Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a system here in which several accounts get a ton of SPAM and spamd (SpamAssassin) is constantly using a ton of memory. Our machine is used for both our website and our email. Our LAMP based website gets a lot of traffic, so when the server slows down due to email scanning it's frustrating. To keep costs low, it's not a real beefy machine either, Pentium D 925 3.4GHz with 3GB of RAM.

Upon inspection, there is one main offender receiving 10,000 SPAM emails per week and a couple of others receiving about 2000. The rest of the addresses receive none.

Since the bulk of the SPAM is being received by one account, do you think it is worth while to change that person's email address? And by the same extent, the others. This is what seems to be the best/easiest/cost-effective solution to me. They don't want to do this, but I have to figure out what's best for our whole system. I know SpamAssassin will still use resources to scan emails, but next highest person (who doesn't receive any spam) is getting about 500 emails per week, so the volume is reduced by up to 20-fold. The offending account is such a stark contrast to all the other accounts, and the server is using a lot of resources, constantly scanning their emails, which are all (99%) junk anyway.

Any thoughts would be greatly appreciated. Thank you.

share|improve this question
add comment

4 Answers

up vote 3 down vote accepted

Are you doing any RBL checks at SMTP time? In my experience, those catch 90% of spam, and it's much easier on the system to do an RBL check during the SMTP transaction (and then reject the mail) rather than having to accept the message and then make the system scan/parse the email through spamassassin.

RBL checks are fairly simple to set up with most MTAs.

share|improve this answer
    
I've inherited this system, so checking now, it looks like Exim is denying from Spamhaus, Spamcop, SORBS, CBL, NJABL –  user955664 Feb 13 '12 at 15:17
    
It surprises me you would see this kind of problem with that long list set-up. Maybe spend a minute verifying that they are A) all still valid and B) the behaviour when a match is found on a list. –  SuperBOB Feb 13 '12 at 15:56
    
Ya, it surprised me too. Looks like the Exim reject log is only rejecting addresses that don't exist. There must be another setting in Exim that isn't enabled. –  user955664 Feb 13 '12 at 16:00
    
Our domain wasn't in the use_rbl_domains file for Exim. I've now added it and am seeing rejections via RBLs. Hopefully this helps some while I address the resource issue. –  user955664 Feb 13 '12 at 16:25
    
Should make a big difference I hope –  SuperBOB Feb 14 '12 at 11:31
show 1 more comment

Generally, I'd stay away from changing a person's email. If that person receives important information and their communication is critical to the business, changing an email address can be very troublesome and problematic.

So if we're not changing the email addresses, there are a couple options with different price points:

  1. Increase the memory in the server. This is perhaps the cheapest method, and probably the easiest too. For less than a few hundred dollars you should be able to at least double the memory on the system.
  2. Move the spam filter/email server to a different machine. If your webserver gets significant traffic and is critical to your business, it should be on it's own machine, not sharing resources with other services. In the spirit of "you have to spend money to make money", your company should understand that investment in the money-making parts of your technology, at the very least, should be a bit of a priority. It doesn't have to cost a lot. It should just be by itself and cared for as a valuable entity in your business.
  3. Invest in a gateway filtering solution. Either sign up for a hosted email service that handles all your spam for you, or get an appliance (like Barracuda or similar) that'll do it for you on-site. The hosted solution will probably be cheaper if you're a small organization.

All these suggestions are moot, though, if the account receiving the extreme levels of spam is for the janitor. If this person's outside communication is not critical to the functioning of the business, they can be issued a new email address relatively easily.

UPDATE 1 I knew I forgot something in this answer. Thanks Aaron for reminding me.

If you give the user a new email address, it is critical that you include training and education in your deployment process. Work email is not to be used as personal email. Gmail, Yahoo, Hotmail, and a plethora of others all offer personal email accounts for free with few limitations or requirements. If the user feels they can sign up for deals and specials and mailing lists using their work account, they need to be informed this is not OK behavior. In fact, using this example of how their poor decisions, even in something as seemingly innocuous as using their work email account to sign up for email lists, cost their company real money and resources, can be a very good teaching tool.

After all, it would really suck to be fired because your email account crashed the mail server which brought down the company website which lost the company critical and profitable business, all because you used your work email to sign up for 300 Cute Kitten Pix listservs. Even I'm having trouble seeing how I'd phrase that on my CV.

share|improve this answer
    
+1 for not running from the problem. These users will continue to use their new e-mail address on Cragslist, etc. The new account will likely have the same problem within 4-6 months. –  Aaron Copley Feb 13 '12 at 16:04
    
True. This address was posted on the company website when I got here, so had years of harvesting. I agree, that the user can be contributing to the problem also, but I know some of it is due to it being harvested from our own site prior to my arrival. –  user955664 Feb 13 '12 at 16:21
    
Got it. Thanks for the info. Is the email address still on the website or used for external contact? –  music2myear Feb 13 '12 at 16:24
    
I removed all addresses from the website when I was hired. I don't believe it is posted like that anywhere else, although, I'd have to check with the user to be sure. –  user955664 Feb 13 '12 at 17:18
1  
Both ErikA and music2myear's answers have helped me. We are exploring all our options now. ErikA's answer pointed out an oversite related to my question and music2myear's answer proposes things to do moving forward. I wish I could split the check as I feel equally helped by both answers. Because I feel equally helped by both, I am going to flip a coin for the check mark. –  user955664 Feb 15 '12 at 14:00
show 1 more comment

I'm not sure of your exact setup here, so I will have to assume some things in my answer.

Have you considered off-loading the spam to an internet email account?

I personally use Gmail to filter my spam from a POP account that receives tons of spam. I simply linked my POP3 account to my Gmail account and their spam filter does it all for me. I guess in your situation, you could create a gmail account for each user.

This is of course assuming the email accounts in question can be accessed by IMAP or POP.

share|improve this answer
    
Ok, just realised that this is a business website and the accounts in question seem to be customer accounts. So ignore my answer. –  Harvy Feb 13 '12 at 16:30
add comment

Consider trying something that will deal with the load better, such as setting up Haraka (with strong filtering in place - not just the default config) in front of Exim to deal with your spam load, and then Exim can just deal with non-spam. This sort of change can make a surprising amount of difference (one large user I can't publicly name yet has seen a 4x reduction in CPU load by doing this).

Disclaimer: I wrote Haraka. But I'm happy to answer questions about it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.