---
name: "grossd.conf"
section: "5"
platform: "linux"
package: "gross"
version: "1.0.2-4.1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/grossd.conf"
---

# grossd.conf(5)

Greylisting of Suspicious Sources daemon configuration file

## NAME

**grossd.conf** - Greylisting of Suspicious Sources daemon configuration file

## SYNOPSIS

*/etc/grossd.conf*

## DESCRIPTION

[*grossd*(8)](/grossd/8.md) reads configuration data from */etc/grossd.conf* (or the file specified with **-f** on the command line).  An example configuration file is installed by default.  You have to set some configuration options in order to get [*grossd*(8)](/grossd/8.md) running in  your environment.  The format is as follows:

   name = value \[ ; param \] ...

Not all options accept parameters -  refer to individual descriptions. The comment separator is  \`#', everything after it is ignored by the config file parser.

### Network configuration options

- **host**

  is the address the server should listen for queries.  Default is \`localhost'.

- **port**

  is the port the server should listen for queries.  Default is 5525.

- **sync\_listen**

  is the address to listen for communication with the peer.  It defaults to the **host** setting.

- **sync\_peer**

  is the address of the peer used when running in clustered mode.

- **sync\_port**

  is the tcp port number to listen to and connect to in communication with the peer.  Default is 5524.

- **status\_host**

  is the address [*grossd*(8)](/grossd/8.md) listens for status queries.  Default is \`localhost'.

- **status\_port**

  is the port number [*grossd*(8)](/grossd/8.md) listens for status queries.  Default is 5522.

- **protocol**

  activates the server protocols [*grossd*(8)](/grossd/8.md) will support.  Valid settings are  \`sjsms', \`postfix' and \`milter'.

- **milter\_listen**

  is the socket address for the Milter service.  The format is \`proto:port@host'.  Refer to Milter documentation for the specifics.

### Core server options

You can probably leave the default values for these settings.  If your daily mail flow exceeds millions of messages per day you may want to tweak  **query\_timelimit** and/or **pool\_maxthreads**.  If you run [*grossd*(8)](/grossd/8.md) in a server with limited memory you may want to adjust **filter\_bits**.

- **filter\_bits**

  is the size of the Bloom filter.  The size will be 2^**filter\_bits**. Lowering this value will increase the probability of false matches in each individual filter.  Default is 24.

- **number\_buffers**

  is the number of Bloom filters used in the ring queue.  Raising this value will cause an entry to stay in the server's memory longer.  Default is 8.

- **rotate\_interval**

  is the number of seconds between Bloom filter rotations.  Let **N := number\_buffers** and **I := rotate\_interval**. An entry will stay in the server's memory for **N - 0.5 \* I** seconds on average.  Defaults to 3600 seconds (one hour).

- **update**

  is the way server updates the database. Valid options are  \`grey' and \`always'.  If set to \`grey', which is the default, [*grossd*(8)](/grossd/8.md) will update the database only if the response is \`STATUS\_GREY'.  Setting it to \`always' may reduce the impact on DNS servers.

- **grey\_mask**

  is the mask for [*grossd*(8)](/grossd/8.md) to use when matching the  \`smtp-client-ip' against the database.  Default is 24, which makes [*grossd*(8)](/grossd/8.md) to treat addresses like *a.b.c.d* as *a.b.c.0*. Setting **grey\_mask** to 32 makes [*grossd*(8)](/grossd/8.md) to require that consecutive attempts are made from the same \`smtp-client-ip'.

- **statefile**

  is the full path of the file that the server uses to store the state information.  Default is not to have a statefile.  You may want to configure a **statefile** especially if you do not configure replication.

- **pidfile**

  is the full path of the file [*grossd*(8)](/grossd/8.md) writes its pid into. You can set parameter \`check', if you want to keep [*grossd*(8)](/grossd/8.md) from starting should pidfile already exist.

## Query constraints

- **grey\_delay**

  is the time in seconds new triplets are kept on the greylist.  Default is 180.

- **query\_timelimit**

  is the query timeout in milliseconds.  You may have to adjust this if you exceed millions of queries a day.

- **pool\_maxthreads**

  is the maximum threadcount per pool.  You may have to raise the limit from the default if you get more than 100 queries per second and/or have slow DNS servers.  The rule of thumb is to decide how many queries you want [*grossd*(8)](/grossd/8.md) to be able to handle per second, and multiply that with **query\_timelimit** (in seconds, of course).  It defaults to 100.

### Configuring server responses

- **block\_threshold**

  is the threshold after which [*grossd*(8)](/grossd/8.md) sends  a permanent error to the client.  Every check that considers \`smtp-client-ip' as suspicious returns a value (check weight).  When sum of these values gets equivalent or greater than **block\_threshold** [*grossd*(8)](/grossd/8.md) sends a STATUS\_BLOCK response.  Default is 0 which disables this functionality.

- **block\_reason**

  is the reason given when client is too suspicious, see **block\_threshold**.  Default is “Bad reputation”.

- **grey\_threshold**

  is analogous to **block\_threshold**, except at the threshold [*grossd*(8)](/grossd/8.md) sends a STATUS\_GREY response. Default is 1. If set to 0 [*grossd*(8)](/grossd/8.md) will greylist by default. This makes it possible to combine a traditional greylister and rbl checks.

- **grey\_reason**

  is the reason given when client is suspicious enough to be greylisted, see **grey\_threshold**.  Default is “Please try again later.”.

### Logging options

- **log\_method**

  is used to choose the logging method.  Currently the only implemented method is \`syslog', which is the default.

- **log\_level**

  sets the logging verbosity.  Possible values in the order of increasing verbosity are \`error', \`warning', \`notice', \`info' and \`debug'. **log\_level** defaults to \`info'.

- **syslog\_facility**

  is the facility syslog sends log messages with.  It defaults to \`mail'.

- **stat\_type**

  is the name of the requested statistic.  It is of multivalued type.  The valid options are:

  - \`full'

    log all possible statistics,

  - \`none'

    no statistics logging,

  - \`status'

    basic set of statistics,

  - \`since\_startup'

    basic set since the startup and

  - \`delay'

    log processing delay statistics.

Default is \`none'.  Setting both \`none' and \`full' is undefined.

- **stat\_interval**

  is the number of seconds between status log entries.  Default is 3600.

### Configuring checks

- **check**

  is a multivalued option, that is, you can configure multiple checks by setting **check** option multiple times.  Currently implemented checks are \`dnsbl', \`dnswl', \`rhsbl' and \`blocker'.   Refer to sections describing the checks below.  If you don't configure any checks [*grossd*(8)](/grossd/8.md) will act as a traditional greylisting server.

- **dnsbl**

  is a DNS domain name of the dnsbl that \`dnsbl' **check** will query.  There are no defaults, but the default configuration file lists a few as an example.  If you have any locally administered block lists then you should be aware that [*grossd*(8)](/grossd/8.md) makes all queries as fully qualified.  You may assign different weights for the dnsbls, default weight is 1.  Refer to **grey\_threshold** and **block\_threshold** about the weights. **dnsbl** is a multivalued option.

- **dnswl**

  is analogous to **dnsbl**.  Remember that **dnswl** is a *definitive* check, that is [*grossd*(8)](/grossd/8.md) waits for the check to complete before deciding how to respond.  This may cause unwanted latency, although you can adjust the maximum latency by **query\_timelimit** option.  **dnswl** is highly recommended if you use [*grossd*(8)](/grossd/8.md) as a traditional greylister.  This is a multivalued option.

- **rhsbl**

  is analogous to **dnsbl**, but the check is made with the right hand side of the sender address (the email domain) instead of the IP address.   This is a multivalued option.

- **blocker\_host**

  is the host name of the Sophos blocker server.  This is used only if **check** = \`blocker' is set.

- **blocker\_port**

  is the TCP port of the Sophos blocker service.  Default is 4466.

- **blocker\_weight**

  is the weight of the blocker check.  See description of **grey\_threshold** and **block\_threshold** regarding the weights.

### Sun Java System Messaging Server specific options

You may configure the responses [*grossd*(8)](/grossd/8.md) sends over to grosscheck library.

- **sjsms\_response\_grey**

  is the mapping result template [*grossd*(8)](/grossd/8.md) uses for a STATUS\_GREY result.  Default is \`$X4.4.3\|$N%reason%', where \`%reason%' is the template for the reason string.

- **sjsms\_response\_match**

  is the mapping result template [*grossd*(8)](/grossd/8.md) uses for a STATUS\_MATCH result.  Default is \`$Y'.

- **sjsms\_response\_trust**

  is the mapping result template [*grossd*(8)](/grossd/8.md) uses for a STATUS\_TRUST result.  Default is \`$Y'.

- **sjsms\_response\_block**

  is the mapping result template [*grossd*(8)](/grossd/8.md) uses for a STATUS\_BLOCK result.  Default is \`$N%reason%', where \`%reason%' is the template for the reason string.

### Postfix specific options

- **postfix\_response\_grey**

  is the response template [*grossd*(8)](/grossd/8.md) uses for a STATUS\_GREY result.  Default is \`action=defer\_if\_permit %reason%', where \`%reason' is the template for the reason string.

- **postfix\_response\_block**

  is the response template [*grossd*(8)](/grossd/8.md) uses for a STATUS\_BLOCK result.  Default is \`action=reject %reason%', where \`%reason' is the template for the reason string.

## MTA CONFIGURATION

### Sun Java System Messaging Server

You have to add a mapping entry to set **SJSMS** to query [*grossd*(8)](/grossd/8.md). It's also a good idea to exclude postmaster and abuse addresses before querying [*grossd*(8)](/grossd/8.md).

Here is an example:

  ORIG\_MAIL\_ACCESS

  ! allow all DSNs and MDNs\
     TCP\|\*\|\*\|\*\|\*\|\*\|\*\|tcp\_local\|\|\*\|\*  $Y$E\
   ! allow all incoming mail to postmaster and abuse\
     TCP\|\*\|\*\|\*\|\*\|\*\|\*\|tcp\_local\|\*\|\*\|postmaster@\*  $Y$E\
     TCP\|\*\|\*\|\*\|\*\|\*\|\*\|tcp\_local\|\*\|\*\|abuse@\*  $Y$E\
   ! use gross to check all triplets (client\_ip,sender,recipient)\
     TCP\|\*\|\*\|\*\|\*\|SMTP/\*\|\*\|tcp\_local\|\*\|\*\|\*  $\[/usr/lib/x86\_64-linux-gnu/grosscheck.so,grosscheck,10.10.13.1,10.10.13.2,5525,$2,$=$8$\_,$=$6$\_,$=$4$\_\]

Mapping call parameters are as follows:

- 1\. full path of the *grosscheck.so*

  - 2\. function name to call (always *grosscheck*)

  - 3\. first server's IP address,

  - 4\. second server's IP address,

  - 5\. UDP port for server connections,

  - 6\. SMTP client's IP address,

  - 7\. envelope sender's email address,

  - 8\. envelope recipient's email address,

  - 9\. HELO/EHLO string.

  ### Postfix

Grossd implements native Postfix policy delegation protocol. Just specify grossd server address at the \`smtpd\_recipient\_restrictions' in the main configuration file

main.cf :

  /etc/postfix/main.cf:\
       smtpd\_recipient\_restrictions =\
           ... \
           reject\_unauth\_destination \
           check\_policy\_service inet:host:port\
           ...

Refer to Postfix documentation at \<http://www.postfix.org\> for specifics.

### Exim

Exim can be configured to query [*grossd*(8)](/grossd/8.md) via Postfix policy delegation protocol.

Main section:

  GROSS\_QUERY = sender=$sender\_address\\\\n\\\\\
     recipient=$local\_part@$domain\\\\n\\\\\
     client\_address=$sender\_host\_address\\\\n\\\\\
     grossd\_mode=single\\\\n\\\\n

Acl section:

  \# gross\
   warn\
     set acl\_c0 = ${readsocket{inet:127.0.0.1:5525}{GROSS\_QUERY}}

  defer\
     message = Please try again later.\
     condition = ${if match {$acl\_c0}{action=defer\_if\_permit}}

  deny\
     message = ${if match {$acl\_c0}{action=reject (.\*)}{$1}\\\\\
       {Rejected by Gross.}}\
     condition = ${if match {$acl\_c0}{action=reject}}

### Sendmail

Sendmail can query grossd via milter protocol. Insert this in sendmail.mc and configure **milter\_listen** accordingly:

  INPUT\_MAIL\_FILTER(\`Gross', \`S=inet:5523@localhost, T=R:20s')

You can check if your version of Sendmail has Milter support compiled in by issuing the following command:

  sendmail -bt -d0.1

## SEE ALSO

[*grossd*(8)](/grossd/8.md)

Gross project site: \<http://code.google.com/p/gross/\>

Bloom filters: \<http://en.wikipedia.org/wiki/Bloom\_filter\>

## AUTHORS

Eino Tuominen and Antti Siira