Slashdot Mirror
Stopping Spam And Trojan Horses With BSD
Brett Glass writes: "This paper, first presented at BSDCon 2000, describes state of the art methods of blocking spam and malware using BSD and Sendmail. The techniques described here are also applicable to other operating systems and mail transfer agents, so this paper is worth reading even if you're using NT, Linux, Postfix, qmail, etc. If you've never heard of a Rumplestiltskin attack, are baffled by the finer points of Sendmail configuration, or want to know how to block worms like ILOVEYOU before they reach vulnerable Windows clients, you'll enjoy this paper. Slides from the presentation are also included."
Most security exploits are in userland daemons, not the kernel itself. As such, it's up to the package maintainers to handle fixes, and this is generally done quite fast.
And to clarify your confusion, I wasn't referring to BSD at any point in my post.
Most security exploits are in userland daemons, not the kernel itself.
...in Linux.
Which is a response to the comment by Oz:
normaly when an exploit is found in *BSD it is typicaly fixed faster than in linux just because how they have 'there system of makeing the system' setup. They have a core team that can say 'yeah we need this' or 'no' and in linux its just linus.
I was pointing out that "its just linus" is usually not the case, because such exploits tend to be in userland, not the kernel.
I just realized how sad it is that I am actually reading this article at 11:20 pm on Christmas Eve, and enjoying it. Then I realize that Hemos actually posted it about the same time... :)
Great Article. Merry Christmas and Happy Holidays to all!
As he [Theo] states in all the replies to this, which seems reasonable to me, that they just fixed a bug during their auditing and that they did not realized that it was a exploit. This seems very reasonable, but people does not seem to get it, which is very sad.
a bit offtopic, but: does anyone know how to configure sendmail, so that if the sender domain matches some RBL (ORBS, etc) "SPAM:" is inserted into the subject line of the header (or some X-SPAM: header is set).
... ;)
The reason behind this, is to allow users to choose whether to filter or not. Some usere here have contact to ppl on open-relay hosts, and I would like to block them
Samba Information HQ
Never used lp in native redhat pre 7.0? That is BSD code.
Sendmail is another example of BSD derived code.
Oh, how about the TCP/IP stack? the include file for in_systm.h says "Original taken from BSD UNIX 4.3-RENO"
If you'd bother to grep for BSD in the linux kernel, you'd find that BSD is core to Linux.
And you 'use' a "BSD" program to get to slashdot. Yup, the OpenBSD firewall that is (was) protecting the site.
If it was said on slashdot, it MUST be true!
--Brett
--Brett
That's because the craven Greg Lehey quoted me without attribution.
--Brett Glass
Are you sure you wanna use tires as a comparison, with all the firestone stuff going on?
;-)
just a thought.
(but good point tho)
Stop over-analyzing your analizations
Look here.
The referenced article starts with a particularly ridiculous bit of advocacy that renders the rest of it fairly dubious. It recommends sendmail on the basis of market penetration, but carefully avoids mentioning its security vulnerabilities and accumulation of cruft; it then makes a contrived argument that, since sendmail was developed on a BSD box, it should be run on the same. Nonsense. sendmail works equally poorly on many Un*x variants; there's nothing special about BSD in that regard.
Why should we judge sendmail on its market penetration but avoid judging BSD in the same way? The paper doesn't bother to justify that. I expect its author(s) figured on a sympathetic audience of BSD advocates.
If you really want to avoid being screwed, run a better MTA -- qmail and exim are reasonable choices. BSD is of course a reasonable choice of OS for that job, as are a number of Un*ces. But don't pick BSD because it will run sendmail -- that's like buying a Colt M1911A1 because it can be converted to full auto. The choice of platform is good, but the reasoning stinks!
--
Some keywords for the NSA in the Lord of the Rings universe: One Ring bind find Sauron quest Nazgul freedom
Sendmail has a bad habit if not being able to scan the message body so you have to use an external filter.
I've got a patch to fix this for 8.11.1 that uses the built in regex map to allow sendmail to look for a regex in the body of the message.