Mercurial > dnsbl

comparison xml/sample.conf @ 75:1142e46be550

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
start coding on new config syntax
author carl
date Wed, 13 Jul 2005 23:04:14 -0700
parents 419e00901570
children 81f1e400e8ab
comparison
equal deleted inserted replaced
74:b7449114ebb0 75:1142e46be550
1 # $Id$ 1 # $Id$
2 # 2 #
3 # lines start with a command token, following by argument tokens 3
4 # tokens are separated by spaces or tabs 4 # partial bnf description of this configuration language
5 # 5 #
6 # 6 # CONFIG = {CONTEXT ";"}+
7 # tld: 7 # CONTEXT = "context" NAME "{" {STATEMENT}+ "}"
8 # second token is the tld suffix - com, net, org, etc 8 # STATEMENT = (DNSBL | DNSBLLIST | CONTENT | ENV-TO | CONTEXT | ENV-FROM) ";"
9 # 9
10 # 10 # DNSBL = "dnsbl" NAME DNSPREFIX ERROR-MSG
11 # content: 11
12 # second token is the dns suffix used for the actual lookups 12 # DNSBLLIST = "dnsbl_list" {NAME}+
13 # third token? is a string enclosed in single quotes, so it 13
14 # is not really a token. This is the error message, with 14 # CONTENT = "content" ("on" | "off") "{" {CONTENT-STATEMENT}+ "}"
15 # up to two %s parameters for the offending host name and 15 # CONTENT-STATEMENT = (FILTER | IGNORE | TLD | HTML-TAGS | HTML-LIMIT | HOST-LIMIT) ";"
16 # client ip address respectively. 16 # FILTER = "filter" DNSPREFIX ERROR-MSG
17 # 17 # IGNORE = "ignore" "{" {HOSTNAME [";"]}+ "}"
18 # If this command is not present, there is no body scanning 18 # TLD = "tld" "{" {TLD [";"]}+ "}"
19 # for host names or bad html tags. 19 # HTML-TAGS = "html_tags" "{" {HTMLTAG [";"]}+ "}"
20 # 20 # ERROR-MSG = string containing exactly two %s replacement tokens for the client ip address
21 # 21
22 # ignore: 22 # HTML-LIMIT = "html_limit" ("on" INTEGER ERROR-MSG | "off")
23 # second token is a host name that is allowed in the body even 23
24 # if it would otherwise be rejected by the content scanning 24 # HOST-LIMIT = "host_limit" ("on" INTEGER ERROR-MSG | "off" | "soft" INTEGER)
25 # above. 25
26 # 26 # ENV-TO = "env_to" "{" {(TO-ADDR | DCC-TO)}+ "}"
27 # 27 # TO-ADDR = ADDRESS [";"]
28 # host_limit: 28 # DCC-TO = "dcc_to" ("ok" | "many") "{" DCCINCLUDEFILE "}" ";"
29 # second token is the integer count of the number of host names 29
30 # or urls that are allowed in any one mail body. Zero is 30 # ENV_FROM = "env_from" DEFAULT "{" {(FROM-ADDR | DCC-FROM)}+ "}"
31 # unlimited. If the actual number of host names in the message 31 # FROM-ADDR = ADDRESS VALUE [";"]
32 # is larger than this limit, the message is rejected. 32 # DCC-FROM = "dcc_from" "{" DCCINCLUDEFILE "}" ";"
33 # third token? is a string enclosed in single quotes, so it 33 # DEFAULT = ("white" | "black" | "unknown" | "inherit" | "")
34 # is not really a token. This is the error message supplied 34 # ADDRESS = (USER@ | DOMAIN | USER@DOMAIN)
35 # to the smtp client. 35 # VALUE = ("white" | "black" | "unknown" | CHILD-CONTEXT-NAME
36 #
37 #
38 # host_soft_limit:
39 # second token is the integer count of the number of host names
40 # or urls that are checked in any one mail body. Zero is
41 # unlimited. If the actual number of host names in the message
42 # is larger than this limit, only a random selection of them
43 # are checked against the dnsbl.
44 #
45 #
46 # html_limit:
47 # second token is the integer count of the number of bad html tags
48 # that are allowed in any one mail body. Zero is unlimited.
49 # third token? is a string enclosed in single quotes, so it
50 # is not really a token. This is the error message supplied
51 # to the smtp client.
52 #
53 #
54 # html_tag:
55 # second token is a valid html tag, that is added to the list
56 # of valid tags. Any html tag seen in the mail bodies that
57 # that is not in this list is presumed to be invalid.
58 #
59 #
60 # dnsbl:
61 # second token is the name of this dnsbl
62 # third token is the dns suffix used for the actual lookups
63 # fourth token? is a string enclosed in single quotes, so it
64 # is not really a token. This is the error message, with
65 # up to two %s parameters for the client ip address.
66 #
67 #
68 # dnsbl_list:
69 # second token is the name of this list of dnsbls
70 # subsequent tokes are the names of the previously defined dnsbls
71 #
72 #
73 # env_from:
74 # second token is the name of this envelope-from-map. There will
75 # generally be multiple lines with the same name.
76 # third token is the envelope from value from the smtp conversation,
77 # or just the domain part that follows the @ symbol.
78 # fourth token is BLACK, WHITE, or the name of a previously defined
79 # envelope-from-map. BLACK causes mail from this sender to be
80 # rejected with "no such user". WHITE causes mail to be accepted
81 # and the dns based lists are ignored. DEFAULT may be used to override
82 # the contents of other maps that are copied into this map, and
83 # set that sender back to the default (not white or black listed,
84 # and subject to dnsbl lookups).
85 #
86 #
87 # env_to:
88 # second token is the envelope recipient value from the smtp conversation,
89 # or just the domain part that follows the @ symbol.
90 # third token is the name of a dnsbl-list, or WHITE or BLACK.
91 # fourth token is the name of an envelope-from-map, or WHITE or BLACK.
92 #
93 # If either one is BLACK, mail to this recipient is rejected with
94 # "no such user", and the dns lists are not checked.
95 #
96 # If the envelope-from-map name is WHITE, mail to this recipient is accepted
97 # and the dns lists are not checked.
98 #
99 # If the envelope-from-map exists, the map is checked for the presence
100 # of the sender. A WHITE or BLACK answer is definitive and the dns lists
101 # are not checked.
102 #
103 # If the dnsbl-list name is WHITE, the dns lists are not checked and the
104 # mail is accepted. Otherwise, the dns lists are checked and the mail
105 # is rejected if any list has an A record for the standard dns based
106 # lookup scheme (reversed octets of the client followed by the dns suffix).
107 #
108 #
109 # include:
110 # second token is the path name of the dnsbl milter config file to be
111 # included.
112 #
113 #
114 # include_dcc:
115 # second token is the name of an envelope-from-map (EMAP below).
116 # third token is the path name of the dcc whiteclnt config file to be
117 # included. Entries from the dcc config are mapped as:
118 # ok -> WHITE
119 # many -> BLACK
120 # env_from -> env_from EMAP xxx
121 # env_to -> env_to
122 # substitute mail_host -> env_from EMAP xxx
123 #
124 #
125 #
126 ##############################################
127 # content scanning parameters
128 #
129 content sbl-xbl.spamhaus.org 'Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s'
130 host_limit 20 'Mail containing too many host names rejected'
131 host_soft_limit 20
132 html_limit 20 'Mail containing excessive bad html tags rejected'
133 include hosts-ignore.conf
134 include html-tags.conf
135 include tld.conf
136 36
137 37
138 ############################################## 38 context sample {
139 # define the dnsbls to use 39 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s";
140 # 40 dnsbl spews blackholes.spews.org "Mail from %s rejected - spews; see http://www.spews.org/ask.cgi?x=%s";
141 dnsbl LOCAL blackholes.five-ten-sg.com 'Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s' 41 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
142 dnsbl SPEWS blackholes.spews.org 'Mail from %s rejected - spews; see http://www.spews.org/ask.cgi?x=%s' 42 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s";
143 dnsbl SBL sbl-xbl.spamhaus.org 'Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s' 43 dnsbl_list local sbl;
144 44
45 content on {
46 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
47 ignore { include "hosts-ignore.conf"; };
48 tld { include "tld.conf"; };
49 html_tags { include "html-tags.conf"; };
50 html_limit off;
51 host_limit on 20 "Mail containing excessive bad html tags rejected";
52 host_limit soft 20;
53 };
145 54
146 ############################################## 55 env_to {
147 # define the (default and other) lists of dnsbls to use 56 mydomain.com; # child contexts are not allowed to specify recipient addresses outside these domains
148 # 57 customer1.com;
149 dnsbl_list DEFAULT LOCAL SPEWS SBL 58 customer1a.com;
150 dnsbl_list SIMPLE SBL 59 customer1b.com;
151 dnsbl_list CUST1 SBL 60 customer2.com;
152 dnsbl_list CUST2 SPEWS SBL 61 customer2a.com;
62 customer2b.com;
63 };
153 64
65 context whitelist {
66 content off {};
67 env_to {
68 # dcc_to ok { include "/var/dcc/whitecommon"; };
69 };
70 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted
71 # so all mail TO these env_to addresses is accepted
72 };
154 73
155 ############################################## 74 context abuse {
156 # define the (default and other) env_from maps 75 dnsbl_list xbl;
157 # 76 content off {};
158 env_from DEFAULT spammer@example.com BLACK 77 env_to {
159 env_from DEFAULT yahoo.com BLACK 78 abuse@; # no content filtering on abuse reports
79 postmaster@; # ""
80 };
81 env_from unknown {}; # ignore all parent white/black listing
82 };
160 83
161 # special list for the vp 84 context minimal {
162 env_from TEST dummy-token DEFAULT # inherit the currently defined DEFAULT env_from mapping 85 dnsbl_list sbl;
163 env_from TEST nai.com BLACK # the vp does not like nai 86 content on {};
164 env_from TEST yahoo.com DEFAULT # 87 env_to {
165 env_from TEST mother@spammyisp.com WHITE # suppresses dnsbl checking 88 sales@mydomain.com;
89 };
90 };
166 91
92 context blacklist {
93 env_to {
94 dcc_to many { include "/var/dcc/whitecommon"; };
95 old-employee@mydomain.com;
96 };
97 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted
98 # so all mail TO these env_to addresses is rejected
99 };
167 100
168 ############################################## 101 context vp { # special context for the vp
169 # specify dnsbl_lists and env_from maps to use for specific recipients 102 env_to {
170 # 103 vp@mydomain.com;
171 env_to abuse@mydomain.com WHITE WHITE # no dnsbl, no env_from map 104 };
172 env_to sales@mydomain.com SIMPLE NULL # sbl only, no env_from map 105 env_from inherit {
173 env_to vp@mydomain.com DEFAULT TEST # allow mail from mom 106 nai.com black; # the vp does not like nai
174 env_to old-emp@mydomain.com BLACK BLACK # return no such user even from backup mx machines 107 yahoo.com unknown; # override parent context blacklisting
108 mother@spammyisp.com white; # suppress dnsbl checking
109 };
110 };
175 111
176 ############################################## 112 context customer1 {
177 # specify dnsbl_lists and env_from maps to use for clients domains 113 dnsbl_list sbl;
178 # 114 env_to {
179 env_to mydomain.com DEFAULT DEFAULT 115 customer1.com;
180 env_to customer1.com CUST1 DEFAULT # all customer 1 domains use just sbl 116 customer1a.com;
181 env_to customer1a.com CUST1 DEFAULT 117 customer1b.com;
182 env_to customer1b.com CUST1 DEFAULT 118 };
183 env_to customer2.com CUST2 DEFAULT # all customer 2 domains use spews and sbl
184 env_to customer2a.com CUST2 DEFAULT
185 119
120 context customer1a {
121 env_to {
122 customer1a.com;
123 }
124 env_from black { # blacklist everything
125 first@acceptable.com unknown; # except these specific envelope senders
126 second@another.com unknown;
127 yahoo.com inherit; # delegate to the parent
128 };
129 };
186 130
187 ############################################## 131 env_from {
188 # you can also include nested config files 132 yahoo.com black; # no mail from yahoo
189 # file names are single tokens, no embedded blanks 133 first@yahoo.com unknown; # except this one
190 # 134 };
191 include dnsbl.conf # this will generate a recursive include file syslog error message 135 };
192 include_dcc DEFAULT /var/dcc/whitecommon # this includes the default dcc whitelist file 136
137 context customer2 {
138 dnsbl_list sbl spews;
139 env_to {
140 customer2.com;
141 customer2a.com;
142 customer2b.com;
143 };
144 };
145
146 env_from unknown {
147 dcc_from { include "/var/dcc/whitecommon"; }; # use the dcc whitecommon list ok/many values to white/black list envelope from values here
148 abuse@ abuse; # replies to abuse reports use the abuse context
149 yahoo.com black; # don't take mail from yahoo
150 spammer@example.com black;
151 };
152 };
153