NAME

       grossd - Greylisting of Suspicious Sources - the Server

SYNOPSIS

       grossd [-dCDhnrV] [-f config] [{-p|-P} pidfile]

DESCRIPTION

       grossd is a greylisting server, and more.  It's blazingly fast and amazingly resource
       efficient.  It can be configured to query DNSBL databases, and enforce greylisting only
       for hosts that are found on those databases.  It can block hosts that match multiple
       databases.  It can be replicated and run parallel on two servers.  It supports Sun Java
       System Messaging Server, Postfix and Exim.  Sendmail Milter implementation needs testing.

   Theory of operation
       Gross consists of grossd, the greylisting daemon, and a client library for SJSMS.  The
       server also implements Postfix content filtering protocol.

       Upon receiving a request from a client, grossd first validates it.  The request includes a
       triplet (`smtp-client-ip', `sender-address', `recipient-address').  A hash is then
       calculated and matched against the Bloom filters.  If a match is found, and test result
       does not exceed block_threshold value, grossd sends an OK (STATUS_TRUST) message.

       If the triplet is not in the Bloom filters (has not been seen recently,) grossd then runs
       configured checks against the client information.  Based on check results grossd returns
       the client a result.  Possible results are STATUS_TRUST, STATUS_BLOCK and STATUS_GREY.
       The final response is query protocol specific.

       The Bloom filters are updated according the update configuration option.  A Bloom filter
       is a very efficient way to store data.  It's a probabilistic data structure, which means
       that there is a possibility of error when querying the database.  False positives are
       possible, but false negatives are not.  This means that there is a possibility that grossd
       will falsely give an STATUS_TRUST response when a connection should be greylisted.  By
       sizing the bloom filters, you can control the error possibility to meet your needs.  The
       right bloom filter size depends on the number of entries in the database, that is, the
       retention time versus the number of handled connections.

OPTIONS

       -C  Create the statefile and exit.  The statefile configuration option must be specified
           in the configuration file.

       -D  Make debugging output more verbose.  It can be set twice for maximum verbosity.

       -d  Run grossd on foreground without daemonizing the process.  grossd will output to
           terminal instead of using syslog.

       -f config
           Specifies the name of the configuration file.  The default is /etc/etc/grossd.conf

       -h  Output short usage information and exit.

       -n  Enable dry-run.

       -P pidfile
           Bail out if the pidfile already exists.  Create pidfile after the check.

       -p pidfile
           Create the pidfile.  Overwrite if it already exists.

       -r  Disable replication.

       -V  Output version information and exit.

FILES

       /etc/grossd.conf

SECURITY CONSIDERATIONS

       Run grossd under some unprivileged user id.  If started as root grossd will setuid()
       itself to nobody's user id.  There are no known security flaws but you must not expose
       grossd to the Internet.  It could be used for a DoS against a domain's DNS servers by an
       attacker as there is no authentication in grossd.

DIAGNOSTICS

       grossd daemon exits 0 if success, and >0 if an error occurs.

SEE ALSO

       Regarding the configuration both the daemon and MTA's, refer to grossd.conf(5)

       Gross project site: <http://code.google.com/p/gross/>

       Bloom filters: <http://en.wikipedia.org/wiki/Bloom_filter>

       DNS queries are done asynchronously using c-ares library
       <http://daniel.haxx.se/projects/c-ares/>.

AUTHORS

       Eino Tuominen and Antti Siira

                                            2008-05-04                                  grossd(8)