milter-spamc/1.16
|
Boolean "YES" or "NO" as to whether the message is spam. | ||
Zero or more 'x' characters representing the message score. Note that the choice of 'x' is intentional, since its a neutral character. Asterisk, '*', and many other punctuation characters have special mean in regular expressions and some other pattern matching languages, that they can be error prone to scan for as literals. | ||
A summary line stating "YES" or "NO", the message score, and the SpamAssassin spam threshold. | ||
The report as returned by SpamAssassin. It normally provides a summary of the rules triggered, their scores, and brief description.
The report format can be customised through SpamAssassin's /etc/mail/spamassassin/local.cf file.
|
||
When a spam message is redirected to a collection address, one or more of these headers are added for each RCPT address given to Sendmail. These headers can be used should there be a need to resend a message to the original recipients. | ||
The milter name, version number, host name, host IP, and timestamp. Note there might be multiple instances of this header, one for each participating scan milter, in which case they should represent the most recent to oldest, similar to Received: header behaviour. This ordering is handled by Sendmail and not configurable. |
Please note that national privacy laws vary from country to country and that it may be illegal to scan or archive electronic correspondence, even for the purpose of filtering unsolicited bulk email. It is the responsibility of businesses and system administrators to determine what are their rights with respect to electronic mail filtering in their country of residence.
milter-spamc
[options ...][arguments ...]
Options can be expressed in four different ways. Boolean options are expressed as +option or -option to turn the option on or off respectively. Options that required a value are expressed as option=value or option+=value for appending to a value list. Note that the +option and -option syntax are equivalent to option=1 and option=0 respectively. Option names are case insensitive.
Some options, like +help or -help, are treated as immediate actions or commands. Unknown options are ignored. The first command-line argument is that which does not adhere to the above option syntax. The special command-line argument -- can be used to explicitly signal an end to the list of options.
The default options, as shown below, can be altered by specifying them on the command-line or within an option file, which simply contains command-line options one or more per line and/or on multiple lines. Comments are allowed and are denoted by a line starting with a hash (#) character. If the file option is defined and not empty, then it is parsed first followed by the command-line options.
Note that there may be additional options that are listed in the option summary given by +help or -help that are not described here.
text!/path/map.txt R/O text file, memory hash /path/map.db Berkeley DB hash format db!/path/map.db Berkeley DB hash format db!btree!/path/map.db Berkeley DB btree format sql!/path/database An SQLite3 database socketmap!host:port Sendmail style socket-map socketmap!/path/local/socket Sendmail style socket-map socketmap!123.45.67.89:port Sendmail style socket-map socketmap![2001:0DB8::1234]:port Sendmail style socket-map
If :port is omitted, the default is 7953.
The access-db contains key-value pairs. Lookups are performed from most to least specific, stopping on the first entry found. Keys are case-insensitive.
An IPv4 lookup is repeated several times reducing the IP address by one octet from right to left until a match is found.
tag:192.0.2.9 tag:192.0.2 tag:192.0 tag:192
An IPv6 lookup is repeated several times reducing the IP address by one 16-bit word from right to left until a match is found.
tag:2001:0DB8:0:0:0:0:1234:5678 tag:2001:0DB8:0:0:0:0:1234 tag:2001:0DB8:0:0:0:0 tag:2001:0DB8:0:0:0 tag:2001:0DB8:0:0 tag:2001:0DB8:0:0 tag:2001:0DB8:0 tag:2001:0DB8 tag:2001
A domain lookup is repeated several times reducing the domain by one label from left to right until a match is found.
tag:[ipv6:2001:0DB8::1234:5678] tag:[192.0.2.9] tag:sub.domain.tld tag:domain.tld tag:tld tag:
An email lookup is similar to a domain lookup, the exact address is first tried, then the address's domain, and finally the local part of the address.
tag:account@sub.domain.tld tag:sub.domain.tld tag:domain.tld tag:tld tag:account@ tag:
If a key is found and is a milter specific tag (ie. milter-spamc-Connect, milter-spamc-From, milter-spamc-Auth, milter-spamc-To), then the value is processed as a pattern list and the result returned. The Sendmail variants cannot have a pattern list. A pattern list is a whitespace separated list of pattern-action pairs followed by an optional default action. The supported patterns are:
[network/cidr]action Classless Inter-Domain Routing !pattern!action Simple fast text matching. /regex/action POSIX Extended Regular Expressions
The CIDR will only ever match for IP address related lookups.
A !pattern! uses an astrisk (*) for a wildcard, scanning over zero or more characters; a question-mark (?) matches any single character; a backslash followed by any character treats it as a literal (it loses any special meaning).
!abc! exact match for 'abc' !abc*! match 'abc' at start of string !*abc! match 'abc' at the end of string !abc*def! match 'abc' at the start and match 'def' at the end, maybe with stuff in between. !*abc*def*! find 'abc', then find 'def'
For black-white lookups, the following actions are recognised: OK or RELAY (white list), REJECT or ERROR (black list), DISCARD (accept & discard), SKIP or DUNNO (stop lookup, no result), and NEXT (opposite of SKIP, resume lookup). Its possible to specify an empty action after a pattern, which is treated like SKIP returning an undefined result. Other options may specify other actions.
Below is a list of supported tags. Other options may specify additional tags.
milter-spamc-Connect:client-ip value § Can be a pattern list. Connect:client-ip value client-ip value milter-spamc-Connect:[client-ip] value § Can be a pattern list. milter-spamc-Connect:client-domain value § Can be a pattern list. milter-spamc-Connect: value § Can be a pattern list. Connect:[client-ip] value Connect:client-domain value [client-ip] value client-domain value All mail sent by a connecting client-ip, unresolved client-ip address or IP addresses that resolve to a client-domain are black or white-listed. These allows you to white-list your network for mail sent internally and off-site, or connections from outside networks. Note that Sendmail also has special semantics for Connect: and untagged forms. milter-spamc-From:sender-address value § Can be a pattern list. milter-spamc-From:sender-domain value § Can be a pattern list. milter-spamc-From:sender@ value § Can be a pattern list. milter-spamc-From: value § Can be a pattern list. From:sender-address value From:sender-domain value From:sender@ value sender-address value sender-domain value sender@ value All mail from the sender-address, sender-domain, or that begins with sender is black or white-listed. In the case of a +detailed email address, the left hand side of the +detail is used for the sender@ lookup. Note that Sendmail also has special semantics for From: and untagged forms. milter-spamc-Auth:auth_authen value § Can be a pattern list. milter-spamc-Auth: value § Can be a pattern list. All mail from the authenticated sender, as given by sendmail's {auth_authen} macro, is black or white-listed. The string searched by the pattern list will be the sender-address
. The empty form of milter-spamc-Auth: allows for a milter specific default only when {auth_authen} is defined.milter-spamc-To:recipient-address value § Can be a pattern list. milter-spamc-To:recipient-domain value § Can be a pattern list. milter-spamc-To:recipient@ value § Can be a pattern list. milter-spamc-To: value § Can be a pattern list. Spam:recipient-address value * (FRIEND or HATER are recognised) Spam:recipient-domain value * (FRIEND or HATER are recognised) Spam:recipient@ value * (FRIEND or HATER are recognised) To:recipient-address value To:recipient-domain value To:recipient@ value recipient-address value recipient-domain value recipient@ value All mail to the recipient-address, recipient-domain, or that begins with recipient is black or white-listed. In the case of a +detailed email address, the left hand side of the +detail is used for the recipient@ lookup. Note that Sendmail also has special semantics for Spam:, To:, and untagged forms.
The milter-spamc-Connect:, milter-spamc-From:, and milter-spamc-To: tags provide a milter specific means to override the Sendmail variants. For example, you normally white list your local network through any and all milters, but on the odd occasion you might want to actually scan mail from inside going out, without removing the Connect: tag that allows Sendmail to relay for your network or white listing for other milters. So for example if you have Sendmail tags like:
To:mx.example.com RELAY
You might have to add milter specific overrides in order to make sure the mail still gets filtered:
To:mx.example.com RELAY milter-spamc-To:mx.example.com SKIP
Some additional examples:
milter-spamc-Connect:80.94 [80.94.96.0/20]OK REJECT Accept connections from the netblock 80.94.96.0/20 (80.94.96.0 through to 80.94.111.255) and rejecting anything else in 80.94.0.0/16. milter-spamc-Connect:192.0.2 /^192\.0\.2\.8[0-9]/OK REJECT Accept connections from 192.0.2.80 through to 192.0.2.89, reject everything else in 192.0.2.0/24. milter-spamc-From:example.com /^john@.+/OK /^fred\+.*@.*/OK REJECT Accept mail from <john@example.com> and <fred@example.com> when fred's address contains a plus-detail in the address. Reject everything else from example.com. milter-spamc-To:example.net !*+*@*!REJECT !*.smith@*!REJECT /^[0-9].*/REJECT Reject mail to example.net using a plus-detail address or to any user who's last name is "smith" or addresses starting with a digit. No default given, so B/W processing would continue.
Normally when the access.db lookup matches a milter tag, then the value pattern list is processed and there are no further access.db lookups. The NEXT action allows the access.db lookups to resume and is effectively the opposite of SKIP. Consider the following examples:
milter-spamc-From:com
From:com/@com/REJECT NEXT
OKReject mail from places like compaq.com or com.com if the pattern matches, but resume the access.db lookups otherwise. milter-spamc-From:aol.com
From:fred@aol.com/^[a-zA-Z0-9!#$&'*+=?^_`{|}~.-]{3,16}@aol.com$/NEXT REJECT
OKAOL local parts are between 3 and 16 characters long and can contain dots and RFC 2822 atext characters except % and /. The NEXT used above allows one simple regex to validate the format of the address and proceed to lookup white listed and/or black listed addresses.
required_hits
by this
many points, then discard the message. If the score is less than
threshold + extra-discard, the message will be tagged or rejected
depending on the value of extra-reject. Specify -1 to disable discards; 0 to discard all spam.
required_hits
by this
many points, then reject the message. If the score is less than
threshold + extra-reject, then message will be tagged. Specify -1
to disable rejections and perform subject tagging only; 0 to reject all spam.
{rcpt_host}
macro passed by
Sendmail is an address-literal that is a local-use IP address
defined by RFC 3330 or 3513
(10.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/24, FE80::0/10 FEC0::0/10),
then spamd is given the local-part before the at-sign (@) to select spamd user preferences.
See also no-user-config.
A format-path string comprises of literal characters and percent-sign (%) prefixed format characters:
%% A literal percent-sign (%) %A The original address, equivalent of %T%P@%D. %D The domain name portion. %L The left-hand-side of a plus-detailed address or the local part. %P The local-part. If %R is not empty then "%L+%R" else "%L". %R The right-hand-side of a plus-detailed address or the empty string. %S The source-route, ie "@A,@B,@C", or the empty string. %T If %S is not empty, then "%S:" else the empty string.
Some examples:
Address Format Result user@example.com %T%P@%D user@example.com user+detail@example.com %P@%D user+detail@example.com user+detail@example.com %L+bulk@%D user+bulk@example.com user+detail@example.com bulk+%L@%D bulk+user@example.com user+detail@example.com bulk+%R@%D bulk+detail@example.com user+detail@example.com %P@bulk.%D user+detail@bulk.example.com @A,@B:user@example.com %T%P@bulk.%D @A,@B:user@bulk.example.com
Note +detailed local-parts is a Sendmail convention supported by some 3rd party mail delivery software, such as procmail, Cyrus IMAP, maybe others. Therefore please make sure your delivery agent understands this technique before using a +detailed local-part. You will require the FEATURE(`preserve_local_plus_detail') be specified in your sendmail.mc file to enable it. See The Bat Book 3ed, § 4.8.35, § 12.4.4.
milter-spamc
.
Typically a unix named socket or a host:port. This value must match the value specified for
the INPUT_MAIL_FILTER() macro in the sendmail.mc file. The accepted syntax is:
{unix|local}:/path/to/file
- A named pipe. (default)
inet:port@{hostname|ip-address}
- An IPV4 socket.
inet6:port@{hostname|ip-address}
- An IPV6 socket.
kill -QUIT `cat /var/run/milter/milter-spamc.pid`
spamd
and milter-spamc
.
§ all All messages § 0 Log nothing. § info General info messages. (default) § trace Trace progress through the milter. § parse Details from parsing addresses or special strings. § debug Lots of debug messages. § dialog I/O from Communications dialog state State transitions of message body scanner. dns Trace & debug of DNS operations cache Cache get/put/gc operations. § database Sendmail database lookups. § socket-fd Socket open & close calls § socket-all All socket operations & I/O § libmilter libmilter engine diagnostics
This is the list of possible SMTP responses generated by milter-spamc
.
Download:
milter-spamc/1.16 md5sum Change Log LibSnert md5sum Change Log Sendmail 8.14 http://www.sendmail.org/ Berkeley DB http://www.sleepycat.com/
In order to support B/W lists milter-spamc
requires Berkeley DB 3 or better. If
you do not require support for Sendmail's access database, skip this step.
You should build and install Berkeley DB library first, if you do not already have it. Please read the Berkeley DB documentation on how to build the library. Briefly, it should be something like this:
cd (path to)/db-4.3.27/build_unix ../dist/configure make make install
If your system is Linux and you install Berkeley DB in the default, non-
standard, location then you must remember to update
/etc/ld.so.conf
and run ldconfig
. You can change
the default install location by specifying the ../dist/configure
option --prefix=/usr/local
for example.
Note that Sendmail will probably have to be rebuilt to use Berkeley DB,
especially if the library was never installed and/or Sendmail was built
against an older version of Berkeley DB. Please see the Sendmail
documentation as to how this is done. The following is a brief outline,
however be sure to read devtools/README
,
devtools/Site/README
, and
"Using Berkeley
DB with Sendmail" for details on how to configure the Sendmail build
process. Outline of steps
cd (path to)/sendmail-8.14.0 vi devtools/Site/site.config.m4 sh Build -c sh Build install
If you have never built a milter for Sendmail, then please make sure that you
build and install libmilter
, which is not built by default when you build Sendmail.
Please read the libmilter
documentation. Briefly, it should be something like this:
cd (path to)/sendmail-8.14.0/libmilter sh Build -c install
The build process for libsnert
and milter-spamc
is pretty straight forward
once you have libmilter
installed:
cd (path to)/com/snert/src/lib ./configure --without-sqlite3 make build cd ../milter-spamc ./configure make build make install
SQLite support is not required in SnertSoft milters that do not use a cache. If you have compiled LibSnert for a mix of SnertSoft milters, some that require a cache, then you can build them all with the SQLite support. Will not hurt, just produce larger binaries in those that do not need it.
Both configuration scripts have some options that allow you to override defaults. Those options are listed with:
./configure --help
An example /usr/local/share/examples/milter-spamc/milter-spamc.mc
is supplied.
This file should be reviewed and the necessary elements inserted into your Sendmail
.mc
file and sendmail.cf
rebuilt.
Please note the comments on the general milter flags.
Once installed and configured, start milter-spamc
and then restart Sendmail.
An example startup script is provided in /usr/local/share/examples/milter-spamc/milter-spamc.sh
.
The default options can be altered by specifying them on the command-line or
within a /etc/mail/milter-spamc.cf
. The milter-spamc.cf
is
parsed first followed by the command-line options.
Currently tested platforms:
Cobalt Qube 1 with Linux RH 5.1 (mips 2.0.34 kernel)
;Linux RH 5.1 (Intel x386 2.2.25 kernel)
;FreeBSD 4.8, 4.9 (Intel x386)
;OpenBSD 3.6 (Intel x386)
Why another SpamAssassin milter?
milter-sender
I wanted to learn about some of the other aspects of Sendmail libmilter.
Remember that the SpamAssassin spamd
daemon must be running for this milter to function.
If you see "Socket write error: connection refused" in the logs, then make sure spamd
is running.
When using mail-format, you should place the local host and your local network in the access database. For example:
Connect:127.0.0.1 OK Connect:192.168.1 OK
Further commentary about extra-discard and extra-reject. Consider:
extra-reject=10 extra-discard=25 mail-policy=copy mail-spam=spambox@my.domain.example
The mail-format option can only redirect to individual mail folders when the entire recipient list is local. Otherwise send to the system spam box for processing.
The reason for this restriction is that +detail information is site specific: its a Sendmail convention and not defined in any RFC. So adding this information into outbound mail is useless, since you can't be sure how it will be interpreted at the receiving end. So when the mail is to be sent to a mix of local and outbound addresses, then the question is what to do with the outbound recipient addresses:
The minimum desired file ownership and permissions are as follows for a typical Linux system. For FreeBSD, NetBSD, and OpenBSD the binary and cache locations may differ, but have the same permissions.
Process user ``milter'' is primary member of group ``milter'' and secondary member of group ``smmsp''. Note that the milter should be started as root, so that it can create a .pid file and .socket file in /var/run; after which it will switch process ownership to milter:milter before starting the accept socket thread.
/etc/mail/ root:smmsp 0750 drwxr-x--- /etc/mail/access.db root:smmsp 0640 -rw-r----- /etc/mail/sendmail.cf root:smmsp 0640 -rw-r----- /etc/mail/milter-spamc.cf root:root 0644 -rw-r--r-- /var/run/milter/milter-spamc.pid milter:milter 0644 -rw-r--r-- /var/run/milter/milter-spamc.socket milter:milter 0644 srw-r--r-- /var/db/milter-spamc milter:milter 0644 -rw-r--r-- (*BSD) /var/cache/milter-spamc milter:milter 0644 -rw-r--r-- (linux) /usr/local/libexec/milter-spamc root:milter 0550 -r-xr-x---
I would like to express my thanks to Derek Balling for his support at http://www.milter.org/.
SNERTSOFT IS WILLING TO LICENSE THE SOFTWARE IDENTIFIED ABOVE TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS CONTAINED IN THIS LICENSE AGREEMENT. PLEASE READ THE AGREEMENT CAREFULLY. BY DOWNLOADING OR INSTALLING THIS SOFTWARE, YOU ACCEPT THE TERMS OF THE AGREEMENT.
``Package'' means the identified above in source and/or binary form, any other machine readable materials provided (including, but not limited to documentation, sample files, data files), any updates or error corrections, and its derivative works.
``Private Individual'' means an individual using the Package for personal, private, and non-commercial use only.
``Organisation'' means a legal entity or an individual that does not qualify as a Private Individual defined above.
``You'' (or ``Your'') means a Private Individual or Organisation exercising rights under, and complying with all of the terms of, this License or a future version of this License issued under Section 5.1. For legal entities, ``You'' includes any entity which controls, is controlled by, or is under common control with You. For purposes of this definition,``control'' means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of such entity.
The Package is an original work written by Anthony C. Howe, hereto referred to as the ``Author''.
If You are a Private Individual and so benefited from a reduced purchase price, then You may only compile, install, and use this Package, with or without private modifications, exclusively on a single machine You legally own or rent from a third party, provided You retain this notice, the Author's copyright notice, any and all license control methods (see below), and any links within the Package back to the most current online versions of this License and Disclaimer.
Otherwise if You have paid the full purchase price, then You may compile, install, and use this Package, with or without private modifications, exclusively on machines You legally own or rent from a third party, provided You retain this notice, the Author's copyright notice, any and all license control methods (see below), and any links within the Package back to the most current online versions of this License and Disclaimer.
You may copy, share, distribute, modify, and create derivative works from the user manuals and any related documentation solely for Your internal business purposes, such as in-house documentation, training manuals, or reference material.
Redistribution, including but not limited to books, CDROMS, download mirrors, floppy diskettes, hard disks, hardcopy print outs, online archives, solid state disks, streaming tapes, or other current or future forms of storage or communication media of the Package, with or without modifications, including any and all derivative works such as source patches, binaries, binary patches, or similar is expressly forbidden without prior written permission in hardcopy (letter or fax) signed and dated by the Author.
It is expressly forbidden for You to use the Package, in whole or in part, in any other software, except those designated by the Author.
It is expressly forbidden for You to use the Package to develop any software or other technology having the same primary function as the Package, including but not limited to using the Package in any development or test procedure that seeks to develop like software or other technology, or determine if such software or other technology performs in a similar manner as the Package.
You may not sell, rent, lease, or transfer the Package to third parties without prior written permission in hardcopy (letter or fax) signed and dated by the Author.
This Agreement is effective until terminated. You may terminate this Agreement at any time by destroying all copies of the Package. This Agreement will terminate immediately without notice from the Author if You fail to comply with any provision of this Agreement. Either party may terminate this Agreement immediately should any portion of the Package become, or in either party's opinion be likely to become, the subject of a claim of infringement of any intellectual property right. Upon Termination, You must destroy all copies of the Package.
New Versions. The Author may publish revised and/or new versions of the License from time to time. Each version will be given a distinguishing version number.
Effect of New Versions. Once a version of the Package has been published under a particular version of the License, You may always continue to use it under the terms of that License version. You may also choose to use such Package under the terms of any subsequent version of the License published by the Author. No one other than the Author has the right to modify the terms applicable to the Package created under this License.
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO WAY SHALL THE AUTHOR OR LICENSEE BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The Package may use one or more license control methods including, but not limited to, license key activation, periodic reporting of Package details and IP address of installation to SnertSoft, remote license verification by SnertSoft, or other future technical means. Any information reported to or gathered by SnertSoft shall remain strictly confidential and the private property of SnertSoft. Under no circumstances will SnertSoft resell or release this information to third parties, unless demanded by court order.
Support is only provided for the Author's original Package. Priority support can be purchased. Free support is limited, based on the Author's availability, though enhancements requests and problem reports are welcome. A community mailing list is available; please refer to SnertSoft web site Support area for details.
Gifts from the author's Amazon US or Amazon UK wishlist (search by mail address <achowe at snert dot com>) are welcomed for the continued encouragement, moral support, and ego pumping needed to work in foreign non-english speaking lands.
inches since 1 September 2003