1. smtp.ufl.edu Augmentation Project Stephen L. Ulmer CIS4914 April 13, 2004

2. Project Summary ● Email is critical to University workflow ● smtp.ufl.edu is not currently adequate – No UBE (aka SPAM) protection – Service performance is poor – Allows "dangerous" content ● System re-architecture would improve situation

3. Sources and References Allman, E., G. Shapiro, C. Assman. Sendmail Installation and Operation Guide,Sendmail Inc. and its Suppliers v. 8.609.2.23, (2003) Skoll, David. The MIMEDefang Community Web Site, http://www.mimedefang.org/, Roaring Pengin Software (as-of 01 Oct 2003) http://www.mimedefang.org/ Misc. The SpamAssassin Wiki, http://news.spamassassin.org/, The Internet Community (as-of 12 Jan 2004)http://news.spamassassin.org/ Ulmer, S., “SMTP Relay Augmentation Project Charter”, UF CNS (2004)

4. Work Performed ● Produced detailed Project Plan, approved by CNS Director ● Secured funding – About $70,000 (including staff time) – From multiple sources ● Acquired support from ITAC-ISM

5. Work Performed ● Built Gentoo Linux cluster to run filtering software – First production Linux cluster at CNS – Significant investment in start-up time ● Existing cluster/installation tools were AIX-centric ● Extension to system management paradigm required – Built with free software, except: ● McAfee Virus Scanner (UF site license) ● IBM's Network Dispatcher (CNS already licensed)

6. Work Performed ● Separated the filtering engines from the SMTP servers – Allows independent horizontal scaling of major components – Separates low-latency workload from high- throughput workload

7. New System Architecture ● 3 separate server groups ● All server groups load-balanced

8. Filtering Engine Components ● MIMEDefang acts as a “framework” ● Other components are used like DLLs ● SpamAssassin uses many different tests

9. Capacity-Related Errors ● Reduced rate of “451 4.7.1 Try again later” ● Reduced average error rate from over 200/minute to less than 1/minute ● Remaining errors caused by remote servers

10. Message Transfer Rate ● Previous maximum: 300/minute ● Current minimum: 300/minute ● Recent peak: 1400/minute ● Reserve capacity still plentiful

11. Future Directions ● Actually block SPAM – Block incoming SPAM at a very high confidence – Block all locally generated SPAM ● Use a multi-vendor virus scanning solution ● Commercial SPAM dectection software?