
reject forged sender address in $1: header: $2
Notes:
* The example is simplified for educational purposes. In reality, my patterns
list multiple email addresses as "(user1@domain1\.tld|user2@domain2\.tld)".
* The "[[:<:]]" and "[[:>:]]" match the beginning and end of a word,
respectively. On some systems you should specify "\<" and "\>" instead. For
details see your system documentation.
* The "\." matches "." literally. Without the "\", the "." would match any
character.
BBlloocckkiinngg bbaacckkssccaatttteerr mmaaiill wwiitthh ootthheerr ffoorrggeedd iinnffoorrmmaattiioonn
Another sign of forgery can be found in the IP address that is recorded in
Received: headers next to your HELO host or domain name. This information must
be used with care, though. Some mail servers are behind a network address
translator and never see the true client IP address.
BBlloocckkiinngg bbaacckkssccaatttteerr mmaaiill ffrroomm vviirruuss ssccaannnneerrss
With all the easily recognizable forgeries eliminated, there is one category of
backscatter mail that remains, and that is notifications from virus scanner
software. Unfortunately, some virus scanning software doesn't know that viruses
forge sender addresses. To make matters worse, the software also doesn't know
how to report a mail delivery problem, so that we cannot use the above
techniques to recognize forgeries.
Recognizing virus scanner mail is an error prone process, because there is a
lot of variation in report formats. The following is only a small example of
message header patterns. For a large collection of header and body patterns
that recognize virus notification email, see http://www.dkuug.dk/keld/virus/ or
http://www.t29.dk/antiantivirus.txt.
/etc/postfix/header_checks:
/^Subject: *Your email contains VIRUSES/ DISCARD virus notification
/^Content-Disposition:.*VIRUS1_DETECTED_AND_REMOVED/
DISCARD virus notification
/^Content-Disposition:.*VirusWarning.txt/ DISCARD virus notification
Note: these documents haven't been updated since 2004, so they are useful only
as a starting point.
A plea to virus or spam scanner operators: please do not make the problem worse
by sending return mail to forged sender addresses. You're only harassing
innocent people. If you must return mail to the purported sender, please return
the full message headers, so that the sender can filter out the obvious
forgeries.
|
