|
108
|
1 <reference>
|
|
|
2 <title>@PACKAGE@ Sendmail milter - Version @VERSION@</title>
|
|
|
3 <partintro>
|
|
|
4 <title>Packages</title>
|
|
|
5 <para>The various source and binary packages are available at <ulink
|
|
|
6 url="http://www.five-ten-sg.com/@PACKAGE@/packages">http://www.five-ten-sg.com/@PACKAGE@/packages</ulink>
|
|
|
7 The most recent documentation is available at <ulink
|
|
|
8 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink>
|
|
|
9 </para>
|
|
94
|
10
|
|
108
|
11 </partintro>
|
|
94
|
12
|
|
108
|
13 <refentry id="@PACKAGE@.1">
|
|
|
14 <refentryinfo>
|
|
|
15 <date>2005-12-18</date>
|
|
|
16 </refentryinfo>
|
|
94
|
17
|
|
108
|
18 <refmeta>
|
|
|
19 <refentrytitle>@PACKAGE@</refentrytitle>
|
|
|
20 <manvolnum>1</manvolnum>
|
|
|
21 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo>
|
|
|
22 </refmeta>
|
|
|
23
|
|
|
24 <refnamediv id='name.1'>
|
|
|
25 <refname>@PACKAGE@</refname>
|
|
|
26 <refpurpose>a sendmail milter with per-user dnsbl filtering</refpurpose>
|
|
|
27 </refnamediv>
|
|
94
|
28
|
|
108
|
29 <refsynopsisdiv id='synopsis.1'>
|
|
|
30 <title>Synopsis</title>
|
|
|
31 <cmdsynopsis>
|
|
|
32 <command>@PACKAGE@</command>
|
|
|
33 <arg><option>-c</option></arg>
|
|
|
34 <arg><option>-s</option></arg>
|
|
|
35 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg>
|
|
|
36 <arg><option>-e <replaceable class="parameter">from|to</replaceable></option></arg>
|
|
|
37 <arg><option>-r <replaceable class="parameter">local-domain-socket</replaceable></option></arg>
|
|
|
38 <arg><option>-p <replaceable class="parameter">sendmail-socket</replaceable></option></arg>
|
|
|
39 <arg><option>-t <replaceable class="parameter">timeout</replaceable></option></arg>
|
|
|
40 </cmdsynopsis>
|
|
|
41 </refsynopsisdiv>
|
|
94
|
42
|
|
108
|
43 <refsect1 id='options.1'>
|
|
|
44 <title>Options</title>
|
|
|
45 <variablelist>
|
|
|
46 <varlistentry>
|
|
|
47 <term>-c</term>
|
|
111
|
48 <listitem><para>
|
|
|
49 Load the configuration file, print a cannonical form
|
|
|
50 of the configuration on stdout, and exit.
|
|
|
51 </para></listitem>
|
|
108
|
52 </varlistentry>
|
|
|
53 <varlistentry>
|
|
|
54 <term>-s</term>
|
|
111
|
55 <listitem><para>
|
|
|
56 Stress test the configuration loading code by repeating
|
|
|
57 the load/free cycle in an infinite loop.
|
|
|
58 </para></listitem>
|
|
108
|
59 </varlistentry>
|
|
|
60 <varlistentry>
|
|
|
61 <term>-d <replaceable class="parameter">n</replaceable></term>
|
|
111
|
62 <listitem><para>
|
|
|
63 Set the debug level to <replaceable class="parameter">n</replaceable>.
|
|
|
64 </para></listitem>
|
|
108
|
65 </varlistentry>
|
|
|
66 <varlistentry>
|
|
|
67 <term>-e <replaceable class="parameter">from|to</replaceable></term>
|
|
111
|
68 <listitem><para>
|
|
|
69 Print the results of looking up the from and to addresses in the
|
|
|
70 current configuration. The | character is used to separate the from and to
|
|
|
71 addresses in the argument to the -e switch.
|
|
|
72 </para></listitem>
|
|
108
|
73 </varlistentry>
|
|
|
74 <varlistentry>
|
|
|
75 <term>-r <replaceable class="parameter">local-domain-socket</replaceable></term>
|
|
111
|
76 <listitem><para>
|
|
|
77 Set the local socket used for the connection to our own dns resolver processes.
|
|
|
78 </para></listitem>
|
|
108
|
79 </varlistentry>
|
|
|
80 <varlistentry>
|
|
|
81 <term>-p <replaceable class="parameter">sendmail-socket</replaceable></term>
|
|
111
|
82 <listitem><para>
|
|
|
83 Set the socket used for the milter connection to sendmail. This is either
|
|
|
84 "inet:port@ip-address" or "local:local-domain-socket-file-name".
|
|
|
85 </para></listitem>
|
|
108
|
86 </varlistentry>
|
|
|
87 <varlistentry>
|
|
|
88 <term>-t <replaceable class="parameter">timeout</replaceable></term>
|
|
111
|
89 <listitem><para>
|
|
|
90 Set the timeout in seconds used for communication with sendmail.
|
|
|
91 </para></listitem>
|
|
108
|
92 </varlistentry>
|
|
|
93 </variablelist>
|
|
|
94 </refsect1>
|
|
94
|
95
|
|
111
|
96 <refsect1 id='usage.1'>
|
|
108
|
97 <title>Usage</title>
|
|
|
98 <para><command>@PACKAGE@</command> -c</para>
|
|
|
99 <para><command>@PACKAGE@</command> -s</para>
|
|
111
|
100 <para><command>@PACKAGE@</command> -e 'someone@aol.com|localname@mydomain.tld'</para>
|
|
|
101 <para><command>@PACKAGE@</command> -d 10 -r resolver.sock -p local:dnsbl.sock</para>
|
|
|
102 </refsect1>
|
|
|
103
|
|
|
104 <refsect1 id='installation.1'>
|
|
|
105 <title>Installation</title>
|
|
|
106 <para>
|
|
|
107 This is now a standard GNU autoconf/automake installation, so the normal
|
|
|
108 "./configure; make; su; make install" works. "make chkconfig" will
|
|
|
109 setup the init.d runlevel scripts. Alternatively, you can use the
|
|
|
110 source or binary RPMs at <ulink
|
|
|
111 url="http://www.five-ten-sg.com/@PACKAGE@/packages">http://www.five-ten-sg.com/@PACKAGE@/packages</ulink>.
|
|
|
112 </para>
|
|
|
113 <para>
|
|
|
114 Note that this has ONLY been tested on Linux, specifically RedHat Linux.
|
|
|
115 In particular, this milter makes no attempt to understand IPv6. Your
|
|
|
116 mileage will vary. You will need at a minimum a C++ compiler with a
|
|
|
117 minimally thread safe STL implementation. The distribution includes a
|
|
|
118 test.cpp program. If it fails this milter won't work. If it passes,
|
|
|
119 this milter might work.
|
|
|
120 </para>
|
|
|
121 <para>
|
|
|
122 Modify your sendmail.mc by removing all the "FEATURE(dnsbl" lines, add
|
|
|
123 the following line in your sendmail.mc and rebuild the .cf file
|
|
|
124 </para>
|
|
|
125 <para><screen>INPUT_MAIL_FILTER(`dnsbl', `S=local:/var/run/dnsbl/dnsbl.sock, F=T, T=C:30s;S:5m;R:5m;E:5m')</screen></para>
|
|
|
126 <para>
|
|
|
127 Modify the default <citerefentry>
|
|
|
128 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum>
|
|
|
129 </citerefentry> configuration.
|
|
|
130 </para>
|
|
|
131 </refsect1>
|
|
|
132
|
|
|
133 <refsect1 id='configuration.1'>
|
|
|
134 <title>Configuration</title>
|
|
|
135 <para>
|
|
|
136 The configuration file is documented in <citerefentry>
|
|
|
137 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum>
|
|
|
138 </citerefentry>. Any change to the config file, or any file included
|
|
|
139 from that config file, will cause it to be reloaded within three
|
|
|
140 minutes.
|
|
|
141 </para>
|
|
108
|
142 </refsect1>
|
|
94
|
143
|
|
108
|
144 <refsect1 id='introduction.1'>
|
|
|
145 <title>Introduction</title>
|
|
|
146 <para>
|
|
|
147 Consider the case of a mail server that is acting as secondary MX for a
|
|
|
148 collection of clients, each of which has a collection of mail domains.
|
|
|
149 Each client may use their own collection of DNSBLs on their primary mail
|
|
|
150 server. We present here a mechanism whereby the backup mail server can
|
|
|
151 use the correct set of DNSBLs for each recipient for each message. As a
|
|
|
152 side-effect, it gives us the ability to customize the set of DNSBLs on a
|
|
|
153 per-recipient basis, so that fred@example.com could use SPEWS and the
|
|
|
154 SBL, where all other users @example.com use only the SBL.
|
|
|
155 </para>
|
|
|
156 <para>
|
|
|
157 This milter can also verify the envelope from/recipient pairs with the
|
|
|
158 primary MX server. This allows the backup mail servers to properly
|
|
|
159 reject mail sent to invalid addresses. Otherwise, the backup mail
|
|
|
160 servers will accept that mail, and then generate a bounce message when
|
|
|
161 the message is forwarded to the primary server (and rejected there with
|
|
|
162 no such user).
|
|
|
163 </para>
|
|
|
164 <para>
|
|
|
165 This milter will also decode (uuencode, base64, mime, html entity, url
|
|
|
166 encodings) and scan for HTTP and HTTPS URLs and bare hostnames in the
|
|
|
167 body of the mail. If any of those host names have A or NS records on
|
|
|
168 the SBL (or a single configurable DNSBL), the mail will be rejected
|
|
|
169 unless previously whitelisted. This milter also counts the number of
|
|
|
170 invalid HTML tags, and can reject mail if that count exceeds your
|
|
|
171 specified limit.
|
|
|
172 </para>
|
|
|
173 <para>
|
|
|
174 The DNSBL milter reads a text configuration file (dnsbl.conf) on
|
|
|
175 startup, and whenever the config file (or any of the referenced include
|
|
|
176 files) is changed. The entire configuration file is case insensitive.
|
|
|
177 If the configuration cannot be loaded due to a syntax error, the milter
|
|
|
178 will log the error and quit. If the configuration cannot be reloaded
|
|
|
179 after being modified, the milter will log the error and send an email to
|
|
|
180 root from dnsbl@$hostname. You probably want to added dnsbl@$hostname
|
|
|
181 to your /etc/mail/virtusertable since otherwise sendmail will reject
|
|
|
182 that message.
|
|
|
183 </para>
|
|
|
184 </refsect1>
|
|
94
|
185
|
|
111
|
186 <refsect1 id='dcc.1'>
|
|
108
|
187 <title>DCC Issues</title>
|
|
|
188 <para>
|
|
|
189 If you are also using the <ulink
|
|
|
190 url="http://www.rhyolite.com/anti-spam/dcc/">DCC</ulink> milter, there
|
|
|
191 are a few considerations. You may need to whitelist senders from the
|
|
|
192 DCC bulk detector, or from the DNS based lists. Those are two very
|
|
|
193 different reasons for whitelisting. The former is done thru the DCC
|
|
|
194 whiteclnt config file, the later is done thru the DNSBL milter config
|
|
|
195 file.
|
|
|
196 </para>
|
|
|
197 <para>
|
|
|
198 You may want to blacklist some specific senders or sending domains.
|
|
|
199 This could be done thru either the DCC (on a global basis, or for a
|
|
|
200 specific single recipient). We prefer to do such blacklisting via the
|
|
|
201 DNSBL milter config, since it can be done for a collection of recipient
|
|
|
202 mail domains. The DCC approach has the feature that you can capture the
|
|
|
203 entire message in the DCC log files. The DNSBL milter approach has the
|
|
|
204 feature that the mail is rejected earlier (at RCPT TO time), and the
|
|
|
205 sending machine just gets a generic "550 5.7.1 no such user" message.
|
|
|
206 </para>
|
|
|
207 <para>
|
|
|
208 The DCC whiteclnt file can be included in the DNSBL milter config by the
|
|
|
209 dcc_to and dcc_from statements. This will import the (env_to, env_from,
|
|
|
210 and substitute mail_host) entries from the DCC config into the DNSBL
|
|
|
211 config. This allows using the DCC config as the single point for
|
|
|
212 white/blacklisting.
|
|
|
213 </para>
|
|
|
214 <para>
|
|
|
215 Consider the case where you have multiple clients, each with their own
|
|
|
216 mail servers, and each running their own DCC milters. Each client is
|
|
|
217 using the DCC facilities for envelope from/to white/blacklisting.
|
|
|
218 Presumably you can use rsync or scp to fetch copies of your clients DCC
|
|
|
219 whiteclnt files on a regular basis. Your mail server, acting as a
|
|
|
220 backup MX for your clients, can use the DNSBL milter, and include those
|
|
|
221 client DCC config files. The envelope from/to white/blacklisting will
|
|
|
222 be appropriately tagged and used only for the domains controlled by each
|
|
|
223 of those clients.
|
|
|
224 </para>
|
|
|
225 </refsect1>
|
|
94
|
226
|
|
111
|
227 <refsect1 id='definitions.1'>
|
|
108
|
228 <title>Definitions</title>
|
|
|
229 <para>
|
|
|
230 CONTEXT - a collection of parameters that defines the filtering context
|
|
|
231 to be used for a collection of envelope recipient addresses. The
|
|
|
232 context includes such things as the list of DNSBLs to be used, and the
|
|
|
233 various content filtering parameters.
|
|
|
234 </para>
|
|
|
235 <para>
|
|
|
236 DNSBL - a named DNS based blocking list is defined by a dns suffix (e.g.
|
|
|
237 sbl-xbl.spamhaus.org) and a message string that is used to generate the
|
|
|
238 "550 5.7.1" smtp error return code. The names of these DNSBLs will be
|
|
|
239 used to define the DNSBL-LISTs.
|
|
|
240 </para>
|
|
|
241 <para>
|
|
|
242 DNSBL-LIST - a named list of DNSBLs that will be used for specific
|
|
|
243 recipients or recipient domains.
|
|
|
244 </para>
|
|
|
245 </refsect1>
|
|
94
|
246
|
|
111
|
247 <refsect1 id='filtering.1'>
|
|
108
|
248 <title>Filtering Procedure</title>
|
|
|
249 <para>
|
|
|
250 If the client has authenticated with sendmail, the mail is accepted, the
|
|
|
251 filtering contexts are not used, the dns lists are not checked, and the
|
|
|
252 body content is not scanned. Otherwise, we follow these steps for each
|
|
|
253 recipient.
|
|
|
254 </para>
|
|
|
255 <orderedlist>
|
|
111
|
256 <listitem><para>
|
|
108
|
257 The envelope to email address is used to find an initial filtering
|
|
|
258 context. We first look for a context that specified the full email
|
|
|
259 address in the env_to statement. If that is not found, we look for a
|
|
|
260 context that specified the entire domain name of the envelope recipient
|
|
|
261 in the env_to statement. If that is not found, we look for a context
|
|
|
262 that specified the user@ part of the envelope recipient in the env_to
|
|
|
263 statement. If that is not found, we use the first top level context
|
|
|
264 defined in the config file.
|
|
111
|
265 </para></listitem>
|
|
|
266 <listitem><para>
|
|
108
|
267 The initial filtering context may redirect to a child context based on
|
|
|
268 the values in the initial context's env_from statement. We look for [1)
|
|
|
269 the full envelope from email address, 2) the domain name part of the
|
|
|
270 envelope from address, 3) the user@ part of the envelope from address]
|
|
|
271 in that context's env_from statement, with values that point to a child
|
|
|
272 context. If such an entry is found, we switch to that child filtering
|
|
|
273 context.
|
|
111
|
274 </para></listitem>
|
|
|
275 <listitem><para>
|
|
108
|
276 We lookup [1) the full envelope from email address, 2) the domain name
|
|
|
277 part of the envelope from address, 3) the user@ part of the envelope
|
|
|
278 from address] in the filtering context env_from statement. That results
|
|
|
279 in one of (white, black, unknown, inherit).
|
|
111
|
280 </para></listitem>
|
|
|
281 <listitem><para>
|
|
108
|
282 If the answer is black, mail to this recipient is rejected with "no such
|
|
|
283 user", and the dns lists are not checked.
|
|
111
|
284 </para></listitem>
|
|
|
285 <listitem><para>
|
|
108
|
286 If the answer is white, mail to this recipient is accepted and the dns
|
|
|
287 lists are not checked.
|
|
111
|
288 </para></listitem>
|
|
|
289 <listitem><para>
|
|
108
|
290 If the answer is unknown, we don't reject yet, but the dns lists will be
|
|
|
291 checked, and the content may be scanned.
|
|
111
|
292 </para></listitem>
|
|
|
293 <listitem><para>
|
|
108
|
294 If the answer is inherit, we repeat the envelope from search in the
|
|
|
295 parent context.
|
|
111
|
296 </para></listitem>
|
|
|
297 <listitem><para>
|
|
108
|
298 The dns lists specified in the filtering context are checked and the
|
|
|
299 mail is rejected if any list has an A record for the standard dns based
|
|
|
300 lookup scheme (reversed octets of the client followed by the dns
|
|
|
301 suffix).
|
|
111
|
302 </para></listitem>
|
|
|
303 <listitem><para>
|
|
108
|
304 If the mail has not been accepted or rejected yet, we look for a
|
|
|
305 verification context, which is the closest ancestor of the filtering
|
|
|
306 context that both specifies a verification host, and which covers the
|
|
|
307 envelope to address. If we find such a verification context, and the
|
|
|
308 verification host is not our own hostname, we open an smtp conversation
|
|
|
309 with that verification host. The current envelope from and recipient to
|
|
|
310 values are passed to that verification host. If we receive a 5xy
|
|
|
311 response those commands, we reject the current recipient with "no such
|
|
|
312 user".
|
|
111
|
313 </para></listitem>
|
|
|
314 <listitem><para>
|
|
108
|
315 If the mail has not been accepted or rejected yet, and the filtering
|
|
|
316 context enables content filtering, and this is the first such recipient
|
|
|
317 in this smtp transaction, we set the content filtering parameters from
|
|
|
318 this context, and enable content filtering for the body of this message.
|
|
111
|
319 </para></listitem>
|
|
108
|
320 </orderedlist>
|
|
|
321 <para>
|
|
|
322 If content filtering is enabled for this body, the mail text is decoded
|
|
|
323 (uuencode, base64, mime, html entity, url encodings), scanned for HTTP
|
|
|
324 and HTTPS URLs, and the first <configurable> host names are
|
|
|
325 checked for their presence on the single <configurable> DNSBL.
|
|
|
326 The only known list that is suitable for this purpose is the SBL. If
|
|
|
327 any of those host names are on that DNSBL (or have nameservers that are
|
|
|
328 on that list), and it is not on the <configurable> ignore list,
|
|
|
329 the mail is rejected. We also scan for excessive bad html tags, and if
|
|
|
330 a <configurable> limit is exceeded, the mail is rejected.
|
|
|
331 </para>
|
|
|
332 </refsect1>
|
|
94
|
333
|
|
111
|
334 <refsect1 id='access.1'>
|
|
108
|
335 <title>Sendmail access vs. DNSBL</title>
|
|
|
336 <para>
|
|
|
337 With the standard sendmail.mc dnsbl FEATURE, the dnsbl checks may be
|
|
|
338 suppressed by entries in the /etc/mail/access database. For example,
|
|
|
339 suppose you control a /18 of address space, and have allocated some /24s
|
|
|
340 to some clients. You have access entries like
|
|
111
|
341 <literallayout class="monospaced"><![CDATA[
|
|
|
342 192.168.4 OK
|
|
|
343 192.168.17 OK]]></literallayout>
|
|
108
|
344 </para>
|
|
|
345 <para>
|
|
|
346 to allow those clients to smarthost thru your mail server. Now if one
|
|
|
347 of those clients happens get infected with a virus that turns a machine
|
|
|
348 into an open proxy, and their 192.168.4.45 lands on the SBL-XBL, you
|
|
|
349 will still wind up allowing that infected machine to smarthost thru your
|
|
|
350 mail servers.
|
|
|
351 </para>
|
|
|
352 <para>
|
|
|
353 With this DNSBL milter, the sendmail access database cannot override the
|
|
|
354 dnsbl checks, so that machine won't be able to send mail to or thru your
|
|
|
355 smarthost mail server (unless the virus/proxy can use smtp-auth).
|
|
|
356 </para>
|
|
|
357 <para>
|
|
|
358 Using the standard sendmail features, you would add access entries to
|
|
|
359 allow hosts on your local network to relay thru your mail server. Those
|
|
|
360 OK entries in the sendmail access database will override all the dnsbl
|
|
|
361 checks. With this DNSBL milter, you will need to have the local users
|
|
|
362 authenticate with smtp-auth to get the same effect. You might find
|
|
|
363 <ulink
|
|
|
364 url="http://www.ists.dartmouth.edu/classroom/sendmail-ssl-how-to.php">
|
|
|
365 these directions</ulink> helpful for setting up smtp-auth if you are on
|
|
|
366 RH Linux.
|
|
|
367 </para>
|
|
|
368 </refsect1>
|
|
94
|
369
|
|
111
|
370 <refsect1 id='performance.1'>
|
|
108
|
371 <title>Performance Issues</title>
|
|
|
372 <para>
|
|
|
373 Consider a high volume high performance machine running sendmail. Each
|
|
|
374 sendmail process can do its own dns resolution. Typically, such dns
|
|
|
375 resolver libraries are not thread safe, and so must be protected by some
|
|
|
376 sort of mutex in a threaded environment. When we add a milter to
|
|
|
377 sendmail, we now have a collection of sendmail processes, and a
|
|
|
378 collection of milter threads.
|
|
|
379 </para>
|
|
|
380 <para>
|
|
|
381 We will be doing a lot of dns lookups per mail message, and at least
|
|
|
382 some of those will take many tens of seconds. If all this dns work is
|
|
|
383 serialized inside the milter, we have an upper limit of about 25K mail
|
|
|
384 messages per day. That is clearly not sufficient for many sites.
|
|
|
385 </para>
|
|
|
386 <para>
|
|
|
387 Since we want to do parallel dns resolution across those milter threads,
|
|
|
388 we add another collection of dns resolver processes. Each sendmail
|
|
|
389 process is talking to a milter thread over a socket, and each milter
|
|
|
390 thread is talking to a dns resolver process over another socket.
|
|
|
391 </para>
|
|
|
392 <para>
|
|
|
393 Suppose we are processing 20 messages per second, and each message
|
|
|
394 requires 20 seconds of dns work. Then we will have 400 sendmail
|
|
|
395 processes, 400 milter threads, and 400 dns resolver processes. Of
|
|
|
396 course that steady state is very unlikely to happen.
|
|
|
397 </para>
|
|
|
398 </refsect1>
|
|
94
|
399
|
|
|
400
|
|
111
|
401 <refsect1 id='rejected.1'>
|
|
108
|
402 <title>Rejected Ideas</title>
|
|
|
403 <para>
|
|
|
404 The following ideas have been considered and rejected.
|
|
|
405 </para>
|
|
|
406 <para>
|
|
111
|
407 Add max_recipients setting to the context configuration. Recipients in
|
|
|
408 excess of that limit will be rejected, and all the non-whitelisted
|
|
|
409 recipients will be removed. Current spammers *very* rarely send more
|
|
|
410 than ten recipients in a single smtp transaction, so this won't stop any
|
|
108
|
411 significant amount of spam.
|
|
|
412 </para>
|
|
|
413 <para>
|
|
|
414 Add poison addresses to the configuration. If any recipient is
|
|
|
415 poison, all recipients are rejected even if they would be whitelisted,
|
|
|
416 and the data is rejected if sent. I have a collection of spam trap
|
|
|
417 addresses that would be suitable for such use. Based on my log files,
|
|
|
418 any mail to those spam trap addresses is rejected based on either dnsbl
|
|
|
419 lookups or the DCC. So this won't result in blocking any additional
|
|
|
420 spam.
|
|
|
421 </para>
|
|
|
422 <para>
|
|
|
423 Add an option to only allow one recipient if the return path is
|
|
|
424 empty. Based on my log files, there is no mail that violates this
|
|
|
425 check.
|
|
|
426 </para>
|
|
|
427 <para>
|
|
|
428 Reject the mail if the envelope from domain name contains any MX
|
|
|
429 records pointing to 127.0.0.0/8. I don't see any significant amount of
|
|
|
430 spam sent with such domain names.
|
|
|
431 </para>
|
|
|
432 </refsect1>
|
|
94
|
433
|
|
108
|
434 <refsect1 id='todo.1'>
|
|
|
435 <title>TODO</title>
|
|
|
436 <para>
|
|
|
437 The following ideas are under consideration.
|
|
|
438 </para>
|
|
|
439 <para>
|
|
|
440 Add a per-context option to reject mail if the number of digits in
|
|
|
441 the reverse dns client name exceeds some threshold.
|
|
|
442 </para>
|
|
|
443 </refsect1>
|
|
94
|
444
|
|
111
|
445 <refsect1 id='copyright.1'>
|
|
108
|
446 <title>Copyright</title>
|
|
|
447 <para>
|
|
|
448 Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>
|
|
|
449 </para>
|
|
|
450 <para>
|
|
|
451 This program is free software; you can redistribute it and/or modify it
|
|
|
452 under the terms of the GNU General Public License as published by the
|
|
|
453 Free Software Foundation; either version 2, or (at your option) any
|
|
|
454 later version.
|
|
|
455 </para>
|
|
|
456 <para>
|
|
|
457 You should have received a copy of the GNU General Public License along
|
|
|
458 with this program; see the file COPYING. If not, please write to the
|
|
|
459 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
460 </para>
|
|
|
461 </refsect1>
|
|
94
|
462
|
|
111
|
463 <refsect1 id='version.1'>
|
|
|
464 <title>CVS Version</title>
|
|
108
|
465 <para>
|
|
|
466 $Id$
|
|
|
467 </para>
|
|
|
468 </refsect1>
|
|
|
469 </refentry>
|
|
|
470
|
|
|
471
|
|
|
472 <refentry id="@PACKAGE@.conf.5">
|
|
|
473 <refentryinfo>
|
|
|
474 <date>2005-12-18</date>
|
|
|
475 </refentryinfo>
|
|
94
|
476
|
|
108
|
477 <refmeta>
|
|
|
478 <refentrytitle>@PACKAGE@.conf</refentrytitle>
|
|
|
479 <manvolnum>5</manvolnum>
|
|
|
480 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo>
|
|
|
481 </refmeta>
|
|
94
|
482
|
|
108
|
483 <refnamediv id='name.5'>
|
|
|
484 <refname>@PACKAGE@.conf</refname>
|
|
111
|
485 <refpurpose>configuration file for @PACKAGE@ sendmail milter</refpurpose>
|
|
108
|
486 </refnamediv>
|
|
|
487
|
|
|
488 <refsynopsisdiv id='synopsis.5'>
|
|
|
489 <title>Synopsis</title>
|
|
|
490 <cmdsynopsis>
|
|
|
491 <command>@PACKAGE@.conf</command>
|
|
|
492 </cmdsynopsis>
|
|
|
493 </refsynopsisdiv>
|
|
94
|
494
|
|
108
|
495 <refsect1 id='description.5'>
|
|
|
496 <title>Description</title>
|
|
|
497 <para>The <command>@PACKAGE@.conf</command> configuration file is
|
|
|
498 specified by this partial bnf description.</para>
|
|
|
499
|
|
|
500 <literallayout class="monospaced"><![CDATA[
|
|
|
501 CONFIG = {CONTEXT ";"}+
|
|
|
502 CONTEXT = "context" NAME "{" {STATEMENT}+ "}"
|
|
111
|
503 STATEMENT = (DNSBL | DNSBLLIST | CONTENT | ENV-TO | VERIFY |
|
|
|
504 CONTEXT | ENV-FROM) ";"
|
|
108
|
505
|
|
|
506 DNSBL = "dnsbl" NAME DNSPREFIX ERROR-MSG
|
|
|
507
|
|
|
508 DNSBLLIST = "dnsbl_list" {NAME}+
|
|
94
|
509
|
|
108
|
510 CONTENT = "content" ("on" | "off") "{" {CONTENT-ST}+ "}"
|
|
111
|
511 CONTENT-ST = (FILTER | IGNORE | TLD | HTML-TAGS | HTML-LIMIT |
|
|
|
512 HOST-LIMIT) ";"
|
|
108
|
513 FILTER = "filter" DNSPREFIX ERROR-MSG
|
|
|
514 IGNORE = "ignore" "{" {HOSTNAME [";"]}+ "}"
|
|
|
515 TLD = "tld" "{" {TLD [";"]}+ "}"
|
|
|
516 HTML-TAGS = "html_tags" "{" {HTMLTAG [";"]}+ "}"
|
|
111
|
517 ERROR-MSG = string containing exactly two %s replacement tokens
|
|
|
518 for the client ip address
|
|
108
|
519
|
|
|
520 HTML-LIMIT = "html_limit" ("on" INTEGER ERROR-MSG | "off")
|
|
|
521
|
|
111
|
522 HOST-LIMIT = "host_limit" ("on" INTEGER ERROR-MSG | "off" |
|
|
|
523 "soft" INTEGER)
|
|
94
|
524
|
|
108
|
525 ENV-TO = "env_to" "{" {(TO-ADDR | DCC-TO)}+ "}"
|
|
|
526 TO-ADDR = ADDRESS [";"]
|
|
|
527 DCC-TO = "dcc_to" ("ok" | "many") "{" DCCINCLUDEFILE "}" ";"
|
|
|
528
|
|
|
529 VERIFY = "verify" HOSTNAME ";"
|
|
|
530
|
|
|
531 ENV_FROM = "env_from" [DEFAULT] "{" {(FROM-ADDR | DCC-FROM)}+ "}"
|
|
|
532 FROM-ADDR = ADDRESS VALUE [";"]
|
|
|
533 DCC-FROM = "dcc_from" "{" DCCINCLUDEFILE "}" ";"
|
|
|
534 DEFAULT = ("white" | "black" | "unknown" | "inherit" | "")
|
|
|
535 ADDRESS = (USER@ | DOMAIN | USER@DOMAIN)
|
|
|
536 VALUE = ("white" | "black" | "unknown" | CHILD-CONTEXT-NAME)]]></literallayout>
|
|
|
537 </refsect1>
|
|
94
|
538
|
|
108
|
539 <refsect1 id='sample.5'>
|
|
|
540 <title>Sample</title>
|
|
|
541 <literallayout class="monospaced"><![CDATA[
|
|
|
542 context sample {
|
|
|
543 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s";
|
|
|
544 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
|
|
|
545 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s";
|
|
|
546 dnsbl dul dul.dnsbl.sorbs.net "Mail from %s rejected - dul; see http://www.sorbs.net/lookup.shtml?%s";
|
|
|
547 dnsbl_list local sbl dul;
|
|
94
|
548
|
|
108
|
549 content on {
|
|
|
550 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
|
|
|
551 ignore { include "hosts-ignore.conf"; };
|
|
|
552 tld { include "tld.conf"; };
|
|
|
553 html_tags { include "html-tags.conf"; };
|
|
|
554 html_limit on 20 "Mail containing excessive bad html tags rejected";
|
|
|
555 html_limit off;
|
|
|
556 host_limit on 20 "Mail containing excessive host names rejected";
|
|
|
557 host_limit soft 20;
|
|
|
558 };
|
|
94
|
559
|
|
108
|
560 env_to {
|
|
|
561 # child contexts are not allowed to specify recipient addresses outside these domains
|
|
|
562 # leave this outer global context env_to empty to allow arbitrary recipients in child contexts
|
|
|
563 mydomain.com;
|
|
|
564 customer1.com;
|
|
|
565 customer1a.com;
|
|
|
566 customer1b.com;
|
|
|
567 customer2.com;
|
|
|
568 customer2a.com;
|
|
|
569 customer2b.com;
|
|
|
570 };
|
|
94
|
571
|
|
108
|
572 context whitelist {
|
|
|
573 content off {};
|
|
|
574 env_to {
|
|
|
575 # dcc_to ok { include "/var/dcc/whitecommon"; }; # copy the dcc OK values (env_to) into this context
|
|
|
576 };
|
|
|
577 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted
|
|
|
578 # so all mail TO these env_to addresses is accepted
|
|
|
579 };
|
|
94
|
580
|
|
108
|
581 context abuse {
|
|
|
582 dnsbl_list xbl;
|
|
|
583 content off {};
|
|
|
584 env_to {
|
|
|
585 abuse@; # no content filtering on abuse reports
|
|
|
586 postmaster@; # ""
|
|
|
587 };
|
|
|
588 env_from unknown {}; # ignore all parent white/black listing
|
|
|
589 };
|
|
94
|
590
|
|
108
|
591 context minimal {
|
|
|
592 dnsbl_list sbl dul;
|
|
|
593 content on {};
|
|
|
594 env_to {
|
|
|
595 sales@mydomain.com;
|
|
|
596 };
|
|
|
597 };
|
|
94
|
598
|
|
108
|
599 context blacklist {
|
|
|
600 env_to {
|
|
|
601 dcc_to many { include "/var/dcc/whitecommon"; }; # copy the dcc MANY values (env_to) into this context
|
|
|
602 old-employee@mydomain.com;
|
|
|
603 };
|
|
|
604 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted
|
|
|
605 # so all mail TO these env_to addresses is rejected
|
|
|
606 };
|
|
94
|
607
|
|
108
|
608 context vp { # special context for the vp
|
|
|
609 env_to {
|
|
|
610 vp@mydomain.com;
|
|
|
611 };
|
|
|
612 env_from inherit {
|
|
|
613 nai.com black; # the vp does not like nai
|
|
|
614 yahoo.com unknown; # override parent context blacklisting
|
|
|
615 mother@spammyisp.com white; # suppress dnsbl checking
|
|
|
616 };
|
|
|
617 };
|
|
|
618
|
|
|
619 context customer1 {
|
|
|
620 dnsbl_list sbl dul;
|
|
|
621 env_to {
|
|
|
622 customer1.com;
|
|
|
623 customer1a.com;
|
|
|
624 customer1b.com;
|
|
|
625 };
|
|
94
|
626
|
|
108
|
627 verify mail.customer1.com;
|
|
94
|
628
|
|
108
|
629 context customer1a {
|
|
|
630 env_to {
|
|
|
631 customer1a.com;
|
|
|
632 }
|
|
|
633 env_from black { # blacklist everything
|
|
|
634 first@acceptable.com unknown; # except these specific envelope senders
|
|
|
635 second@another.com unknown;
|
|
|
636 yahoo.com inherit; # delegate to the parent
|
|
|
637 };
|
|
|
638 };
|
|
|
639
|
|
|
640 env_from { # default value of the default is inherit
|
|
|
641 yahoo.com black; # no mail from yahoo
|
|
|
642 first@yahoo.com unknown; # except this one
|
|
|
643 };
|
|
|
644 };
|
|
94
|
645
|
|
108
|
646 context customer2 {
|
|
|
647 dnsbl_list sbl;
|
|
|
648 env_to {
|
|
|
649 customer2.com;
|
|
|
650 customer2a.com;
|
|
|
651 customer2b.com;
|
|
|
652 };
|
|
|
653 };
|
|
104
|
654
|
|
108
|
655 env_from unknown {
|
|
|
656 dcc_from { include "/var/dcc/whitecommon"; }; # copy the dcc OK/MANY values (env_from, substitute mail_host) into this context
|
|
|
657 abuse@ abuse; # replies to abuse reports use the abuse context
|
|
|
658 yahoo.com black; # don't take mail from yahoo
|
|
|
659 spammer@example.com black;
|
|
|
660 };
|
|
|
661 };]]></literallayout>
|
|
|
662 </refsect1>
|
|
94
|
663
|
|
111
|
664 <refsect1 id='version.5'>
|
|
|
665 <title>CVS Version</title>
|
|
108
|
666 <para>
|
|
|
667 $Id$
|
|
|
668 </para>
|
|
|
669 </refsect1>
|
|
|
670
|
|
|
671 </refentry>
|
|
|
672 </reference>
|
