SpamCannibal - How It Works
What is SpamCannibal?
SpamCannibal is a free software toolkit to help stop UBE (Unsolicited Bulk
Email), UCE (Unsolicited Commercial Email), and other spam from reaching your mail server.
A subset of SpamCannibal's modules can be used to mount and effective
defense against DoS attacks.
SpamCannibal is published under the GNU General Public License and is
available for download from CPAN. For specific download instructions
and links, click the Download link.
SpamCannibal's primary functional modules are:
In addition, there are a number of additonal web tools modules and scripts to assist with
administration and user services.
- IPTables::IPv4::DBTarpit, a database backed TCP/IP connection tarpit and IP
address collection daemon written in 'C' that uses Linux iptables QUEUE service.
- IPTables::IPv4::DBTarpit::Tools, database management tools for DBTarpit,
written in Perl. These tools may be used to directly interface spam filter
programs with the database tarpit.
- sc_BLcheck.pl and sc_BLpreen.pl, scripts run by a cron job to
automatically add and remove IP addresses to/from the tarpit based on
interrogation of remote DNSBL servers.
- sc_mailfilter.pl, a mail reception client to which you can email a
"spam" header and message. sc_mailfilter.pl will strip out the sending MTA
IP address and add it to the tarpit database, adding the headers and message
to the "evidence" database.
- Mail::SpamCannibal::DNSBLserver, a lightweight DNSBL server written
entirely in 'C' that reports status for the 'tarpit' database IP addresses when
interrogated. This is a full function DNSBL run entirely out of a database
that can be managed with the Perl toolset,
a web interface or automatically by the above scripts. DNSBLserver is
specifically designed to work cooperatively with other DNSBLserver daemons
to share 'tarpit' data without recursive feedback of IP address information.
- spam_report.cgi, a web page report generator that interfaces to the
LaBrea::Tarpit::Report module to present statistics and activity information
about the current activity of spam sites contacting your host and the dbtarpit daemon.
spam_report.cgi can be run as a standard cgi module or it can take advantage
of a mod-perl enhanced Apache installation.
How does SpamCannibal Work?
The SpamCannibal tool suite uses the Berkeley DB database found on almost all
unix based operating systems. It maintains four database files; 'tarpit',
'archive', 'blcontrib', and 'evidence'.
- tarpit is a list of IP addresses of hosts that are
to be refused access to port 25 (or any port defended against DoS attacks)
and the time of their last access attempt.
- archive contains the IP address and time of last contact for every host
accessing port 25 (or any port defended against DoS attacks)
that is NOT in the tarpit database. The archive database is
subsequently examined by the BLcheck screening script to check the IP addresses against various
DNSBL servers for known spam activity.
- blcontrib is a list of IP addresses of every host that has been added
to the tarpit because it was found in a remote DNSBL database and identified
as a spam source. The responding DNSBL TXT record, zone name and A response
record are stored for use by the 'BLpreen' script and to provide 'reason'
information for the web lookup client.
- evidence contains the IP address of every host added to the
tarpit database directly by the local hosting site. In addition to the offending IP
address, the database contains the mail headers and message constituting the
reason for addition to the tarpit banned list.
- The dbtarpit daemon interfaces directly with Linux iptables. All
connection attempts to port 25 (or any port defended against DoS attacks)
are examined by dbtarpit prior to network connection.
Incoming IP addresses are checked against the 'tarpit' database
and if found in the database tarpitted if TCP/IP or dropped if another protocol. Optionally, TCP/IP connections can be
dropped instead of tarpitting. If an address is not found in the 'tarpit' database it is saved in the
'archive' database for subsequent processing by the script that checks against
remote DNSBL servers. The packet is then passed transparently through to its
destination as if the dbtarpit daemon were not present.
- Activated by a cron job, sc_BLcheck.pl processes the 'archive' database and checks each
IP address against the list of DNSBL servers in its configuration file.
Addresses found in a remote DNSBL database that meet the necessary match
criteria are added to the 'tarpit' database. The TXT record (if any) or a
default TXT record from the config file is added to the 'blcontrib' database
along with the identity of the remote DNSBL for use by the DNSBLserver
daemon and web server client.
- Spam that is not identified by the automated tools that get's
through to your desktop is handled by the sc_mailfilter.pl mail client.
This script accepts mail sent to it as a designated 'robot' user. Its
configuration file contains the known mail servers and aliases within your
domain(s). Simply email a copy of the headers and message to the 'robot' spam
account from your PGP enabled (optional for security) mail client. It will
be decrypted by sc_maifilter.pl and the first originating server in the
Received-from: headers that is not a known-acceptable mail host is extracted
and added to the 'tarpit' database. The headers and message content are added
to the 'evidence' database for use by the web client.
What's a TARPIT and how does it work?
A TCP/IP tarpit is a program that sets the flow control settings to inhibit
communication rather than facilitate it. It sets the packet data and packet
window size parameters to very low values which slows the transmission rate
to a trickle. Then it never acknowledges packets, so transmission will be
retried over and over, ideally bringing the transmitting program
(the spam server, scanning tool or worm) to a virtual
halt for several hours or perhaps indefinitely. Tarpits maintained on our
firewall servers hold some threads for months.
More information on tarpits is available on the labrea, Sourceforge labrea, and LaBrea::Tarpit
...these sites are required reading.