Rspamd: [QnA] spamtrap reject message

[philfry]

Classification (Please choose one option):

• [ ] Crash/Hang/Data loss
• [ ] WebUI/Usability
• [ ] Serious bug
• [x] Other bug
• [ ] Feature
• [x] Enhancement

Reproducibility (Please choose one option):

• [X] Always
• [ ] Sometimes
• [ ] Rarely
• [ ] Unable
• [ ] I didn’t try
• [ ] Not applicable

Rspamd version:

1.6.5

Operation system, CPU, memory and environment:

n/a

Description (Please provide a descriptive summary of the issue):

When getting greylisted for sending an email to a spamtrap the reject message is a little too verbose by exposing the fact that the recipient address actually is a spamtrap. Blackhats would remove the spamtrap addresses asap from their lists.

Compile errors (if any):

Steps to reproduce:

1. send an email to a spamtrap
2. get greylisted
3. watch the reject message

Expected results:

451 4.7.1 greylisted for some reason

Actual results:

451 4.7.1 spamtrap found: <[email protected]>

Debugging information (see details here):

Configuration:

# local.d/spamtrap.conf
action = "add header";
score = 1.0;
learn_fuzzy = true;
learn_spam = true;
map = file://$LOCAL_CONFDIR/maps.d/spamtrap.map;
enabled = true;

# rspamd.conf.local
settings_redis {                                                                           
    handlers = {                                                                           
        SPAMTRAP = <<EOD                     
return function(task)                        
  local rcpt = task:get_recipients('smtp')   
  if not (rcpt and #rcpt == 1) then          
    return                                   
  end                                        
  return 'sptr_' .. rcpt[1]['addr']:lower()  
end
EOD;
        SPAMTRAP_DOMAIN = <<EOD
return function(task)
 local rcpt = task:get_recipients('smtp')
 if not (rcpt and #rcpt == 1) then
   return
 end
 return 'sptr_' .. '@' .. rcpt[1]['domain']:lower()
end
EOD;
    }
}



md5-73e84349acd88abee7a4cf735c05dc51



redis /run/redis/redis.sock[2]> get [email protected]
"{ groups_disabled = [\"rbl\", \"antivirus\", \"dkim\", \"spf\", \"dmarc\"]; }"

Additional information:

[croessner]

I have removed greylisting for spamtrapped emails in the redis db. You do not need to greylist and with this workaround, no messages concerning spamtrap are returned

[croessner]

redis-cli SET
"sptr_$name"
'{ groups_disabled = ["rbl", "antivirus", "dkim", "spf", "dmarc"], symbols_disabled = ["GREYLIST_CHECK", "GREYLIST_SAVE"]; }'

[philfry]

nice workaround, thanks a lot 😃

yet it might be not the worst idea to hide "gee, you just emailed a spamtrap" return messages, what do you think?

[vstakhov]

Yes, that's totally stupid.