dccd(8) Distributed Checksum Clearinghouse dccd(8)
dccd -- Distributed Checksum Clearinghouse Daemon
dccd [-64dVbfFQ] -i server-ID [-n brand] [-h homedir] -I [host-ID][,user]
[-a [server-addr][,server-port]] [-q qsize]
[-G [on,][weak-body,][weak-IP,][embargo][,window][,white]]
[-W [rate][,chg][,dbsize]] [-K [no-]type] [-T tracemode]
[-u anon-delay[*inflate]] [-C dbclean] [-L ltype,facility.level]
[-R [RL_SUB],[RL_ANON],[RL_ALL_ANON],[RL_BUGS]]
Dccd receives reports of checksums related to mail received by DCC
clients and queries about the total number of reports of particular
checksums. A DCC server never receives mail, address, headers, or other
information from clients, but only cryptographically secure checksums of
such information. A DCC server cannot determine the text or other infor-
mation that corresponds to the checksums it receives. It only acts as a
clearinghouse of total counts of checksums computed by clients.
Each DCC server or close cluster of DCC servers is identified by a
numeric server-ID. Each DCC client is identified by a client-ID, either
explicitly listed in the ids file or the special anonymous client-ID.
Many computers are expected to share a single client-ID. A server-ID is
less than 32768 while a client-ID is between 32768 and 16777215. DCC
server-IDs need be known only to DCC servers and the people running them.
The passwords associated with DCC server-IDs should be protected, because
DCC servers listen to commands authenticated with server-IDs and their
associated passwords. Each client that does not use the anonymous ID
must know the client-ID and password used by each of its servers. A sin-
gle client computer can use different passwords with different server
computers. See the ids file.
A whitelist of known good (or bad) sources of email prevents legitimate
mailing lists from being seen as unsolicited bulk email by DCC clients.
The whitelist used by a DCC server is built into the database when old
entries are removed by dbclean(8). Each DCC client has its own, local
whitelist, and in general, whitelists work better in DCC clients than
servers.
The effectiveness of a Distributed Checksum Clearinghouse increases as
the number of subscribers increases. Flooding reports of checksums among
DCC servers increases the effective number of subscribers to each server.
Each dccd daemon tries to maintain TCP/IP connections to the other
servers listed in the flod file, and send them reports containing check-
sums with total counts exceeding thresholds. Changes in the flod file
are noticed automatically within minutes.
Controls on report flooding are specified in the flod file. Each line
specifies a hostname and port number to which reports should be flooded,
a server-ID to identify and authenticate the output stream, a server-ID
to identify and authenticate an input stream from the same server, and
flags with each ID. The ability to delete reports of checksums is handy,
but could be abused. If del is not present among the in-opts options for
the incoming ID, incoming delete requests are logged and then ignored.
Floods from DCC "brands" that count only mail to "spam traps" and whose
servers use the -Q option to count extremely "bulk" mail should be marked
with traps. They can be seen as counting millions of targets, so the
traps flag on their flod file entry changes their incoming flooded
reports counts to "many."
Dccd automatically checks its flod and ids files periodically. Cdcc(8)
has the server commands new ids and flood check to tell dccd to check
those two files immediately. Both files are also checked for changes in
response to the SIGHUP signal.
OPTIONS
The following options are available:
-6 enable IPv6. The default is equivalent to -4. See also the IPv4
and IPv6 options in the flod file description below and the IPv6 on
cdcc(8) command.
-4 disable IPv6. See also -6.
-d enables debugging output. Additional -d options increase the number
of messages.
-V displays the version of the DCC server daemon.
-b causes the server to not detach itself from the controlling tty or
put itself into the background.
-F uses write() instead of mmap() in some cases to modify the DCC data-
base. It is the default on Solaris.
-f turns off -F.
-Q causes the server to treat reports of checksums as queries except
from DCC clients marked trusted in the ids file with rpt-ok. See -u
to turn off access by anonymous or unauthenticated clients
-i server-ID
specifies the ID of this DCC server. Each server identifies itself
as responsible for checksums that it forwards to other servers.
-n brand
is an arbitrary string of letters and numbers that identifies the
organization running the DCC server. The brand is required, and
appears in the SMTP X-DCC headers generated by the DCC.
-h homedir
overrides the default DCC home directory, which is often /var/dcc.
-I [host-ID][,user]
changes the server's globally unique identity for flooding from the
default value consisting of the first 16 characters of the host
name. or changes the UID and GID of the process Host-ID is a string
of up to 16 characters that replaces the first 16 characters of the
system's hostname in assertions of the server-ID that are flooded to
peers. User must be valid user name.
-a [server-addr][,server-port]
adds an hostname or IP address to the list of local IP addresses
that the server answers. Multiple -a options can be used to specify
a subset of the available network interfaces or to use more than one
port number. The default is to listen on all local IP addresses.
It can be useful to list some or all of the IP addresses of multi-
homed hosts to deal with local or remote firewalls. By default
server-port is 6277 for DCC servers and 6276 for Greylist servers.
It is the UDP port at which DCC requests are received and the TCP
port for incoming floods of reports.
If server-addr is absent and if the getifaddrs(8) function is sup-
ported, separate UDP sockets are bound to each configured network
interface so that each DCC clients receives replies from the IP
addresses to which corresponding request are sent. If dccd is
started before all network interfaces are turned on or there are
interfaces that are turned on and off or change their addresses such
as PPP interfaces, then the special string @ should be used to tell
dccd to bind to an IN_ADDRANY UDP socket.
Outgoing TCP connections to flood checksum reports to other DCC
servers used the IP address of a single -a option, but only if there
is single option that is not localhost. See also the flod file.
-q qsize
specifies the maximum size of the queue of requests from anonymous
or unauthenticated clients. The default value is the maximum DCC
RTT in seconds times 200 or 1000.
-G [on,][weak-body,][weak-IP,][embargo][,window][,white]
changes dccd to a Greylist server for dccm(8) or dccifd(8).
Greylisting consists of temporarily rejecting or embargoing mail
from unfamiliar combinations of SMTP client IP address, SMTP enve-
lope sender, and SMTP envelope recipient. If the SMTP client per-
sists for embargo seconds and so is probably not an "open proxy,"
worm-infected personal computer, or other transient source of spam,
the triple of (IP address,sender,recipient) is added to a database
similar to the usual DCC database. If the SMTP client does not try
again after embargo seconds and before window seconds after the
first attempt, the triple is forgotten. If the SMTP client persists
past the embargo, the triple is added to the database and becomes
familiar and the message is accepted. Familiar triples are remem-
bered for white seconds after the last accepted mail message. The
triple is forgotten if it is ever associated with unsolicited bulk
email.
All three durations can be a number of minutes, hours, days, or
weeks followed by MINUTES, M, HOURS, H, DAYS, D, WEEKS or W. The
default is -G 270seconds,7days,63days. The first duration or the
embargo should be longer than open proxies can linger retransmit-
ting. The second window time should be as long as legitimate mail
servers persist in retransmitting to recognize embargoed messages
whose retransmissions were not received because of network or other
problems. The white time should be long enough to recognize and not
embargo messages from regular senders.
Usually the DCC greylist system requires that an almost identical
copy of the message be retransmitted during the embargo. If
weak-body is present, any message with the same triple of sender IP
address, sender mail address, and target mail address ends the
embargo, even if the body of the message differs.
If weak-IP is present, all mail from an SMTP client at an IP address
is accept after any message from the same IP address has been
accepted.
Unlike DCC checksums, the contents of greylist databases are private
and do not benefit from broad sharing. However, large installations
can use more two or more greylist servers flooding triples among
themselves. Flooding among greylist servers is controlled by the
grey_flod file.
All greylist cooperating or flooding greylist servers must use the
same -G values.
Clients of greylist servers cannot be anonymous and must have
client-IDs and passwords assigned in the ids file. This implies
that cdcc commands directed to greylist servers must specify the
server-ID.
White- and blacklists are honored by the DCC clients. White-listed
messages are embargoed or checked with a greylist server. The
greylist triples of blacklisted messages, messages whose DCC counts
make them spam, and other messages known to be spam are sent to a
greylist server to be removed from the greylist database and cause
an embargo on the next messages with those triples.
Messages whose checksums match greylist server whitelists are not
embargoed and the checksums of their triples are not added to the
greylist database.
The target counts of embargoed messages are reported to the DCC net-
work to improve the detection of bulk mail.
-W [rate][,chg][,dbsize]
controls quick database cleaning. If the database is larger than
dbsize, it seems that the database has not recently and is not about
to be cleaned, dccd is receiving fewer than rate requests per sec-
ond, and if telling DCC clients that the database is about to be
cleaned reduces that rate by chg%, then dccd starts dbclean(8) for a
quick database cleaning. The cleaning is abandoned if it takes too
long. The default values are equivalent to -W 1.0,40.0,RSS where
RSS is the maximum dccd resident set displayed the system log by -d
when starts.
-K [no-]type
marks checksums of type (not) be "kept" or counted in the database
unless they appear in the whitelist. Explicit settings add to or
remove from the initial contents of the list, which is equivalent to
-K Body -K Fuz1 -K Fuz2.
-T tracemode
causes the server to trace or record some operations. tracemode
must be one of the following:
ADMN administrative requests from the control program, cdcc(8)
ANON errors by anonymous clients
CLNT errors by authenticated clients
RLIM rate-limited messages
QUERY all queries and reports
RIDC some messages concerning the report-ID cache that is used
to detect duplicate reports from clients
FLOOD messages about inter-server flooding connections
FLOOD2 messages about flooded reports
IDS unknown server-IDs in flooded reports
BL requests from clients with IP addresses in the blacklist
file.
The default is ANON CLNT.
-u anon-delay[*inflate]
changes the number of milliseconds anonymous or unauthenticated
clients must wait for answers to their queries and reports. The
purpose of this delay is to discourage large anonymous clients. The
anon-delay is multiplied by 1 plus the number of recent anonymous
requests from an IP address divided by the inflate value.
The string FOREVER turns off all anonymous or unauthenticated access
not only for checksum queries and reports but also cdcc(8) stats
requests. A missing value for inflate turns off inflation.
The default value is 50,none, except when -G is used in which case
FOREVER is assumed and required.
-C dbclean
changes the default name or path of the program used to rebuild the
hash table when it becomes too full. The default value is
libexec/dbclean with the libexec directory specified when the soft-
ware was built and installed.. The value can include arguments as
in -C '$DCC_LIBEXEC/dbclean -F'.
Dbclean should not be run by dccd except in emergencies such as
database corruption or hash table overflow. Dbclean(8) should be
run daily with the /var/dcc/libexec/cron-dccd cron script
-L ltype,facility.level
specifies how messages should be logged. Ltype must be error or
info to indicate which of the two types of messages are being con-
trolled. Level must be a syslog(3) level among EMERG, ALERT, CRIT,
ERR, WARNING, NOTICE, INFO, and DEBUG. Facility must be among AUTH,
AUTHPRIV, CRON, DAEMON, FTP, KERN, LPR, MAIL, NEWS, USER, UUCP, and
LOCAL0 through LOCAL7. The default is equivalent to
-L info,MAIL.NOTICE -L error,MAIL.ERR
-R [RL_SUB],[RL_ANON],[RL_ALL_ANON],[RL_BUGS]
sets one or more of the four rate-limits. RL_SUB limits the number
of DCC transactions per second from subscribers or DCC clients with
known client-IDs and passwords. This limit applies to each IP
address independently.
RL_ANON limits the number of DCC transactions per second from anony-
mous DCC clients. This limit applies to each IP address indepen-
dently. It is better to use -u than to change this value to exclude
anonymous clients.
RL_ALL_ANON limits the number of DCC transactions per second from
all anonymous DCC clients. This limit applies to all anonymous
clients as a group, regardless of their IP addresses.
RL_BUGS limits the number of complaints or error messages per second
for all anonymous DCC clients as a group as well as for each DCC
client by IP address.
The default is equivalent to -R 400,50,600,0.1
/var/dcc is the DCC home directory containing data and control files.
dcc_db is the database of mail checksums.
dcc_db.hash is the mail checksum database hash table.
grey_db is the database of greylist checksums.
grey_db.hash is the greylist database hash table.
flod contains lines controlling DCC flooding of the form:
host[,rport][;src[,lport]] rem-ID [passwd-ID [o-opt [i-opt]]]
where absent optional values are signaled with "-" and
host is the IP address or name of a DCC server and rport is
the name or number of the TCP port used by the remote
server.
src and lport are the IP address or host name and TCP port
from which the outgoing flooding connection should come.
Incoming flooding connections must arrive at an address
and port specified with -a.
rem-id is the server-ID of the remote DCC server.
passwd-ID is a server-ID that is not assigned to a server, but
whose first password is used to sign checksum reports sent
to the remote system. Either of its passwords are
required with incoming reports. If it is absent or "-",
outgoing floods are signed with the first password of the
local server in the ids file and incoming floods must be
signed with either password of the remote server-ID.
i-opt and o-opt are comma separated lists of
off turns off flooding to the remote or local system.
traps indicates that the remote sending or local receiv-
ing system has only "spam traps."
no-del says checksum delete requests are refused by the
remote or local server and so turns off sending or
accepting delete requests, respectively. By default,
delete requests are sent to remote servers and
accepted in incoming floods if and only if the peers
are exchanging DCC reputations.
del says delete requests are accepted by the remote or
local server.
no-log-del turns off logging of incoming requests to
delete checksums.
passive is used to tell a server outside a firewall to
expect a peer inside to create both of the pair of
input and output TCP connections used for flooding.
The peer inside the firewall should use SOCKS or NAT
on its flod file entry for this system.
SOCKS is used to tell a server inside a firewall that it
should create both of the TCP connections used for
flooding and that SOCKS protocol should be used. The
peer outside the firewall should use passive on its
flod file entry for this system.
NAT differs from SOCKS only by not using the SOCKS proto-
col.
ID1->ID2 converts server-ID ID1 in flooded reports to
server-ID ID2. Either ID1 or ID2 may be the string
`self' to specify the server's own ID. ID1 can be
the string `all' to specify all server-IDs or a pair
of server-IDs separated by a dash to specify an
inclusive range. ID2 can be the string `ok' to send
or receive reports without translation or the string
`reject' to not send outgoing or refuse incoming
reports. Only the first matching conversion is
applied. For example, when `self->ok,all->reject' is
applied to a locally generated report, the first con-
version is applied and the second is ignored.
leaf=path-len does not send reports with paths longer
than path-len server-IDs.
IPv4 overrides a -6 setting for this flooding peer.
IPv6 overrides the default or an explicit -4 setting.
vers specifies the version of the DCC flooding protocol
used by the remote DCC server with a string such as
`version2'.
trace sends information about a single peer like the
cdcc(8) command trace FLOOD on does for all peers.
trace2 sends information about individual flooded reports
like the cdcc(8) command trace FLOOD2 on does for all
peers.
grey_flod is the equivalent of flod used by dccd when it is a greylist
server.
flod.map is an automatically generated file in which dccd records its
progress sending or flooding reports to DCC peers.
grey_flod.map is the equivalent of flod.map used by dccd when it is a
greylist server.
ids contains the IDs and passwords known by the DCC server. An ids
file that can be read by others cannot be used. It contains
blank lines, comments starting with "#" and lines of the form:
id[,rpt-ok][,delay=ms[*inflate]] passwd1 [passwd2]
where
id is a DCC client-ID or server-ID.
Rpt-ok if present overrides -Q by saying that this client is
trusted to report only checksums for unsolicited bulk
mail.
delay=ms[*inflate] delays answers to systems using the client
id. The delay in milliseconds is multiplied by 1 plus the
number of recent requests from an IP address using id
divided by the inflate value. See -U.
passwd1 is the password currently used by clients with identi-
fier id. It is a 1 to 32 character string that does not
contain blank, tab, newline or carriage return characters.
passwd2 is the optional next password that those clients will
use. A DCC server accepts either password if both are
present in the file.
Both passwords can be absent if the entry not used except to
tell dccd that server-IDs in the flooded reports are valid.
The string unknown is equivalent to the null string.
whitelist contains the DCC server whitelist. It is not used directly but
is loaded into the database when dbclean(8) is run.
grey_whitelist contains the greylist server whitelist. It is not used
directly but is loaded into the database when dbclean(8) is run
with -G.
blacklist if present, contains a list of IP addresses and blocks of IP
addresses DCC clients that are ignored. Each line in the file
should be blank, a comment starting with '#', or an IP address
or block of IP addresses in the form
[trace,] [ok,] [bad] xxx.xxx.xxx.xxx[/yy]
Changes to the file are automatically noticed and acted upon
within a few minutes. Addresses or blocks of addresses can be
preceded with ok to "punch holes" in blacklisted blocks or with
trace to log activity. This mechanism is intended for no more
than a few dozen blocks of addresses.
dccd_clients contains client IP addresses and activity counts.
grey_clients contains greylist client IP addresses and activity counts.
dccd is usually started with other system daemons with something like the
script misc/start-dccd. It uses values in the file dcc_conf in the DCC
home directory to start the server.
The following is useful for cleanly stopping the daemon:
cdcc 'id 100; stop'
The ID of the local server must be used instead of "100."
Unless old reports are removed from the database, it grows too large.
dbclean(8) should be run daily with the /var/dcc/libexec/cron-dccd cron
script
cdcc(8), dcc(8), dbclean(8), dblist(8), dccifd(8), dccm(8), dccproc(8).
dccsight(8),
dccd is based on an idea from Paul Vixie. It was designed and written at
Rhyolite Software, starting in 2000. This document describes version
1.3.90.
April 21, 2008
Man(1) output converted with
man2html
modified for the DCC $Date 2001/04/29 03:22:18 $