The first mail delivery attempt (by a server that has never attempted delivery before) connects to port 25 is redirected to port 8025 on localhost. This is done with pf redirect rules. If the delivering server is not currently in the whitelist pf table it goes directly to spamd. The delivering mail server is denied delivery by spamd and told to come back at a later time. The mail servers visit is logged in spamd database and a timer starts. During this time the marked server is not allowed to deliver it's mail. It can come back as many times as it wants in this time period but will always be denied delivery. The connecting server is in what is called a "grey state" and is put on a greylist. This means it is not blacklisted (never allowed) nor whitelisted (always allowed).
Once our specified deny time period ends the delivering mail server will hopefully attempt another delivery (most legit servers will). When it does it will be denied delivery once again. The difference this time is it's status in the spamd database will be changed from grey to white. It's ip address is put in the pf whitelist table and any delivery from this server is redirected straight to the mail server (port 25) on any future delivery attempts. The future delivery attempts for a whitelisted server is done via the whitelist table in pf. Once spamd puts the server's ip in this table the best match in the firewall rules is the whitelist table match. Any servers in this table are redirected to the mail server.
The pf whitelist table is mantained by the spamd deamon. It will insert and remove entries based on it's database. Spamd removes whitelist entries from the spamd database if no mail delivery activity has been seen from the whitelisted address by spamlogd within our specified number of hours from the initial time an address is whitelisted.
After being white listed the delivering server will try another delivery attempt. This time it will be redirected right to mail server.
Spamd is installed on OpenBSD by default. The following are configuration options we are going to use to run spamd. The "-5" option is for black-listed entries, it returns an error code 550 to the spammer. The "-S12" option will stutter greylisted connections for the specified amount of seconds, after which the connection is not stuttered. The next option is "-G25:4:864". The first 25 stands for pass time in mins. Spamd will not accept mail from the initial connection attempt time up to this set time (25). At this point the server is grey listed. The second number 4 is called grey expiration time (hrs). This is the maximum amount of time the server to try to make another delivery after the 25 min pass time period. So, the server can attempt a delivery between 25 mins and 4 hrs after the initial connection attempt and it will be whitelisted. But remember when it connects during this time period it will be denied and whitelisted at the same time. It will have to come back one last time to delivery it's mail. It can come back any time after it is whitelisted. The last number is called the whitelist experation time. It is the time you have in hours to send a message to the server after you have been whitelisted. If you don't send a message to the server from the time your whitelisted up to this time then you will be removed from the whitelist and have to go through the whole filtering process over again. "-b" tells spamd what ip to bind to. "-v" turns on verbose logging. "-nOpenMailServer" is the SMTP version banner that is reported upon initial connection. Change that to whatever you want. The spamd line is put in the /etc/rc.conf file. An example of the revelant lines from this file are below.
The /etc/rc.conf below has pf being turned on and points to it's config file. It will also turn on spamd (in greylisting mode) and sendmail (or if you installed and configured postfix then that). The rest of the lines are not needed to get spamd working but are there for reference.
# These are the settings needed for spamd and postfix and or sendmail to work. pf=YES pf_rules=/etc/pf.conf sendmail_flags="-bd -q30m" spamd_grey=YES spamd_flags="-5 -S20 -G25:4:864 -b127.0.0.1 -v -nOpenMailServer" syslogd_flags="-a /var/spool/postfix/dev/log" # These settings are not needed to get spamd and postfix working they are just what I use. # The rest of the options in the rc.conf are either left blank or turned off. dhcpd_flags="fxp1" ntpd_flags="-s" sshd_flags="-4"
These are the lines you will need in your pf.conf file to get spamd working. Only the lines that involve spamd are below. You will have to fit these into your ruleset in the correct order (Macros, tables, options, traffic normalization, queuing, traslation, and packet filtering). The comments explain what the rules do. I have left in the rules for my MTA Postfix as an example of what you would need to do when using spamd and Postfix together. Postfix and spamd listen on localhost and connections for both are redirected to localhost from the outside. After putting the rules in restart PF (pfctl -f /etc/pf.conf).
# use a macro for the interface name, so it can be changed easily ext_if = "fxp0" # Spamd whitelist table table <spamd-white> persist # Outside servers whitelist. Uncomment if you use a generated whitelist like in script at bottom of page. # table <whitelist> persist file "/etc/whitelist.txt" # Outside servers whitelist redirect to postfix. Uncomment if used/needed. Line above goes with this. # rdr on $ext_if proto tcp from <whitelist> to ($ext_if) port smtp -> lo0 port smtp # Spamd and Postfix redirect on external interface. # If in whitelist table go to Postfix. If not in whitelist table go to spamd. rdr on $ext_if proto tcp from <spamd-white> to ($ext_if) port smtp -> lo0 port smtp rdr on $ext_if proto tcp from !<spamd-white> to ($ext_if) port smtp -> lo0 port spamd # Postfix Mail Server (internal interface) redirect for internal hosts. rdr on $int_if proto tcp from any to $int_if port smtp -> lo0 port smtp # Allow traffic for spamd from outside. Synproxy the connection. pass in quick on $ext_if inet proto tcp from any to lo0 port spamd flags S/SAFPRU synproxy state # Allow traffic for postfix mail server from anyone on the outside and the inside. pass in log on $ext_if inet proto tcp from any to lo0 port smtp flags S/SAFPRU synproxy state pass in on $int_if inet proto tcp from any to lo0 port smtp flags S/SAFPRU keep state
Setup and save a very simple /etc/spamd.conf file for now. We will do blacklist checks with the MTA.
all:\
::
You should be able to just reboot your machine to have all of these services start. I would suggest doing it to be sure they all start when the machine is rebooted. After rebooting you should see spamd (spamd,tcpdump) running. Hopefully you will see your MTA running also (postfix or sendmail or whatever). Tcpdump is running for spamd to watch incoming connections from mail servers. It uses it to keep the spam database (spamdb) up to date.
After being setup you can try to send an e-mail to your machine. Here's to hoping you setup all your dns records correctly. If you did and the e-mail gets to your machine spamd should respond with the a general message of "Come back later". Now you have an entry in your spam database (spamdb). To check this just execute the program: spamdb. You will see output like the following below.
