Mercurial > dnsbl
annotate xml/dnsbl.in @ 184:0e15a805d295 stable-6-0-11
embedded dcc filtering
| author | carl |
|---|---|
| date | Sun, 07 Oct 2007 09:21:50 -0700 |
| parents | e8a822f9cca0 |
| children | f0eda59e8afd |
| rev | line source |
|---|---|
| 108 | 1 <reference> |
| 2 <title>@PACKAGE@ Sendmail milter - Version @VERSION@</title> | |
| 3 <partintro> | |
| 4 <title>Packages</title> | |
| 5 <para>The various source and binary packages are available at <ulink | |
|
114
f4f5fb263072
cleanup list of tlds, add trailing / on http package directory reference
carl
parents:
111
diff
changeset
|
6 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink> |
| 108 | 7 The most recent documentation is available at <ulink |
| 8 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink> | |
| 9 </para> | |
| 94 | 10 |
| 108 | 11 </partintro> |
| 94 | 12 |
| 108 | 13 <refentry id="@PACKAGE@.1"> |
| 14 <refentryinfo> | |
| 184 | 15 <date>2007-10-07</date> |
| 108 | 16 </refentryinfo> |
| 94 | 17 |
| 108 | 18 <refmeta> |
| 19 <refentrytitle>@PACKAGE@</refentrytitle> | |
| 20 <manvolnum>1</manvolnum> | |
| 21 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
| 22 </refmeta> | |
| 23 | |
| 24 <refnamediv id='name.1'> | |
| 25 <refname>@PACKAGE@</refname> | |
| 26 <refpurpose>a sendmail milter with per-user dnsbl filtering</refpurpose> | |
| 27 </refnamediv> | |
| 94 | 28 |
| 108 | 29 <refsynopsisdiv id='synopsis.1'> |
| 30 <title>Synopsis</title> | |
| 31 <cmdsynopsis> | |
| 32 <command>@PACKAGE@</command> | |
| 33 <arg><option>-c</option></arg> | |
| 34 <arg><option>-s</option></arg> | |
| 35 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg> | |
| 36 <arg><option>-e <replaceable class="parameter">from|to</replaceable></option></arg> | |
| 179 | 37 <arg><option>-b <replaceable class="parameter">local-domain-socket</replaceable></option></arg> |
| 108 | 38 <arg><option>-r <replaceable class="parameter">local-domain-socket</replaceable></option></arg> |
| 39 <arg><option>-p <replaceable class="parameter">sendmail-socket</replaceable></option></arg> | |
| 40 <arg><option>-t <replaceable class="parameter">timeout</replaceable></option></arg> | |
| 41 </cmdsynopsis> | |
| 42 </refsynopsisdiv> | |
| 94 | 43 |
| 108 | 44 <refsect1 id='options.1'> |
| 45 <title>Options</title> | |
| 46 <variablelist> | |
| 47 <varlistentry> | |
| 48 <term>-c</term> | |
| 111 | 49 <listitem><para> |
| 50 Load the configuration file, print a cannonical form | |
| 51 of the configuration on stdout, and exit. | |
| 52 </para></listitem> | |
| 108 | 53 </varlistentry> |
| 54 <varlistentry> | |
| 55 <term>-s</term> | |
| 111 | 56 <listitem><para> |
| 57 Stress test the configuration loading code by repeating | |
| 58 the load/free cycle in an infinite loop. | |
| 59 </para></listitem> | |
| 108 | 60 </varlistentry> |
| 61 <varlistentry> | |
| 62 <term>-d <replaceable class="parameter">n</replaceable></term> | |
| 111 | 63 <listitem><para> |
| 64 Set the debug level to <replaceable class="parameter">n</replaceable>. | |
| 65 </para></listitem> | |
| 108 | 66 </varlistentry> |
| 67 <varlistentry> | |
| 68 <term>-e <replaceable class="parameter">from|to</replaceable></term> | |
| 111 | 69 <listitem><para> |
| 70 Print the results of looking up the from and to addresses in the | |
| 71 current configuration. The | character is used to separate the from and to | |
| 72 addresses in the argument to the -e switch. | |
| 73 </para></listitem> | |
| 108 | 74 </varlistentry> |
| 75 <varlistentry> | |
| 179 | 76 <term>-b <replaceable class="parameter">local-domain-socket-file-name</replaceable></term> |
| 77 <listitem><para> | |
| 78 Set the local socket used for the connection to the dccifd daemon. | |
| 79 This is typically /var/dcc/dccifd. | |
| 80 </para></listitem> | |
| 81 </varlistentry> | |
| 82 <varlistentry> | |
| 83 <term>-r <replaceable class="parameter">local-domain-socket-file-name</replaceable></term> | |
| 111 | 84 <listitem><para> |
| 85 Set the local socket used for the connection to our own dns resolver processes. | |
| 86 </para></listitem> | |
| 108 | 87 </varlistentry> |
| 88 <varlistentry> | |
| 89 <term>-p <replaceable class="parameter">sendmail-socket</replaceable></term> | |
| 111 | 90 <listitem><para> |
| 91 Set the socket used for the milter connection to sendmail. This is either | |
| 92 "inet:port@ip-address" or "local:local-domain-socket-file-name". | |
| 93 </para></listitem> | |
| 108 | 94 </varlistentry> |
| 95 <varlistentry> | |
| 96 <term>-t <replaceable class="parameter">timeout</replaceable></term> | |
| 111 | 97 <listitem><para> |
| 98 Set the timeout in seconds used for communication with sendmail. | |
| 99 </para></listitem> | |
| 108 | 100 </varlistentry> |
| 101 </variablelist> | |
| 102 </refsect1> | |
| 94 | 103 |
| 111 | 104 <refsect1 id='usage.1'> |
| 108 | 105 <title>Usage</title> |
| 106 <para><command>@PACKAGE@</command> -c</para> | |
| 107 <para><command>@PACKAGE@</command> -s</para> | |
| 111 | 108 <para><command>@PACKAGE@</command> -e 'someone@aol.com|localname@mydomain.tld'</para> |
| 109 <para><command>@PACKAGE@</command> -d 10 -r resolver.sock -p local:dnsbl.sock</para> | |
| 110 </refsect1> | |
| 111 | |
| 112 <refsect1 id='installation.1'> | |
| 113 <title>Installation</title> | |
| 114 <para> | |
| 115 This is now a standard GNU autoconf/automake installation, so the normal | |
| 116 "./configure; make; su; make install" works. "make chkconfig" will | |
| 117 setup the init.d runlevel scripts. Alternatively, you can use the | |
| 118 source or binary RPMs at <ulink | |
| 119 url="http://www.five-ten-sg.com/@PACKAGE@/packages">http://www.five-ten-sg.com/@PACKAGE@/packages</ulink>. | |
| 120 </para> | |
| 121 <para> | |
| 122 Note that this has ONLY been tested on Linux, specifically RedHat Linux. | |
| 123 In particular, this milter makes no attempt to understand IPv6. Your | |
| 124 mileage will vary. You will need at a minimum a C++ compiler with a | |
| 125 minimally thread safe STL implementation. The distribution includes a | |
| 126 test.cpp program. If it fails this milter won't work. If it passes, | |
| 127 this milter might work. | |
| 128 </para> | |
| 129 <para> | |
| 130 Modify your sendmail.mc by removing all the "FEATURE(dnsbl" lines, add | |
| 131 the following line in your sendmail.mc and rebuild the .cf file | |
| 132 </para> | |
| 133 <para><screen>INPUT_MAIL_FILTER(`dnsbl', `S=local:/var/run/dnsbl/dnsbl.sock, F=T, T=C:30s;S:5m;R:5m;E:5m')</screen></para> | |
| 134 <para> | |
| 135 Modify the default <citerefentry> | |
| 136 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
| 137 </citerefentry> configuration. | |
| 138 </para> | |
| 139 </refsect1> | |
| 140 | |
| 141 <refsect1 id='configuration.1'> | |
| 142 <title>Configuration</title> | |
| 143 <para> | |
| 144 The configuration file is documented in <citerefentry> | |
| 145 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
| 146 </citerefentry>. Any change to the config file, or any file included | |
| 147 from that config file, will cause it to be reloaded within three | |
| 148 minutes. | |
| 149 </para> | |
| 108 | 150 </refsect1> |
| 94 | 151 |
| 108 | 152 <refsect1 id='introduction.1'> |
| 153 <title>Introduction</title> | |
| 154 <para> | |
| 155 Consider the case of a mail server that is acting as secondary MX for a | |
| 156 collection of clients, each of which has a collection of mail domains. | |
| 157 Each client may use their own collection of DNSBLs on their primary mail | |
| 158 server. We present here a mechanism whereby the backup mail server can | |
| 159 use the correct set of DNSBLs for each recipient for each message. As a | |
| 160 side-effect, it gives us the ability to customize the set of DNSBLs on a | |
| 183 | 161 per-recipient basis, so that fred@example.com could use LOCAL and the |
| 108 | 162 SBL, where all other users @example.com use only the SBL. |
| 163 </para> | |
| 164 <para> | |
| 165 This milter can also verify the envelope from/recipient pairs with the | |
| 166 primary MX server. This allows the backup mail servers to properly | |
| 167 reject mail sent to invalid addresses. Otherwise, the backup mail | |
| 168 servers will accept that mail, and then generate a bounce message when | |
| 169 the message is forwarded to the primary server (and rejected there with | |
| 127 | 170 no such user). These rejections are the primary cause of such backscatter. |
| 108 | 171 </para> |
| 172 <para> | |
| 173 This milter will also decode (uuencode, base64, mime, html entity, url | |
| 174 encodings) and scan for HTTP and HTTPS URLs and bare hostnames in the | |
| 175 body of the mail. If any of those host names have A or NS records on | |
| 176 the SBL (or a single configurable DNSBL), the mail will be rejected | |
| 177 unless previously whitelisted. This milter also counts the number of | |
| 178 invalid HTML tags, and can reject mail if that count exceeds your | |
| 179 specified limit. | |
| 180 </para> | |
| 181 <para> | |
| 136 | 182 This milter can also impose hourly rate limits on the number of |
| 183 recipients accepted from SMTP AUTH connections, that would otherwise be | |
| 184 allowed to relay thru this mail server with no spam filtering. | |
| 185 </para> | |
| 186 <para> | |
| 162 | 187 Consider the case of a message from A to B passing thru this milter. If |
| 188 that message is not blocked, then we might eventually see a reply | |
| 156 | 189 message from B to A. If the filtering context for A includes an |
| 162 | 190 autowhite entry, and that context does <emphasis>not</emphasis> cover B |
| 191 as a recipient, then this milter will add an entry in that file to | |
| 192 whitelist such replies for a configurable time period. Suppose A and B | |
| 193 are in the same domain, or at least use the same filtering context. In | |
| 194 that case we don't want to add a whitelist entry for B, since that would | |
| 195 then allow spammers to send mail from B (forged) to B. Such autowhite | |
| 160 | 196 files need to be writeable by the dnsbl user, where all the other dnsbl |
| 197 configuration files only need to be readable by the dnsbl user. | |
| 156 | 198 </para> |
| 199 <para> | |
|
176
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
200 You can manually add such an autowhite entry, by appending a single |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
201 text line to the autowhitelist file, using something like |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
202 <command>echo "$mail 0" >>$autowhitefile</command>. |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
203 You can manually remove such an autowhite entry, by appending a single |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
204 text line to the autowhitelist file, using something like |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
205 <command>echo "$mail 1" >>$autowhitefile</command>. |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
206 </para> |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
207 <para> |
| 108 | 208 The DNSBL milter reads a text configuration file (dnsbl.conf) on |
| 209 startup, and whenever the config file (or any of the referenced include | |
| 210 files) is changed. The entire configuration file is case insensitive. | |
| 211 If the configuration cannot be loaded due to a syntax error, the milter | |
| 212 will log the error and quit. If the configuration cannot be reloaded | |
| 213 after being modified, the milter will log the error and send an email to | |
| 152 | 214 root from dnsbl@$hostname. You probably want to add dnsbl@$hostname |
| 108 | 215 to your /etc/mail/virtusertable since otherwise sendmail will reject |
| 216 that message. | |
| 217 </para> | |
| 218 </refsect1> | |
| 94 | 219 |
| 111 | 220 <refsect1 id='dcc.1'> |
| 108 | 221 <title>DCC Issues</title> |
| 222 <para> | |
| 223 If you are also using the <ulink | |
| 224 url="http://www.rhyolite.com/anti-spam/dcc/">DCC</ulink> milter, there | |
| 225 are a few considerations. You may need to whitelist senders from the | |
| 226 DCC bulk detector, or from the DNS based lists. Those are two very | |
| 227 different reasons for whitelisting. The former is done thru the DCC | |
| 228 whiteclnt config file, the later is done thru the DNSBL milter config | |
| 229 file. | |
| 230 </para> | |
| 231 <para> | |
| 232 You may want to blacklist some specific senders or sending domains. | |
| 233 This could be done thru either the DCC (on a global basis, or for a | |
| 234 specific single recipient). We prefer to do such blacklisting via the | |
| 235 DNSBL milter config, since it can be done for a collection of recipient | |
| 236 mail domains. The DCC approach has the feature that you can capture the | |
| 237 entire message in the DCC log files. The DNSBL milter approach has the | |
| 238 feature that the mail is rejected earlier (at RCPT TO time), and the | |
| 239 sending machine just gets a generic "550 5.7.1 no such user" message. | |
| 240 </para> | |
| 241 <para> | |
| 242 The DCC whiteclnt file can be included in the DNSBL milter config by the | |
| 243 dcc_to and dcc_from statements. This will import the (env_to, env_from, | |
| 244 and substitute mail_host) entries from the DCC config into the DNSBL | |
| 245 config. This allows using the DCC config as the single point for | |
| 246 white/blacklisting. | |
| 247 </para> | |
| 248 <para> | |
| 249 Consider the case where you have multiple clients, each with their own | |
| 250 mail servers, and each running their own DCC milters. Each client is | |
| 251 using the DCC facilities for envelope from/to white/blacklisting. | |
| 252 Presumably you can use rsync or scp to fetch copies of your clients DCC | |
| 253 whiteclnt files on a regular basis. Your mail server, acting as a | |
| 254 backup MX for your clients, can use the DNSBL milter, and include those | |
| 255 client DCC config files. The envelope from/to white/blacklisting will | |
| 256 be appropriately tagged and used only for the domains controlled by each | |
| 257 of those clients. | |
| 258 </para> | |
| 179 | 259 <para> |
| 260 You can now use (via dccifd) different dcc filtering parameters on a per | |
| 261 context basis. See the dcc_greylist and dcc_bulk_threshold statements | |
| 262 in the <citerefentry> <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
| 263 <manvolnum>5</manvolnum> </citerefentry> configuration. Those | |
| 264 statements are only active if you supply the <option>-b</option> option | |
| 265 on the dnsbl command line. If you use the dcc via the standard dcc | |
| 266 milter (dccm), then connections from clients that use SMTP AUTH are | |
| 267 still subject to greylisting. If you use the dcc via dccifd and this | |
| 268 milter, then connections from clients that use SMTP AUTH are never | |
| 180 | 269 subject to greylisting. As part of this per-user greylisting, you need |
| 270 to move the dnsblnogrey file from the config directory to something | |
| 271 like /var/dcc/userdirs/local/dnsblnogrey/whiteclnt so the dccifd will | |
| 272 properly ignore greylisting for those recipients that don't want it. | |
| 179 | 273 </para> |
| 108 | 274 </refsect1> |
| 94 | 275 |
| 111 | 276 <refsect1 id='definitions.1'> |
| 108 | 277 <title>Definitions</title> |
| 278 <para> | |
| 279 CONTEXT - a collection of parameters that defines the filtering context | |
| 280 to be used for a collection of envelope recipient addresses. The | |
| 281 context includes such things as the list of DNSBLs to be used, and the | |
| 282 various content filtering parameters. | |
| 283 </para> | |
| 284 <para> | |
| 285 DNSBL - a named DNS based blocking list is defined by a dns suffix (e.g. | |
| 286 sbl-xbl.spamhaus.org) and a message string that is used to generate the | |
| 287 "550 5.7.1" smtp error return code. The names of these DNSBLs will be | |
| 288 used to define the DNSBL-LISTs. | |
| 289 </para> | |
| 290 <para> | |
| 291 DNSBL-LIST - a named list of DNSBLs that will be used for specific | |
| 292 recipients or recipient domains. | |
| 293 </para> | |
| 294 </refsect1> | |
| 94 | 295 |
| 111 | 296 <refsect1 id='filtering.1'> |
| 108 | 297 <title>Filtering Procedure</title> |
| 298 <para> | |
| 152 | 299 The SMTP envelope 'from' and 'to' values are used in various checks. |
| 300 The first check is to see if a reply message (swapping the env_from and | |
| 160 | 301 env_to values) would be unconditionally blocked (just based on the |
| 302 envelope from address). That check is similar to the main check | |
| 303 described below, but there is no body content to be scanned, and there | |
| 304 is no client connection ip address to be checked against DNSBLs. If | |
| 305 such a reply message would be blocked, we also block the original | |
| 306 outgoing message. This prevents folks from sending mail to recipients | |
| 307 that are unable to reply. | |
| 152 | 308 </para> |
| 309 <para> | |
| 136 | 310 If the client has authenticated with sendmail, the rate limits are |
| 311 checked. If the authenticated user has not exceeded the hourly rate | |
|
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
312 limit, then the mail is accepted, the filtering contexts are not used, |
| 136 | 313 the dns lists are not checked, and the body content is not scanned. If |
| 314 the client has not authenticated with sendmail, we follow these steps | |
| 315 for each recipient. | |
| 108 | 316 </para> |
| 317 <orderedlist> | |
| 111 | 318 <listitem><para> |
| 108 | 319 The envelope to email address is used to find an initial filtering |
| 320 context. We first look for a context that specified the full email | |
| 321 address in the env_to statement. If that is not found, we look for a | |
| 322 context that specified the entire domain name of the envelope recipient | |
| 323 in the env_to statement. If that is not found, we look for a context | |
| 324 that specified the user@ part of the envelope recipient in the env_to | |
| 325 statement. If that is not found, we use the first top level context | |
| 326 defined in the config file. | |
| 111 | 327 </para></listitem> |
| 328 <listitem><para> | |
| 108 | 329 The initial filtering context may redirect to a child context based on |
| 330 the values in the initial context's env_from statement. We look for [1) | |
| 331 the full envelope from email address, 2) the domain name part of the | |
| 332 envelope from address, 3) the user@ part of the envelope from address] | |
| 333 in that context's env_from statement, with values that point to a child | |
| 334 context. If such an entry is found, we switch to that child filtering | |
| 335 context. | |
| 111 | 336 </para></listitem> |
| 337 <listitem><para> | |
| 108 | 338 We lookup [1) the full envelope from email address, 2) the domain name |
| 339 part of the envelope from address, 3) the user@ part of the envelope | |
| 340 from address] in the filtering context env_from statement. That results | |
| 341 in one of (white, black, unknown, inherit). | |
| 111 | 342 </para></listitem> |
| 343 <listitem><para> | |
| 108 | 344 If the answer is black, mail to this recipient is rejected with "no such |
| 345 user", and the dns lists are not checked. | |
| 111 | 346 </para></listitem> |
| 347 <listitem><para> | |
| 108 | 348 If the answer is white, mail to this recipient is accepted and the dns |
| 349 lists are not checked. | |
| 111 | 350 </para></listitem> |
| 351 <listitem><para> | |
| 108 | 352 If the answer is unknown, we don't reject yet, but the dns lists will be |
| 353 checked, and the content may be scanned. | |
| 111 | 354 </para></listitem> |
| 355 <listitem><para> | |
| 108 | 356 If the answer is inherit, we repeat the envelope from search in the |
| 357 parent context. | |
| 111 | 358 </para></listitem> |
| 359 <listitem><para> | |
| 168 | 360 If the mail has not been accepted or rejected yet, the dns lists |
| 361 specified in the filtering context are checked and the mail is rejected | |
| 362 if any list has an A record for the standard dns based lookup scheme | |
| 363 (reversed octets of the client followed by the dns suffix). | |
| 364 </para></listitem> | |
| 365 <listitem><para> | |
| 366 If the mail has not been accepted or rejected yet, and the filtering | |
| 170 | 367 context (or any ancestor context) specifies a non-empty generic regular |
| 368 expression, then we check the fully qualified client name (obtained via | |
| 369 the sendmail macro "_"). The mail is rejected if the client name | |
| 370 matches the specified regular expression. | |
| 111 | 371 </para></listitem> |
| 372 <listitem><para> | |
| 108 | 373 If the mail has not been accepted or rejected yet, we look for a |
| 374 verification context, which is the closest ancestor of the filtering | |
| 375 context that both specifies a verification host, and which covers the | |
| 376 envelope to address. If we find such a verification context, and the | |
| 377 verification host is not our own hostname, we open an smtp conversation | |
| 378 with that verification host. The current envelope from and recipient to | |
| 379 values are passed to that verification host. If we receive a 5xy | |
| 380 response those commands, we reject the current recipient with "no such | |
| 381 user". | |
| 111 | 382 </para></listitem> |
| 383 <listitem><para> | |
| 108 | 384 If the mail has not been accepted or rejected yet, and the filtering |
| 385 context enables content filtering, and this is the first such recipient | |
| 386 in this smtp transaction, we set the content filtering parameters from | |
| 387 this context, and enable content filtering for the body of this message. | |
| 111 | 388 </para></listitem> |
| 108 | 389 </orderedlist> |
| 390 <para> | |
| 160 | 391 For each recipient that was accepted, we search for an autowhite entry |
| 392 starting in the reply filtering context. If an autowhite entry is found, | |
| 393 we add the recipient to that auto whitelist file. This will prevent reply | |
| 394 messages from being blocked by the dnsbl or content filtering. | |
| 395 </para> | |
| 396 <para> | |
| 108 | 397 If content filtering is enabled for this body, the mail text is decoded |
| 119 | 398 (uuencode, base64, mime, html entity, url encodings), and scanned for HTTP |
| 399 and HTTPS URLs or bare host names. Hostnames must be either ip address | |
| 400 literals, or must end in a string defined by the TLD list. The first | |
| 401 <configurable> host names are checked as follows. | |
| 402 </para> | |
| 403 <para> | |
| 404 The only known list that is suitable for the content filter DNSBL is the | |
| 405 SBL. If the content filter DNSBL is defined, and any of those host | |
| 406 names resolve to ip addresses that are on that DNSBL (or have | |
| 407 nameservers that are on that list), and the host name is not on the | |
| 408 <configurable> ignore list, the mail is rejected. | |
| 409 </para> | |
| 410 <para> | |
| 411 If the content uribl DNSBL is defined, and any of those host names are | |
| 412 on that DNSBL, and the host name is not on the <configurable> | |
| 413 ignore list, the mail is rejected. | |
| 414 </para> | |
| 415 <para> | |
|
167
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
416 If any non-whitelisted recipient has a filtering context with a non-zero |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
417 spamassassin limit, then the message is passed thru spamassassin (via |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
418 spamc), and the message is rejected for those recipients with spamassassin |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
419 limits less than the resulting spamassassin score. |
| 163 | 420 </para> |
| 421 <para> | |
| 119 | 422 We also scan for excessive bad html tags, and if a <configurable> |
| 423 limit is exceeded, the mail is rejected. | |
| 108 | 424 </para> |
| 425 </refsect1> | |
| 94 | 426 |
| 111 | 427 <refsect1 id='access.1'> |
| 108 | 428 <title>Sendmail access vs. DNSBL</title> |
| 429 <para> | |
| 430 With the standard sendmail.mc dnsbl FEATURE, the dnsbl checks may be | |
| 431 suppressed by entries in the /etc/mail/access database. For example, | |
| 432 suppose you control a /18 of address space, and have allocated some /24s | |
| 433 to some clients. You have access entries like | |
| 111 | 434 <literallayout class="monospaced"><![CDATA[ |
| 435 192.168.4 OK | |
| 436 192.168.17 OK]]></literallayout> | |
| 108 | 437 </para> |
| 438 <para> | |
| 439 to allow those clients to smarthost thru your mail server. Now if one | |
| 440 of those clients happens get infected with a virus that turns a machine | |
| 441 into an open proxy, and their 192.168.4.45 lands on the SBL-XBL, you | |
| 442 will still wind up allowing that infected machine to smarthost thru your | |
| 443 mail servers. | |
| 444 </para> | |
| 445 <para> | |
| 446 With this DNSBL milter, the sendmail access database cannot override the | |
| 447 dnsbl checks, so that machine won't be able to send mail to or thru your | |
| 448 smarthost mail server (unless the virus/proxy can use smtp-auth). | |
| 449 </para> | |
| 450 <para> | |
| 451 Using the standard sendmail features, you would add access entries to | |
| 452 allow hosts on your local network to relay thru your mail server. Those | |
| 453 OK entries in the sendmail access database will override all the dnsbl | |
| 454 checks. With this DNSBL milter, you will need to have the local users | |
| 455 authenticate with smtp-auth to get the same effect. You might find | |
| 456 <ulink | |
| 457 url="http://www.ists.dartmouth.edu/classroom/sendmail-ssl-how-to.php"> | |
| 458 these directions</ulink> helpful for setting up smtp-auth if you are on | |
| 459 RH Linux. | |
| 460 </para> | |
| 461 </refsect1> | |
| 94 | 462 |
| 111 | 463 <refsect1 id='performance.1'> |
| 108 | 464 <title>Performance Issues</title> |
| 465 <para> | |
| 466 Consider a high volume high performance machine running sendmail. Each | |
| 467 sendmail process can do its own dns resolution. Typically, such dns | |
| 468 resolver libraries are not thread safe, and so must be protected by some | |
| 469 sort of mutex in a threaded environment. When we add a milter to | |
| 470 sendmail, we now have a collection of sendmail processes, and a | |
| 471 collection of milter threads. | |
| 472 </para> | |
| 473 <para> | |
| 474 We will be doing a lot of dns lookups per mail message, and at least | |
| 475 some of those will take many tens of seconds. If all this dns work is | |
| 476 serialized inside the milter, we have an upper limit of about 25K mail | |
| 477 messages per day. That is clearly not sufficient for many sites. | |
| 478 </para> | |
| 479 <para> | |
| 480 Since we want to do parallel dns resolution across those milter threads, | |
| 481 we add another collection of dns resolver processes. Each sendmail | |
| 482 process is talking to a milter thread over a socket, and each milter | |
| 483 thread is talking to a dns resolver process over another socket. | |
| 484 </para> | |
| 485 <para> | |
| 486 Suppose we are processing 20 messages per second, and each message | |
| 487 requires 20 seconds of dns work. Then we will have 400 sendmail | |
| 488 processes, 400 milter threads, and 400 dns resolver processes. Of | |
| 489 course that steady state is very unlikely to happen. | |
| 490 </para> | |
| 491 </refsect1> | |
| 94 | 492 |
| 493 | |
| 111 | 494 <refsect1 id='rejected.1'> |
| 108 | 495 <title>Rejected Ideas</title> |
| 496 <para> | |
| 497 The following ideas have been considered and rejected. | |
| 498 </para> | |
| 499 <para> | |
| 111 | 500 Add max_recipients setting to the context configuration. Recipients in |
| 501 excess of that limit will be rejected, and all the non-whitelisted | |
| 502 recipients will be removed. Current spammers *very* rarely send more | |
| 503 than ten recipients in a single smtp transaction, so this won't stop any | |
| 108 | 504 significant amount of spam. |
| 505 </para> | |
| 506 <para> | |
| 507 Add poison addresses to the configuration. If any recipient is | |
| 508 poison, all recipients are rejected even if they would be whitelisted, | |
| 509 and the data is rejected if sent. I have a collection of spam trap | |
| 510 addresses that would be suitable for such use. Based on my log files, | |
| 511 any mail to those spam trap addresses is rejected based on either dnsbl | |
| 512 lookups or the DCC. So this won't result in blocking any additional | |
| 513 spam. | |
| 514 </para> | |
| 515 <para> | |
| 516 Add an option to only allow one recipient if the return path is | |
| 517 empty. Based on my log files, there is no mail that violates this | |
| 518 check. | |
| 519 </para> | |
| 520 <para> | |
| 521 Reject the mail if the envelope from domain name contains any MX | |
| 522 records pointing to 127.0.0.0/8. I don't see any significant amount of | |
| 523 spam sent with such domain names. | |
| 524 </para> | |
| 525 </refsect1> | |
| 94 | 526 |
| 108 | 527 <refsect1 id='todo.1'> |
| 528 <title>TODO</title> | |
| 529 <para> | |
| 530 The following ideas are under consideration. | |
| 531 </para> | |
| 532 <para> | |
| 533 Add a per-context option to reject mail if the number of digits in | |
| 534 the reverse dns client name exceeds some threshold. | |
| 535 </para> | |
| 115 | 536 <para> |
| 537 Look for href="hostname/path" strings that are missing the required | |
| 538 http:// protocol header. Such references are still clickable in common | |
| 539 mail software. | |
| 540 </para> | |
| 108 | 541 </refsect1> |
| 94 | 542 |
| 111 | 543 <refsect1 id='copyright.1'> |
| 108 | 544 <title>Copyright</title> |
| 545 <para> | |
| 163 | 546 Copyright (C) 2007 by 510 Software Group <carl@five-ten-sg.com> |
| 108 | 547 </para> |
| 548 <para> | |
| 549 This program is free software; you can redistribute it and/or modify it | |
| 550 under the terms of the GNU General Public License as published by the | |
| 160 | 551 Free Software Foundation; either version 3, or (at your option) any |
| 108 | 552 later version. |
| 553 </para> | |
| 554 <para> | |
| 555 You should have received a copy of the GNU General Public License along | |
| 556 with this program; see the file COPYING. If not, please write to the | |
| 557 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. | |
| 558 </para> | |
| 559 </refsect1> | |
| 94 | 560 |
| 111 | 561 <refsect1 id='version.1'> |
| 562 <title>CVS Version</title> | |
| 108 | 563 <para> |
| 564 $Id$ | |
| 565 </para> | |
| 566 </refsect1> | |
| 567 </refentry> | |
| 568 | |
| 569 | |
| 570 <refentry id="@PACKAGE@.conf.5"> | |
| 571 <refentryinfo> | |
| 184 | 572 <date>2007-10-07</date> |
| 108 | 573 </refentryinfo> |
| 94 | 574 |
| 108 | 575 <refmeta> |
| 576 <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
| 577 <manvolnum>5</manvolnum> | |
| 578 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
| 579 </refmeta> | |
| 94 | 580 |
| 108 | 581 <refnamediv id='name.5'> |
| 582 <refname>@PACKAGE@.conf</refname> | |
| 111 | 583 <refpurpose>configuration file for @PACKAGE@ sendmail milter</refpurpose> |
| 108 | 584 </refnamediv> |
| 585 | |
| 586 <refsynopsisdiv id='synopsis.5'> | |
| 587 <title>Synopsis</title> | |
| 588 <cmdsynopsis> | |
| 589 <command>@PACKAGE@.conf</command> | |
| 590 </cmdsynopsis> | |
| 591 </refsynopsisdiv> | |
| 94 | 592 |
| 108 | 593 <refsect1 id='description.5'> |
| 594 <title>Description</title> | |
| 595 <para>The <command>@PACKAGE@.conf</command> configuration file is | |
|
148
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
596 specified by this partial bnf description. Comments start with // |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
597 or # and extend to the end of the line. To include the contents |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
598 of some file verbatim in the dnsbl.conf file, use |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
599 <literallayout class="monospaced"><![CDATA[include "<file>";]]></literallayout> |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
600 </para> |
| 108 | 601 |
| 602 <literallayout class="monospaced"><![CDATA[ | |
| 603 CONFIG = {CONTEXT ";"}+ | |
| 604 CONTEXT = "context" NAME "{" {STATEMENT}+ "}" | |
| 168 | 605 STATEMENT = (DNSBL | DNSBLLIST | CONTENT | ENV-TO | VERIFY | GENERIC |
| 606 | AUTOWHITE | CONTEXT | ENV-FROM | RATE-LIMIT) ";" | |
| 108 | 607 |
| 124 | 608 DNSBL = "dnsbl" NAME DNSPREFIX ERROR-MSG1 |
| 108 | 609 |
| 610 DNSBLLIST = "dnsbl_list" {NAME}+ | |
| 94 | 611 |
| 108 | 612 CONTENT = "content" ("on" | "off") "{" {CONTENT-ST}+ "}" |
| 178 | 613 CONTENT-ST = (FILTER | URIBL | IGNORE | TLD | CCTLD | HTML-TAGS | |
| 614 HTML-LIMIT | HOST-LIMIT | SPAMASS | REQUIRE | DCCGREY | | |
| 615 DCCBULK) ";" | |
| 124 | 616 FILTER = "filter" DNSPREFIX ERROR-MSG2 |
| 617 URIBL = "uribl" DNSPREFIX ERROR-MSG3 | |
| 108 | 618 IGNORE = "ignore" "{" {HOSTNAME [";"]}+ "}" |
| 619 TLD = "tld" "{" {TLD [";"]}+ "}" | |
| 119 | 620 CCTLD = "cctld" "{" {TLD [";"]}+ "}" |
| 108 | 621 HTML-TAGS = "html_tags" "{" {HTMLTAG [";"]}+ "}" |
| 124 | 622 ERROR-MSG1 = string containing exactly two %s replacement tokens |
| 623 both are replaced with the client ip address | |
| 624 ERROR-MSG2 = string containing exactly two %s replacement tokens | |
| 625 the first is replaced with the hostname, and the second | |
| 626 is replaced with the ip address | |
| 627 ERROR-MSG3 = string containing exactly two %s replacement tokens | |
| 628 both are replaced with the hostname | |
| 108 | 629 |
| 630 HTML-LIMIT = "html_limit" ("on" INTEGER ERROR-MSG | "off") | |
| 631 | |
| 111 | 632 HOST-LIMIT = "host_limit" ("on" INTEGER ERROR-MSG | "off" | |
| 633 "soft" INTEGER) | |
| 178 | 634 SPAMASS = "spamassassin" INTEGER |
| 635 REQUIRE = "require_match" ("yes" | "no") | |
| 636 DCCGREY = "dcc_greylist" ("yes" | "no") | |
| 637 DCCBULK = "dcc_bulk_threshold" (INTEGER | "many" | "off") | |
| 94 | 638 |
| 108 | 639 ENV-TO = "env_to" "{" {(TO-ADDR | DCC-TO)}+ "}" |
| 640 TO-ADDR = ADDRESS [";"] | |
| 641 DCC-TO = "dcc_to" ("ok" | "many") "{" DCCINCLUDEFILE "}" ";" | |
| 642 | |
| 643 VERIFY = "verify" HOSTNAME ";" | |
| 168 | 644 GENERIC = "generic" REGULAREXPRESSION ERROR-MSG4 ";" |
| 645 ERROR-MSG4 = string containing exactly one %s replacement token | |
| 646 which is replaced with the client name | |
| 153 | 647 AUTOWHITE = "autowhite" DAYS FILENAME ";" |
| 108 | 648 |
| 649 ENV_FROM = "env_from" [DEFAULT] "{" {(FROM-ADDR | DCC-FROM)}+ "}" | |
| 650 FROM-ADDR = ADDRESS VALUE [";"] | |
| 651 DCC-FROM = "dcc_from" "{" DCCINCLUDEFILE "}" ";" | |
| 136 | 652 |
| 140 | 653 RATE-LIMIT = "rate_limit" [DEFAULTLIMIT] "{" (RATE)+ "}" |
| 136 | 654 RATE = USER LIMIT [";"] |
| 655 | |
| 108 | 656 DEFAULT = ("white" | "black" | "unknown" | "inherit" | "") |
| 657 ADDRESS = (USER@ | DOMAIN | USER@DOMAIN) | |
|
148
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
658 VALUE = ("white" | "black" | "unknown" | "inherit" | CHILD-CONTEXT-NAME)]]></literallayout> |
| 108 | 659 </refsect1> |
| 94 | 660 |
| 108 | 661 <refsect1 id='sample.5'> |
| 662 <title>Sample</title> | |
| 663 <literallayout class="monospaced"><![CDATA[ | |
| 127 | 664 context main-default { |
| 665 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
| 666 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 174 | 667 dnsbl_list sbl; |
| 127 | 668 |
| 669 // outbound content filtering to prevent our own customers from sending spam | |
| 670 content on { | |
| 671 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 672 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; | |
| 673 #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; | |
| 674 ignore { include "hosts-ignore.conf"; }; | |
| 675 tld { include "tld.conf"; }; | |
| 676 cctld { include "cctld.conf"; }; | |
| 677 html_tags { include "html-tags.conf"; }; | |
| 678 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
| 679 html_limit off; | |
| 680 host_limit on 20 "Mail containing excessive host names rejected"; | |
| 681 host_limit soft 20; | |
| 178 | 682 spamassassin 4; |
| 683 require_match yes; | |
| 684 dcc_greylist yes; | |
| 685 dcc_bulk_threshold 50; | |
| 127 | 686 }; |
| 687 | |
| 688 // backscatter prevention - don't send bounces for mail that we accepted but could not forward | |
| 689 // we only send bounces to our own customers | |
| 690 env_from unknown { | |
| 691 "<>" black; | |
| 692 }; | |
| 136 | 693 |
|
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
694 // hourly recipient rate limit by smtp auth client id |
| 140 | 695 rate_limit 30 { // default |
| 171 | 696 #fred 100; // override default limits |
| 697 #joe 10; // "" | |
| 136 | 698 }; |
| 127 | 699 }; |
| 700 | |
| 171 | 701 context main { |
| 702 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; | |
| 108 | 703 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 174 | 704 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 108 | 705 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 171 | 706 dnsbl_list local sbl; |
| 94 | 707 |
| 108 | 708 content on { |
| 709 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 122 | 710 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; |
| 119 | 711 #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
| 108 | 712 ignore { include "hosts-ignore.conf"; }; |
| 713 tld { include "tld.conf"; }; | |
| 119 | 714 cctld { include "cctld.conf"; }; |
| 108 | 715 html_tags { include "html-tags.conf"; }; |
| 716 html_limit off; | |
| 717 host_limit soft 20; | |
| 178 | 718 spamassassin 5; |
| 719 require_match yes; | |
| 720 dcc_greylist yes; | |
| 721 dcc_bulk_threshold 20; | |
| 108 | 722 }; |
| 94 | 723 |
|
175
e726e1a61ef9
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
174
diff
changeset
|
724 generic "(^|[.-])(ppp|h|host)?([0-9]{1,3}[.-](Red-|dynamic[.-])?){4}" |
| 171 | 725 "your mail server %s seems to have a generic name"; |
| 726 | |
| 108 | 727 env_to { |
| 171 | 728 # !! replace this with your domain names |
| 108 | 729 # child contexts are not allowed to specify recipient addresses outside these domains |
| 179 | 730 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx |
| 174 | 731 include "/etc/mail/local-host-names"; |
| 108 | 732 }; |
| 94 | 733 |
| 108 | 734 context whitelist { |
| 735 content off {}; | |
| 736 env_to { | |
| 171 | 737 # dcc_to ok { include "/var/dcc/whitecommon"; }; |
| 108 | 738 }; |
| 739 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
| 740 # so all mail TO these env_to addresses is accepted | |
| 741 }; | |
| 94 | 742 |
| 171 | 743 context abuse { |
| 744 dnsbl_list xbl; | |
| 745 content off {}; | |
| 174 | 746 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 171 | 747 env_to { |
| 748 abuse@ # no content filtering on abuse reports | |
| 749 postmaster@ # "" | |
| 750 }; | |
| 751 env_from unknown {}; # ignore all parent white/black listing | |
| 752 }; | |
| 753 | |
| 108 | 754 context minimal { |
| 171 | 755 dnsbl_list sbl; |
| 178 | 756 content on { |
| 757 spamassassin 10; | |
| 758 dcc_bulk_threshold many; | |
| 759 }; | |
| 171 | 760 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 108 | 761 env_to { |
| 762 }; | |
| 763 }; | |
| 94 | 764 |
| 108 | 765 context blacklist { |
| 766 env_to { | |
| 171 | 767 # dcc_to many { include "/var/dcc/whitecommon"; }; |
| 108 | 768 }; |
| 769 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
| 770 # so all mail TO these env_to addresses is rejected | |
| 771 }; | |
| 94 | 772 |
| 171 | 773 env_from unknown { |
| 774 abuse@ abuse; # replies to abuse reports use the abuse context | |
| 775 # dcc_from { include "/var/dcc/whitecommon"; }; | |
| 108 | 776 }; |
| 777 | |
| 171 | 778 autowhite 90 "autowhite/my-auto-whitelist"; |
| 779 # install should create /etc/dnsbl/autowhite writable by userid dnsbl | |
| 108 | 780 };]]></literallayout> |
| 781 </refsect1> | |
| 94 | 782 |
| 111 | 783 <refsect1 id='version.5'> |
| 784 <title>CVS Version</title> | |
| 108 | 785 <para> |
| 786 $Id$ | |
| 787 </para> | |
| 788 </refsect1> | |
| 789 | |
| 790 </refentry> | |
| 791 </reference> |