SPAM and VIRUS UPDATE


This is an overview of our strategy for handling unwanted email within ECE. There is no complete central solution to the spam problem. The central mail server can do a good job of removing viruses, bouncing e-mail from known spam servers, and filtering mailing lists but only the end user knows what kind of mail they don't like, or whether they know a certain mail sender. There has to be a combination of automatic server filtering and user controlled filtering to control viruses and spam.

The ECE mail servers are running several filters on incoming e-mail. The mail filtering statistics can be monitored on the following ECE mail servers.

Mailserver Statitistics: EECG   CONTROL   COMM   UGSPARCS

The following is brief outline of the major filter methods.


RBL lists

RBL (Realtime Blackhole List) is a way of identifying hosts that are associated with the sending of spam e-mail. A typical blacklist host would be a mail server that gives any internet user the permission to relay e-mail without any restrictions.

The department mail servers have access to a commercial RBL site and a hand tuned list supported by the ECF computer facility. An e-mail message recieved from a mail server on the list will be bounced back with the reason for the bounce.

Labelled as "spam", shown in on the graphs.


Virus filter

The Clam Anit-Virus (ClamAV) anti-virus solution is used on the servers to filter out viruses, trojans, worms and other attack agents that have a well defined signature. The e-mail caught containing these well defined signatures are quarantined at the server or deleted. Shown in on the graphs.


Mailing List filters

In-house filtering tools are used for reducing the number of spam e-mailed to department mail lists.

Labelled as "spam", shown in on the graphs.


User spam filters

The users of the ECE mail servers can run a spam filter program such as "SpamAssassin" to perform their personal spam filtering. "SpamAssassin" will tag e-mail as to its likelihood of being spam. The end user can tune "SpamAssassin" to be very aggressive in removing spam or use the default setup. The end user can also "teach" programs like "SpamAssassin" to recognize e-mail they consider spam.

Labelled as "spam", shown in on the graphs. At this time not all "spam" caught with personal spam filtering programs can be logged by the system and included in the graphs.

Contact "ecehelp AT ece.utoronto.ca" if you would like details on how to use "SpamAssassin" on your research account.


Summary

For the near future, the management of spam and viruses is a disagreeable task for the system admins and users. The system admins will be constantly improving the filtering tools but the target is constantly transforming.

Some general statistics on the filtering:

RBL and ECF list filtering: 11,850 messages bounced per day

Mail Alias filtering: 35 messages to a list dropped per day

ClamAv filtering: 330 virus messages dropped per day

SpamAssassin filtering: 17,150 messages directed to spam folders per day

Received: 8,360 messages accepted for delivery to our users per day

There will be a web page setup soon with more e-mail statistics.