smtp.ufl.edu Augmentation Project Stephen L. Ulmer CIS4914 April 13, 2004

Project Summary ● is critical to University workflow ● smtp.ufl.edu is not currently adequate – No UBE (aka SPAM) protection – Service performance is poor – Allows "dangerous" content ● System re-architecture would improve situation

Sources and References Allman, E., G. Shapiro, C. Assman. Sendmail Installation and Operation Guide,Sendmail Inc. and its Suppliers v , (2003) Skoll, David. The MIMEDefang Community Web Site, Roaring Pengin Software (as-of 01 Oct 2003) Misc. The SpamAssassin Wiki, The Internet Community (as-of 12 Jan 2004) Ulmer, S., “SMTP Relay Augmentation Project Charter”, UF CNS (2004)

Work Performed ● Produced detailed Project Plan, approved by CNS Director ● Secured funding – About $70,000 (including staff time) – From multiple sources ● Acquired support from ITAC-ISM

Work Performed ● Built Gentoo Linux cluster to run filtering software – First production Linux cluster at CNS – Significant investment in start-up time ● Existing cluster/installation tools were AIX-centric ● Extension to system management paradigm required – Built with free software, except: ● McAfee Virus Scanner (UF site license) ● IBM's Network Dispatcher (CNS already licensed)

Work Performed ● Separated the filtering engines from the SMTP servers – Allows independent horizontal scaling of major components – Separates low-latency workload from high- throughput workload

New System Architecture ● 3 separate server groups ● All server groups load-balanced

Filtering Engine Components ● MIMEDefang acts as a “framework” ● Other components are used like DLLs ● SpamAssassin uses many different tests

Capacity-Related Errors ● Reduced rate of “ Try again later” ● Reduced average error rate from over 200/minute to less than 1/minute ● Remaining errors caused by remote servers

Message Transfer Rate ● Previous maximum: 300/minute ● Current minimum: 300/minute ● Recent peak: 1400/minute ● Reserve capacity still plentiful

Future Directions ● Actually block SPAM – Block incoming SPAM at a very high confidence – Block all locally generated SPAM ● Use a multi-vendor virus scanning solution ● Commercial SPAM dectection software?