freebsd stable - Feb 2005 - Tarpitting Spam Traffic using PF...

I read about the spamd redirect in pf.conf.  However, I wonder if it
might be useful to set up a redirect to something like this:

http://www.fresh.files2.serveftp.net/smtarpit/

I suppose it doesn't make a difference, but I do want to make it
extremely painful for any spammers.   What are other people doing on
this part?

On Sun, Feb 20, 2005 at 12:36:07AM -0500, Forrest Aldrich
wrote:
> I read about the spamd redirect in pf.conf.  However, I wonder if it
> might be useful to set up a redirect to something like this:
> 
> http://www.fresh.files2.serveftp.net/smtarpit/
> 
> I suppose it doesn't make a difference, but I do want to make it
> extremely painful for any spammers.   What are other people doing on
> this part?
I doubt this is of much use for a few reasons:

1) Many spammers don't bother with any result codes. They open a
connection and start spewing data.

2) Those who do look at result codes will quickly stop if this technique
becomes prevalent.

3) There is no way to distinguish between legitimate email and spam.
Anyone setting this up would have to be very careful about how they
present the email addresses for the tarpit to the net to make sure they
didn't got to legitimate email senders.

4) Many spammers use zombied machines on cable modems and the like to do
their dirty work. Gumming up those machines doesn't really mean much to
them; they'll just go find more.

If you want to setup a tarpit/honeypot, I think it would be much more
productive to run http://projecthoneypot.org.
-- 
Jim C. Nasby, Database Consultant               decibel@decibel.org 
Give your computer some brain candy! www.distributed.net Team #1828

Windows: "Where do you want to go today?"
Linux: "Where do you want to go tomorrow?"
FreeBSD: "Are you guys coming, or what?"

Forrest Aldrich <forrie@forrie.com> writes:
> I read about the spamd redirect in pf.conf.  
PF's spamd works rather well, but it will never be better than the
weakest data source.  spamd does greylisting as well, which I think is
possibly quite as useful as the tarpitting in stopping spam from
entering your system.  Then again, the tarpitting part is sometimes a
bit entertaining at least.

My take on this with some comments on our experience here can be found
at http://www.bgnett.no/~peter/pf/en/spamd.html, which is part of my pf
tutorial (starting at http://www.bgnett.no/~peter/pf/en/ or
http://www.bgnett.no/~peter/pf/no/ if your Norwegian is better than your
English)

-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/
"First, we kill all the spammers" The Usenet Bard,
"Twice-forwarded tales"