Mercurial > dnsbl
annotate xml/dnsbl.in @ 158:ca4f178f9064
add auto whitelisting
author | carl |
---|---|
date | Sun, 08 Jul 2007 09:57:49 -0700 |
parents | dcfa43a59ec8 |
children | b3ed72ee6564 |
rev | line source |
---|---|
108 | 1 <reference> |
2 <title>@PACKAGE@ Sendmail milter - Version @VERSION@</title> | |
3 <partintro> | |
4 <title>Packages</title> | |
5 <para>The various source and binary packages are available at <ulink | |
114
f4f5fb263072
cleanup list of tlds, add trailing / on http package directory reference
carl
parents:
111
diff
changeset
|
6 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink> |
108 | 7 The most recent documentation is available at <ulink |
8 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink> | |
9 </para> | |
94 | 10 |
108 | 11 </partintro> |
94 | 12 |
108 | 13 <refentry id="@PACKAGE@.1"> |
14 <refentryinfo> | |
115 | 15 <date>2006-01-08</date> |
108 | 16 </refentryinfo> |
94 | 17 |
108 | 18 <refmeta> |
19 <refentrytitle>@PACKAGE@</refentrytitle> | |
20 <manvolnum>1</manvolnum> | |
21 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
22 </refmeta> | |
23 | |
24 <refnamediv id='name.1'> | |
25 <refname>@PACKAGE@</refname> | |
26 <refpurpose>a sendmail milter with per-user dnsbl filtering</refpurpose> | |
27 </refnamediv> | |
94 | 28 |
108 | 29 <refsynopsisdiv id='synopsis.1'> |
30 <title>Synopsis</title> | |
31 <cmdsynopsis> | |
32 <command>@PACKAGE@</command> | |
33 <arg><option>-c</option></arg> | |
34 <arg><option>-s</option></arg> | |
35 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg> | |
36 <arg><option>-e <replaceable class="parameter">from|to</replaceable></option></arg> | |
37 <arg><option>-r <replaceable class="parameter">local-domain-socket</replaceable></option></arg> | |
38 <arg><option>-p <replaceable class="parameter">sendmail-socket</replaceable></option></arg> | |
39 <arg><option>-t <replaceable class="parameter">timeout</replaceable></option></arg> | |
40 </cmdsynopsis> | |
41 </refsynopsisdiv> | |
94 | 42 |
108 | 43 <refsect1 id='options.1'> |
44 <title>Options</title> | |
45 <variablelist> | |
46 <varlistentry> | |
47 <term>-c</term> | |
111 | 48 <listitem><para> |
49 Load the configuration file, print a cannonical form | |
50 of the configuration on stdout, and exit. | |
51 </para></listitem> | |
108 | 52 </varlistentry> |
53 <varlistentry> | |
54 <term>-s</term> | |
111 | 55 <listitem><para> |
56 Stress test the configuration loading code by repeating | |
57 the load/free cycle in an infinite loop. | |
58 </para></listitem> | |
108 | 59 </varlistentry> |
60 <varlistentry> | |
61 <term>-d <replaceable class="parameter">n</replaceable></term> | |
111 | 62 <listitem><para> |
63 Set the debug level to <replaceable class="parameter">n</replaceable>. | |
64 </para></listitem> | |
108 | 65 </varlistentry> |
66 <varlistentry> | |
67 <term>-e <replaceable class="parameter">from|to</replaceable></term> | |
111 | 68 <listitem><para> |
69 Print the results of looking up the from and to addresses in the | |
70 current configuration. The | character is used to separate the from and to | |
71 addresses in the argument to the -e switch. | |
72 </para></listitem> | |
108 | 73 </varlistentry> |
74 <varlistentry> | |
75 <term>-r <replaceable class="parameter">local-domain-socket</replaceable></term> | |
111 | 76 <listitem><para> |
77 Set the local socket used for the connection to our own dns resolver processes. | |
78 </para></listitem> | |
108 | 79 </varlistentry> |
80 <varlistentry> | |
81 <term>-p <replaceable class="parameter">sendmail-socket</replaceable></term> | |
111 | 82 <listitem><para> |
83 Set the socket used for the milter connection to sendmail. This is either | |
84 "inet:port@ip-address" or "local:local-domain-socket-file-name". | |
85 </para></listitem> | |
108 | 86 </varlistentry> |
87 <varlistentry> | |
88 <term>-t <replaceable class="parameter">timeout</replaceable></term> | |
111 | 89 <listitem><para> |
90 Set the timeout in seconds used for communication with sendmail. | |
91 </para></listitem> | |
108 | 92 </varlistentry> |
93 </variablelist> | |
94 </refsect1> | |
94 | 95 |
111 | 96 <refsect1 id='usage.1'> |
108 | 97 <title>Usage</title> |
98 <para><command>@PACKAGE@</command> -c</para> | |
99 <para><command>@PACKAGE@</command> -s</para> | |
111 | 100 <para><command>@PACKAGE@</command> -e 'someone@aol.com|localname@mydomain.tld'</para> |
101 <para><command>@PACKAGE@</command> -d 10 -r resolver.sock -p local:dnsbl.sock</para> | |
102 </refsect1> | |
103 | |
104 <refsect1 id='installation.1'> | |
105 <title>Installation</title> | |
106 <para> | |
107 This is now a standard GNU autoconf/automake installation, so the normal | |
108 "./configure; make; su; make install" works. "make chkconfig" will | |
109 setup the init.d runlevel scripts. Alternatively, you can use the | |
110 source or binary RPMs at <ulink | |
111 url="http://www.five-ten-sg.com/@PACKAGE@/packages">http://www.five-ten-sg.com/@PACKAGE@/packages</ulink>. | |
112 </para> | |
113 <para> | |
114 Note that this has ONLY been tested on Linux, specifically RedHat Linux. | |
115 In particular, this milter makes no attempt to understand IPv6. Your | |
116 mileage will vary. You will need at a minimum a C++ compiler with a | |
117 minimally thread safe STL implementation. The distribution includes a | |
118 test.cpp program. If it fails this milter won't work. If it passes, | |
119 this milter might work. | |
120 </para> | |
121 <para> | |
122 Modify your sendmail.mc by removing all the "FEATURE(dnsbl" lines, add | |
123 the following line in your sendmail.mc and rebuild the .cf file | |
124 </para> | |
125 <para><screen>INPUT_MAIL_FILTER(`dnsbl', `S=local:/var/run/dnsbl/dnsbl.sock, F=T, T=C:30s;S:5m;R:5m;E:5m')</screen></para> | |
126 <para> | |
127 Modify the default <citerefentry> | |
128 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
129 </citerefentry> configuration. | |
130 </para> | |
131 </refsect1> | |
132 | |
133 <refsect1 id='configuration.1'> | |
134 <title>Configuration</title> | |
135 <para> | |
136 The configuration file is documented in <citerefentry> | |
137 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
138 </citerefentry>. Any change to the config file, or any file included | |
139 from that config file, will cause it to be reloaded within three | |
140 minutes. | |
141 </para> | |
108 | 142 </refsect1> |
94 | 143 |
108 | 144 <refsect1 id='introduction.1'> |
145 <title>Introduction</title> | |
146 <para> | |
147 Consider the case of a mail server that is acting as secondary MX for a | |
148 collection of clients, each of which has a collection of mail domains. | |
149 Each client may use their own collection of DNSBLs on their primary mail | |
150 server. We present here a mechanism whereby the backup mail server can | |
151 use the correct set of DNSBLs for each recipient for each message. As a | |
152 side-effect, it gives us the ability to customize the set of DNSBLs on a | |
153 per-recipient basis, so that fred@example.com could use SPEWS and the | |
154 SBL, where all other users @example.com use only the SBL. | |
155 </para> | |
156 <para> | |
157 This milter can also verify the envelope from/recipient pairs with the | |
158 primary MX server. This allows the backup mail servers to properly | |
159 reject mail sent to invalid addresses. Otherwise, the backup mail | |
160 servers will accept that mail, and then generate a bounce message when | |
161 the message is forwarded to the primary server (and rejected there with | |
127 | 162 no such user). These rejections are the primary cause of such backscatter. |
108 | 163 </para> |
164 <para> | |
165 This milter will also decode (uuencode, base64, mime, html entity, url | |
166 encodings) and scan for HTTP and HTTPS URLs and bare hostnames in the | |
167 body of the mail. If any of those host names have A or NS records on | |
168 the SBL (or a single configurable DNSBL), the mail will be rejected | |
169 unless previously whitelisted. This milter also counts the number of | |
170 invalid HTML tags, and can reject mail if that count exceeds your | |
171 specified limit. | |
172 </para> | |
173 <para> | |
136 | 174 This milter can also impose hourly rate limits on the number of |
175 recipients accepted from SMTP AUTH connections, that would otherwise be | |
176 allowed to relay thru this mail server with no spam filtering. | |
177 </para> | |
178 <para> | |
156 | 179 Consider the case of a message from A to B passing thru this milter. |
180 If that message is not blocked, then we might eventually see a reply | |
181 message from B to A. If the filtering context for A includes an | |
182 autowhite entry, then this milter will add an entry in that file to | |
183 whitelist such replies. Note that manually editing such autowhite files | |
158 | 184 is not supported. Also, such autowhite files need to be writeable by the |
185 dnsbl user, where all the other dnsbl configuration files only need | |
157 | 186 to be readable by the dnsbl user. |
156 | 187 </para> |
188 <para> | |
108 | 189 The DNSBL milter reads a text configuration file (dnsbl.conf) on |
190 startup, and whenever the config file (or any of the referenced include | |
191 files) is changed. The entire configuration file is case insensitive. | |
192 If the configuration cannot be loaded due to a syntax error, the milter | |
193 will log the error and quit. If the configuration cannot be reloaded | |
194 after being modified, the milter will log the error and send an email to | |
152 | 195 root from dnsbl@$hostname. You probably want to add dnsbl@$hostname |
108 | 196 to your /etc/mail/virtusertable since otherwise sendmail will reject |
197 that message. | |
198 </para> | |
199 </refsect1> | |
94 | 200 |
111 | 201 <refsect1 id='dcc.1'> |
108 | 202 <title>DCC Issues</title> |
203 <para> | |
204 If you are also using the <ulink | |
205 url="http://www.rhyolite.com/anti-spam/dcc/">DCC</ulink> milter, there | |
206 are a few considerations. You may need to whitelist senders from the | |
207 DCC bulk detector, or from the DNS based lists. Those are two very | |
208 different reasons for whitelisting. The former is done thru the DCC | |
209 whiteclnt config file, the later is done thru the DNSBL milter config | |
210 file. | |
211 </para> | |
212 <para> | |
213 You may want to blacklist some specific senders or sending domains. | |
214 This could be done thru either the DCC (on a global basis, or for a | |
215 specific single recipient). We prefer to do such blacklisting via the | |
216 DNSBL milter config, since it can be done for a collection of recipient | |
217 mail domains. The DCC approach has the feature that you can capture the | |
218 entire message in the DCC log files. The DNSBL milter approach has the | |
219 feature that the mail is rejected earlier (at RCPT TO time), and the | |
220 sending machine just gets a generic "550 5.7.1 no such user" message. | |
221 </para> | |
222 <para> | |
223 The DCC whiteclnt file can be included in the DNSBL milter config by the | |
224 dcc_to and dcc_from statements. This will import the (env_to, env_from, | |
225 and substitute mail_host) entries from the DCC config into the DNSBL | |
226 config. This allows using the DCC config as the single point for | |
227 white/blacklisting. | |
228 </para> | |
229 <para> | |
230 Consider the case where you have multiple clients, each with their own | |
231 mail servers, and each running their own DCC milters. Each client is | |
232 using the DCC facilities for envelope from/to white/blacklisting. | |
233 Presumably you can use rsync or scp to fetch copies of your clients DCC | |
234 whiteclnt files on a regular basis. Your mail server, acting as a | |
235 backup MX for your clients, can use the DNSBL milter, and include those | |
236 client DCC config files. The envelope from/to white/blacklisting will | |
237 be appropriately tagged and used only for the domains controlled by each | |
238 of those clients. | |
239 </para> | |
240 </refsect1> | |
94 | 241 |
111 | 242 <refsect1 id='definitions.1'> |
108 | 243 <title>Definitions</title> |
244 <para> | |
245 CONTEXT - a collection of parameters that defines the filtering context | |
246 to be used for a collection of envelope recipient addresses. The | |
247 context includes such things as the list of DNSBLs to be used, and the | |
248 various content filtering parameters. | |
249 </para> | |
250 <para> | |
251 DNSBL - a named DNS based blocking list is defined by a dns suffix (e.g. | |
252 sbl-xbl.spamhaus.org) and a message string that is used to generate the | |
253 "550 5.7.1" smtp error return code. The names of these DNSBLs will be | |
254 used to define the DNSBL-LISTs. | |
255 </para> | |
256 <para> | |
257 DNSBL-LIST - a named list of DNSBLs that will be used for specific | |
258 recipients or recipient domains. | |
259 </para> | |
260 </refsect1> | |
94 | 261 |
111 | 262 <refsect1 id='filtering.1'> |
108 | 263 <title>Filtering Procedure</title> |
264 <para> | |
152 | 265 The SMTP envelope 'from' and 'to' values are used in various checks. |
266 The first check is to see if a reply message (swapping the env_from and | |
267 env_to values) would be blocked. That check is similar to the main | |
268 check described below, but there is no body content to be scanned, and | |
269 there is no client connection ip address to be checked against DNSBLs. | |
270 This prevents folks from sending mail to recipients that are unable to | |
271 reply. | |
272 </para> | |
273 <para> | |
136 | 274 If the client has authenticated with sendmail, the rate limits are |
275 checked. If the authenticated user has not exceeded the hourly rate | |
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
276 limit, then the mail is accepted, the filtering contexts are not used, |
136 | 277 the dns lists are not checked, and the body content is not scanned. If |
278 the client has not authenticated with sendmail, we follow these steps | |
279 for each recipient. | |
108 | 280 </para> |
281 <orderedlist> | |
111 | 282 <listitem><para> |
108 | 283 The envelope to email address is used to find an initial filtering |
284 context. We first look for a context that specified the full email | |
285 address in the env_to statement. If that is not found, we look for a | |
286 context that specified the entire domain name of the envelope recipient | |
287 in the env_to statement. If that is not found, we look for a context | |
288 that specified the user@ part of the envelope recipient in the env_to | |
289 statement. If that is not found, we use the first top level context | |
290 defined in the config file. | |
111 | 291 </para></listitem> |
292 <listitem><para> | |
108 | 293 The initial filtering context may redirect to a child context based on |
294 the values in the initial context's env_from statement. We look for [1) | |
295 the full envelope from email address, 2) the domain name part of the | |
296 envelope from address, 3) the user@ part of the envelope from address] | |
297 in that context's env_from statement, with values that point to a child | |
298 context. If such an entry is found, we switch to that child filtering | |
299 context. | |
111 | 300 </para></listitem> |
301 <listitem><para> | |
108 | 302 We lookup [1) the full envelope from email address, 2) the domain name |
303 part of the envelope from address, 3) the user@ part of the envelope | |
304 from address] in the filtering context env_from statement. That results | |
305 in one of (white, black, unknown, inherit). | |
111 | 306 </para></listitem> |
307 <listitem><para> | |
108 | 308 If the answer is black, mail to this recipient is rejected with "no such |
309 user", and the dns lists are not checked. | |
111 | 310 </para></listitem> |
311 <listitem><para> | |
108 | 312 If the answer is white, mail to this recipient is accepted and the dns |
313 lists are not checked. | |
111 | 314 </para></listitem> |
315 <listitem><para> | |
108 | 316 If the answer is unknown, we don't reject yet, but the dns lists will be |
317 checked, and the content may be scanned. | |
111 | 318 </para></listitem> |
319 <listitem><para> | |
108 | 320 If the answer is inherit, we repeat the envelope from search in the |
321 parent context. | |
111 | 322 </para></listitem> |
323 <listitem><para> | |
108 | 324 The dns lists specified in the filtering context are checked and the |
325 mail is rejected if any list has an A record for the standard dns based | |
326 lookup scheme (reversed octets of the client followed by the dns | |
327 suffix). | |
111 | 328 </para></listitem> |
329 <listitem><para> | |
108 | 330 If the mail has not been accepted or rejected yet, we look for a |
331 verification context, which is the closest ancestor of the filtering | |
332 context that both specifies a verification host, and which covers the | |
333 envelope to address. If we find such a verification context, and the | |
334 verification host is not our own hostname, we open an smtp conversation | |
335 with that verification host. The current envelope from and recipient to | |
336 values are passed to that verification host. If we receive a 5xy | |
337 response those commands, we reject the current recipient with "no such | |
338 user". | |
111 | 339 </para></listitem> |
340 <listitem><para> | |
108 | 341 If the mail has not been accepted or rejected yet, and the filtering |
342 context enables content filtering, and this is the first such recipient | |
343 in this smtp transaction, we set the content filtering parameters from | |
344 this context, and enable content filtering for the body of this message. | |
111 | 345 </para></listitem> |
108 | 346 </orderedlist> |
347 <para> | |
348 If content filtering is enabled for this body, the mail text is decoded | |
119 | 349 (uuencode, base64, mime, html entity, url encodings), and scanned for HTTP |
350 and HTTPS URLs or bare host names. Hostnames must be either ip address | |
351 literals, or must end in a string defined by the TLD list. The first | |
352 <configurable> host names are checked as follows. | |
353 </para> | |
354 <para> | |
355 The only known list that is suitable for the content filter DNSBL is the | |
356 SBL. If the content filter DNSBL is defined, and any of those host | |
357 names resolve to ip addresses that are on that DNSBL (or have | |
358 nameservers that are on that list), and the host name is not on the | |
359 <configurable> ignore list, the mail is rejected. | |
360 </para> | |
361 <para> | |
362 If the content uribl DNSBL is defined, and any of those host names are | |
363 on that DNSBL, and the host name is not on the <configurable> | |
364 ignore list, the mail is rejected. | |
365 </para> | |
366 <para> | |
367 We also scan for excessive bad html tags, and if a <configurable> | |
368 limit is exceeded, the mail is rejected. | |
108 | 369 </para> |
370 </refsect1> | |
94 | 371 |
111 | 372 <refsect1 id='access.1'> |
108 | 373 <title>Sendmail access vs. DNSBL</title> |
374 <para> | |
375 With the standard sendmail.mc dnsbl FEATURE, the dnsbl checks may be | |
376 suppressed by entries in the /etc/mail/access database. For example, | |
377 suppose you control a /18 of address space, and have allocated some /24s | |
378 to some clients. You have access entries like | |
111 | 379 <literallayout class="monospaced"><![CDATA[ |
380 192.168.4 OK | |
381 192.168.17 OK]]></literallayout> | |
108 | 382 </para> |
383 <para> | |
384 to allow those clients to smarthost thru your mail server. Now if one | |
385 of those clients happens get infected with a virus that turns a machine | |
386 into an open proxy, and their 192.168.4.45 lands on the SBL-XBL, you | |
387 will still wind up allowing that infected machine to smarthost thru your | |
388 mail servers. | |
389 </para> | |
390 <para> | |
391 With this DNSBL milter, the sendmail access database cannot override the | |
392 dnsbl checks, so that machine won't be able to send mail to or thru your | |
393 smarthost mail server (unless the virus/proxy can use smtp-auth). | |
394 </para> | |
395 <para> | |
396 Using the standard sendmail features, you would add access entries to | |
397 allow hosts on your local network to relay thru your mail server. Those | |
398 OK entries in the sendmail access database will override all the dnsbl | |
399 checks. With this DNSBL milter, you will need to have the local users | |
400 authenticate with smtp-auth to get the same effect. You might find | |
401 <ulink | |
402 url="http://www.ists.dartmouth.edu/classroom/sendmail-ssl-how-to.php"> | |
403 these directions</ulink> helpful for setting up smtp-auth if you are on | |
404 RH Linux. | |
405 </para> | |
406 </refsect1> | |
94 | 407 |
111 | 408 <refsect1 id='performance.1'> |
108 | 409 <title>Performance Issues</title> |
410 <para> | |
411 Consider a high volume high performance machine running sendmail. Each | |
412 sendmail process can do its own dns resolution. Typically, such dns | |
413 resolver libraries are not thread safe, and so must be protected by some | |
414 sort of mutex in a threaded environment. When we add a milter to | |
415 sendmail, we now have a collection of sendmail processes, and a | |
416 collection of milter threads. | |
417 </para> | |
418 <para> | |
419 We will be doing a lot of dns lookups per mail message, and at least | |
420 some of those will take many tens of seconds. If all this dns work is | |
421 serialized inside the milter, we have an upper limit of about 25K mail | |
422 messages per day. That is clearly not sufficient for many sites. | |
423 </para> | |
424 <para> | |
425 Since we want to do parallel dns resolution across those milter threads, | |
426 we add another collection of dns resolver processes. Each sendmail | |
427 process is talking to a milter thread over a socket, and each milter | |
428 thread is talking to a dns resolver process over another socket. | |
429 </para> | |
430 <para> | |
431 Suppose we are processing 20 messages per second, and each message | |
432 requires 20 seconds of dns work. Then we will have 400 sendmail | |
433 processes, 400 milter threads, and 400 dns resolver processes. Of | |
434 course that steady state is very unlikely to happen. | |
435 </para> | |
436 </refsect1> | |
94 | 437 |
438 | |
111 | 439 <refsect1 id='rejected.1'> |
108 | 440 <title>Rejected Ideas</title> |
441 <para> | |
442 The following ideas have been considered and rejected. | |
443 </para> | |
444 <para> | |
111 | 445 Add max_recipients setting to the context configuration. Recipients in |
446 excess of that limit will be rejected, and all the non-whitelisted | |
447 recipients will be removed. Current spammers *very* rarely send more | |
448 than ten recipients in a single smtp transaction, so this won't stop any | |
108 | 449 significant amount of spam. |
450 </para> | |
451 <para> | |
452 Add poison addresses to the configuration. If any recipient is | |
453 poison, all recipients are rejected even if they would be whitelisted, | |
454 and the data is rejected if sent. I have a collection of spam trap | |
455 addresses that would be suitable for such use. Based on my log files, | |
456 any mail to those spam trap addresses is rejected based on either dnsbl | |
457 lookups or the DCC. So this won't result in blocking any additional | |
458 spam. | |
459 </para> | |
460 <para> | |
461 Add an option to only allow one recipient if the return path is | |
462 empty. Based on my log files, there is no mail that violates this | |
463 check. | |
464 </para> | |
465 <para> | |
466 Reject the mail if the envelope from domain name contains any MX | |
467 records pointing to 127.0.0.0/8. I don't see any significant amount of | |
468 spam sent with such domain names. | |
469 </para> | |
470 </refsect1> | |
94 | 471 |
108 | 472 <refsect1 id='todo.1'> |
473 <title>TODO</title> | |
474 <para> | |
475 The following ideas are under consideration. | |
476 </para> | |
477 <para> | |
478 Add a per-context option to reject mail if the number of digits in | |
479 the reverse dns client name exceeds some threshold. | |
480 </para> | |
115 | 481 <para> |
482 Look for href="hostname/path" strings that are missing the required | |
483 http:// protocol header. Such references are still clickable in common | |
484 mail software. | |
485 </para> | |
108 | 486 </refsect1> |
94 | 487 |
111 | 488 <refsect1 id='copyright.1'> |
108 | 489 <title>Copyright</title> |
490 <para> | |
491 Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com> | |
492 </para> | |
493 <para> | |
494 This program is free software; you can redistribute it and/or modify it | |
495 under the terms of the GNU General Public License as published by the | |
496 Free Software Foundation; either version 2, or (at your option) any | |
497 later version. | |
498 </para> | |
499 <para> | |
500 You should have received a copy of the GNU General Public License along | |
501 with this program; see the file COPYING. If not, please write to the | |
502 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. | |
503 </para> | |
504 </refsect1> | |
94 | 505 |
111 | 506 <refsect1 id='version.1'> |
507 <title>CVS Version</title> | |
108 | 508 <para> |
509 $Id$ | |
510 </para> | |
511 </refsect1> | |
512 </refentry> | |
513 | |
514 | |
515 <refentry id="@PACKAGE@.conf.5"> | |
516 <refentryinfo> | |
115 | 517 <date>2006-01-08</date> |
108 | 518 </refentryinfo> |
94 | 519 |
108 | 520 <refmeta> |
521 <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
522 <manvolnum>5</manvolnum> | |
523 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
524 </refmeta> | |
94 | 525 |
108 | 526 <refnamediv id='name.5'> |
527 <refname>@PACKAGE@.conf</refname> | |
111 | 528 <refpurpose>configuration file for @PACKAGE@ sendmail milter</refpurpose> |
108 | 529 </refnamediv> |
530 | |
531 <refsynopsisdiv id='synopsis.5'> | |
532 <title>Synopsis</title> | |
533 <cmdsynopsis> | |
534 <command>@PACKAGE@.conf</command> | |
535 </cmdsynopsis> | |
536 </refsynopsisdiv> | |
94 | 537 |
108 | 538 <refsect1 id='description.5'> |
539 <title>Description</title> | |
540 <para>The <command>@PACKAGE@.conf</command> configuration file is | |
148
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
541 specified by this partial bnf description. Comments start with // |
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
542 or # and extend to the end of the line. To include the contents |
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
543 of some file verbatim in the dnsbl.conf file, use |
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
544 <literallayout class="monospaced"><![CDATA[include "<file>";]]></literallayout> |
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
545 </para> |
108 | 546 |
547 <literallayout class="monospaced"><![CDATA[ | |
548 CONFIG = {CONTEXT ";"}+ | |
549 CONTEXT = "context" NAME "{" {STATEMENT}+ "}" | |
153 | 550 STATEMENT = (DNSBL | DNSBLLIST | CONTENT | ENV-TO | VERIFY | |
551 AUTOWHITE | CONTEXT | ENV-FROM | RATE-LIMIT) ";" | |
108 | 552 |
124 | 553 DNSBL = "dnsbl" NAME DNSPREFIX ERROR-MSG1 |
108 | 554 |
555 DNSBLLIST = "dnsbl_list" {NAME}+ | |
94 | 556 |
108 | 557 CONTENT = "content" ("on" | "off") "{" {CONTENT-ST}+ "}" |
119 | 558 CONTENT-ST = (FILTER | URIBL | IGNORE | TLD | CCTLD | HTML-TAGS | |
559 HTML-LIMIT | HOST-LIMIT) ";" | |
124 | 560 FILTER = "filter" DNSPREFIX ERROR-MSG2 |
561 URIBL = "uribl" DNSPREFIX ERROR-MSG3 | |
108 | 562 IGNORE = "ignore" "{" {HOSTNAME [";"]}+ "}" |
563 TLD = "tld" "{" {TLD [";"]}+ "}" | |
119 | 564 CCTLD = "cctld" "{" {TLD [";"]}+ "}" |
108 | 565 HTML-TAGS = "html_tags" "{" {HTMLTAG [";"]}+ "}" |
124 | 566 ERROR-MSG1 = string containing exactly two %s replacement tokens |
567 both are replaced with the client ip address | |
568 ERROR-MSG2 = string containing exactly two %s replacement tokens | |
569 the first is replaced with the hostname, and the second | |
570 is replaced with the ip address | |
571 ERROR-MSG3 = string containing exactly two %s replacement tokens | |
572 both are replaced with the hostname | |
108 | 573 |
574 HTML-LIMIT = "html_limit" ("on" INTEGER ERROR-MSG | "off") | |
575 | |
111 | 576 HOST-LIMIT = "host_limit" ("on" INTEGER ERROR-MSG | "off" | |
577 "soft" INTEGER) | |
94 | 578 |
108 | 579 ENV-TO = "env_to" "{" {(TO-ADDR | DCC-TO)}+ "}" |
580 TO-ADDR = ADDRESS [";"] | |
581 DCC-TO = "dcc_to" ("ok" | "many") "{" DCCINCLUDEFILE "}" ";" | |
582 | |
583 VERIFY = "verify" HOSTNAME ";" | |
153 | 584 AUTOWHITE = "autowhite" DAYS FILENAME ";" |
108 | 585 |
586 ENV_FROM = "env_from" [DEFAULT] "{" {(FROM-ADDR | DCC-FROM)}+ "}" | |
587 FROM-ADDR = ADDRESS VALUE [";"] | |
588 DCC-FROM = "dcc_from" "{" DCCINCLUDEFILE "}" ";" | |
136 | 589 |
140 | 590 RATE-LIMIT = "rate_limit" [DEFAULTLIMIT] "{" (RATE)+ "}" |
136 | 591 RATE = USER LIMIT [";"] |
592 | |
108 | 593 DEFAULT = ("white" | "black" | "unknown" | "inherit" | "") |
594 ADDRESS = (USER@ | DOMAIN | USER@DOMAIN) | |
148
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
595 VALUE = ("white" | "black" | "unknown" | "inherit" | CHILD-CONTEXT-NAME)]]></literallayout> |
108 | 596 </refsect1> |
94 | 597 |
108 | 598 <refsect1 id='sample.5'> |
599 <title>Sample</title> | |
600 <literallayout class="monospaced"><![CDATA[ | |
127 | 601 context main-default { |
602 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
603 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
127 | 604 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
605 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
606 dnsbl dul dul.dnsbl.sorbs.net "Mail from %s rejected - dul; see http://www.sorbs.net/lookup.shtml?%s"; | |
607 dnsbl_list local sbl dul; | |
608 | |
609 // outbound content filtering to prevent our own customers from sending spam | |
610 content on { | |
611 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
612 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; | |
613 #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; | |
614 ignore { include "hosts-ignore.conf"; }; | |
615 tld { include "tld.conf"; }; | |
616 cctld { include "cctld.conf"; }; | |
617 html_tags { include "html-tags.conf"; }; | |
618 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
619 html_limit off; | |
620 host_limit on 20 "Mail containing excessive host names rejected"; | |
621 host_limit soft 20; | |
622 }; | |
623 | |
624 // backscatter prevention - don't send bounces for mail that we accepted but could not forward | |
625 // we only send bounces to our own customers | |
626 env_from unknown { | |
627 "<>" black; | |
628 }; | |
136 | 629 |
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
630 // hourly recipient rate limit by smtp auth client id |
140 | 631 rate_limit 30 { // default |
136 | 632 fred 100; // override default limits |
140 | 633 joe 10; // "" |
136 | 634 }; |
127 | 635 }; |
636 | |
108 | 637 context sample { |
638 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; | |
639 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
640 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
641 dnsbl dul dul.dnsbl.sorbs.net "Mail from %s rejected - dul; see http://www.sorbs.net/lookup.shtml?%s"; | |
642 dnsbl_list local sbl dul; | |
94 | 643 |
108 | 644 content on { |
645 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
122 | 646 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; |
119 | 647 #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
108 | 648 ignore { include "hosts-ignore.conf"; }; |
649 tld { include "tld.conf"; }; | |
119 | 650 cctld { include "cctld.conf"; }; |
108 | 651 html_tags { include "html-tags.conf"; }; |
652 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
653 html_limit off; | |
654 host_limit on 20 "Mail containing excessive host names rejected"; | |
655 host_limit soft 20; | |
656 }; | |
94 | 657 |
108 | 658 env_to { |
659 # child contexts are not allowed to specify recipient addresses outside these domains | |
660 # leave this outer global context env_to empty to allow arbitrary recipients in child contexts | |
661 mydomain.com; | |
662 customer1.com; | |
663 customer1a.com; | |
664 customer1b.com; | |
665 customer2.com; | |
666 customer2a.com; | |
667 customer2b.com; | |
668 }; | |
94 | 669 |
108 | 670 context whitelist { |
671 content off {}; | |
672 env_to { | |
673 # dcc_to ok { include "/var/dcc/whitecommon"; }; # copy the dcc OK values (env_to) into this context | |
674 }; | |
675 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
676 # so all mail TO these env_to addresses is accepted | |
677 }; | |
94 | 678 |
108 | 679 context minimal { |
680 dnsbl_list sbl dul; | |
681 content on {}; | |
682 env_to { | |
683 sales@mydomain.com; | |
684 }; | |
685 }; | |
94 | 686 |
108 | 687 context blacklist { |
688 env_to { | |
689 dcc_to many { include "/var/dcc/whitecommon"; }; # copy the dcc MANY values (env_to) into this context | |
690 old-employee@mydomain.com; | |
691 }; | |
692 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
693 # so all mail TO these env_to addresses is rejected | |
694 }; | |
94 | 695 |
108 | 696 context vp { # special context for the vp |
697 env_to { | |
698 vp@mydomain.com; | |
699 }; | |
700 env_from inherit { | |
701 nai.com black; # the vp does not like nai | |
702 yahoo.com unknown; # override parent context blacklisting | |
703 mother@spammyisp.com white; # suppress dnsbl checking | |
704 }; | |
705 }; | |
706 | |
707 context customer1 { | |
708 dnsbl_list sbl dul; | |
709 env_to { | |
710 customer1.com; | |
711 customer1a.com; | |
712 customer1b.com; | |
713 }; | |
94 | 714 |
153 | 715 # we can reject unknown users |
108 | 716 verify mail.customer1.com; |
94 | 717 |
153 | 718 # whitelist anyone to whom we have sent mail in the last 90 days |
719 autowhite 90 "autowhite/customer1"; | |
720 | |
108 | 721 context customer1a { |
722 env_to { | |
723 customer1a.com; | |
148
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
724 }; |
108 | 725 env_from black { # blacklist everything |
726 first@acceptable.com unknown; # except these specific envelope senders | |
727 second@another.com unknown; | |
728 yahoo.com inherit; # delegate to the parent | |
729 }; | |
730 }; | |
731 | |
732 env_from { # default value of the default is inherit | |
733 yahoo.com black; # no mail from yahoo | |
734 first@yahoo.com unknown; # except this one | |
735 }; | |
736 }; | |
94 | 737 |
108 | 738 context customer2 { |
739 dnsbl_list sbl; | |
740 env_to { | |
741 customer2.com; | |
742 customer2a.com; | |
743 customer2b.com; | |
744 }; | |
745 }; | |
104 | 746 |
149 | 747 # this is at the end, so that these abuse@ and postmaster@ entries will |
748 # override any conflicting entries inside the customer contexts. | |
749 context abuse { | |
750 dnsbl_list xbl; | |
751 content off {}; | |
752 env_to { | |
753 abuse@; # no content filtering on abuse reports | |
754 postmaster@; # "" | |
755 }; | |
756 env_from unknown {}; # ignore all parent white/black listing | |
757 }; | |
758 | |
108 | 759 env_from unknown { |
760 dcc_from { include "/var/dcc/whitecommon"; }; # copy the dcc OK/MANY values (env_from, substitute mail_host) into this context | |
761 abuse@ abuse; # replies to abuse reports use the abuse context | |
762 yahoo.com black; # don't take mail from yahoo | |
763 spammer@example.com black; | |
764 }; | |
765 };]]></literallayout> | |
766 </refsect1> | |
94 | 767 |
111 | 768 <refsect1 id='version.5'> |
769 <title>CVS Version</title> | |
108 | 770 <para> |
771 $Id$ | |
772 </para> | |
773 </refsect1> | |
774 | |
775 </refentry> | |
776 </reference> |