Subversion Repositories

?revision_form?Rev ?revision_input??revision_submit??revision_endform?

Rev 1 | Only display areas with differences | Ignore whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 1 Rev 2
1
<html>
1
<html>
2
<head>
2
<head>
3
<title>Exim SpamAssassin at SMTP time</title>
3
<title>Exim SpamAssassin at SMTP time</title>
4
</head>
4
</head>
5
5
6
<body>
6
<body>
7
7
8
<h1 ALIGN="CENTER">Exim SpamAssassin at SMTP time</h1>
8
<h1 ALIGN="CENTER">Exim SpamAssassin at SMTP time</h1>
9
9
10
<h3>What's that?</h3>
10
<h3>What's that?</h3>
11
<pre>
11
<pre>
12
mail from: merlin@gandalf
12
mail from: merlin@gandalf
13
250 OK
13
250 OK
14
rcpt to: merlin@gandalf
14
rcpt to: merlin@gandalf
15
250 Accepted
15
250 Accepted
16
data
16
data
17
354 Enter message, ending with "." on a line by itself
17
354 Enter message, ending with "." on a line by itself
18
From: merlin@gandalf
18
From: merlin@gandalf
19
To: merlin@gandalf
19
To: merlin@gandalf
20
Subject: $$$ Make Money Fast $$$ !!!
20
Subject: $$$ Make Money Fast $$$ !!!
21
21
22
viagra 100% GARANTEE AMAZING FULL REFUND 
22
viagra 100% GARANTEE AMAZING FULL REFUND 
23
This is not spam
23
This is not spam
24
.
24
.
25
550 Rejected
25
550 Rejected
26
</pre>
26
</pre>
27
(logs would show something like this:
27
(logs would show something like this:
28
<tt>2004-03-10 08:27:18 1B16Y8-0001UP-4R SA: Action: permanently rejected message: hits=14.8 required=7.0 trigger=11.0 ( scanned in 2/2 secs | Message-Id: CCQPVENACPQBFLTRLICXWQVEK@gandalf). From <merlin@gandalf> (host=gandalf [127.0.0.1]) for merlin@gandalf</tt>)
28
<tt>2004-03-10 08:27:18 1B16Y8-0001UP-4R SA: Action: permanently rejected message: hits=14.8 required=7.0 trigger=11.0 ( scanned in 2/2 secs | Message-Id: CCQPVENACPQBFLTRLICXWQVEK@gandalf). From <merlin@gandalf> (host=gandalf [127.0.0.1]) for merlin@gandalf</tt>)
29
29
30
30
31
<P>
31
<P>
32
An example of teergrube would return this instead
32
An example of teergrube would return this instead
33
<pre>
33
<pre>
34
data
34
data
35
354 Enter message, ending with "." on a line by itself
35
354 Enter message, ending with "." on a line by itself
36
(...)
36
(...)
37
body     SEE_FOR_YOURSELF       /See (?:for|it) yourself\b/i
37
body     SEE_FOR_YOURSELF       /See (?:for|it) yourself\b/i
38
describe SEE_FOR_YOURSELF       See for yourself
38
describe SEE_FOR_YOURSELF       See for yourself
39
39
40
body ORDER_NOW                  /\border (?:now|soon|fast|quickly|while)\b/i
40
body ORDER_NOW                  /\border (?:now|soon|fast|quickly|while)\b/i
41
describe ORDER_NOW              Encourages you to waste no time in ordering
41
describe ORDER_NOW              Encourages you to waste no time in ordering
42
42
43
.
43
.
44
451- wait for more output
44
451- wait for more output
45
451- wait for more output
45
451- wait for more output
46
451- wait for more output
46
451- wait for more output
47
(... one line every 10 secs, 15 minutes elapse ...)
47
(... one line every 10 secs, 15 minutes elapse ...)
48
450 Please try again later
48
450 Please try again later
49
</pre>
49
</pre>
50
50
51
The idea here is to stall and waste the resources of the remote sender (BTW
51
The idea here is to stall and waste the resources of the remote sender (BTW
52
teergrube comes from german, and means tar-pitting, or stopping someone in his
52
teergrube comes from german, and means tar-pitting, or stopping someone in his
53
tracks)
53
tracks)
54
54
55
<BR><BR>
55
<BR><BR>
56
<h3>Why?</h3>
56
<h3>Why?</h3>
57
SpamAssassin can be run inside exim after the mail has been accepted, as shown
57
SpamAssassin can be run inside exim after the mail has been accepted, as shown
58
<a href="http://bogmog.sourceforge.net/document_show.php3?doc_id=28">here</a>,
58
<a href="http://bogmog.sourceforge.net/document_show.php3?doc_id=28">here</a>,
59
but if you're not going to use my patch and you just want to run SA as an exim
59
but if you're not going to use my patch and you just want to run SA as an exim
60
transport, 
60
transport, 
61
<a href="http://dman13.dyndns.org/~dman/config_docs/exim-spamassassin/">this</a>
61
<a href="http://dman13.dyndns.org/~dman/config_docs/exim-spamassassin/">this</a>
62
version is recommended
62
version is recommended
63
<P>
63
<P>
64
Now, while this will work, we can do better, hence the reason for my code
64
Now, while this will work, we can do better, hence the reason for my code
65
(just to make things clear, you do not want to run both my code, and dman's
65
(just to make things clear, you do not want to run both my code, and dman's
66
transports. It'd work, but you'd be scanning the message twice)
66
transports. It'd work, but you'd be scanning the message twice)
67
<P>
67
<P>
68
The reason why I wanted SpamAssassin in local scan is that I don't want to
68
The reason why I wanted SpamAssassin in local scan is that I don't want to
69
accept the damn spam in the first place.
69
accept the damn spam in the first place.
70
70
71
<ul>
71
<ul>
72
<li>While my code lets you do that, I don't like to send mails to the bit
72
<li>While my code lets you do that, I don't like to send mails to the bit
73
    bucket, so you need to bounce them.
73
    bucket, so you need to bounce them.
74
<li>Once you accept the spam, you can't bounce it half the time, or you
74
<li>Once you accept the spam, you can't bounce it half the time, or you
75
    bounce it to an innocent whose Email was forged as an envelope sender
75
    bounce it to an innocent whose Email was forged as an envelope sender
76
    (some spam even forges the bounce address to <em>you</em>)
76
    (some spam even forges the bounce address to <em>you</em>)
77
<li>If I refuse spam at SMTP time, it will remove the spam addresses from at
77
<li>If I refuse spam at SMTP time, it will remove the spam addresses from at
78
    least a few lists (they gotta clean their lists eventually otherwise they'd
78
    least a few lists (they gotta clean their lists eventually otherwise they'd
79
    spend more time Emailing dead addresses than good ones)
79
    spend more time Emailing dead addresses than good ones)
80
<li>I have the option of toying with spammers and stall their connections and
80
<li>I have the option of toying with spammers and stall their connections and
81
    waste their resources (see the following page for details on 
81
    waste their resources (see the following page for details on 
82
    <A HREF="http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html">
82
    <A HREF="http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html">
83
    teergrubing</A>
83
    teergrubing</A>
84
</ul>
84
</ul>
85
85
86
Note that you can also use this code to simply run SA on all your mails (or
86
Note that you can also use this code to simply run SA on all your mails (or
87
portion thereof as configured with SAEximRunCond) without having to configure SA
87
portion thereof as configured with SAEximRunCond) without having to configure SA
88
in your exim.conf. In other words, this code can be configured to not reject
88
in your exim.conf. In other words, this code can be configured to not reject
89
any mails.
89
any mails.
90
90
91
<BR><BR>
91
<BR><BR>
92
<h3>SpamAssassin? What's that?</h3>
92
<h3>SpamAssassin? What's that?</h3>
93
Ah, you need to visit <a href="http://spamassassin.org/">this page</a> first 
93
Ah, you need to visit <a href="http://spamassassin.org/">this page</a> first 
94
then
94
then
95
95
96
96
97
<BR><BR>
97
<BR><BR>
98
<h3>How does it work, what knobs are there?</h3>
98
<h3>How does it work, what knobs are there?</h3>
99
You need to configure spamassassin to flags mails as spam after a certain
99
You need to configure spamassassin to flags mails as spam after a certain
100
threshold (7 for instance). After that, this code can be configured to
100
threshold (7 for instance). After that, this code can be configured to
101
101
102
<ul>
102
<ul>
103
<li>Pretend to be processing the Email and send continuation lines to the
103
<li>Pretend to be processing the Email and send continuation lines to the
104
    remote server until it gives up (aka 
104
    remote server until it gives up (aka 
105
    <A HREF="http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html">
105
    <A HREF="http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html">
106
    teergrubing</A>)
106
    teergrubing</A>)
107
<li>Accept but not deliver mail with a high threshold (i.e. devnull the mail)
107
<li>Accept but not deliver mail with a high threshold (i.e. devnull the mail)
108
<li>Reject mail with a lower threshold
108
<li>Reject mail with a lower threshold
109
<li>Temporarily reject mail with a still lower threshold (you can then inspect
109
<li>Temporarily reject mail with a still lower threshold (you can then inspect
110
    your logs to decide if you want to tweak SA so that next time the mail
110
    your logs to decide if you want to tweak SA so that next time the mail
111
    is sent, you can receive it)
111
    is sent, you can receive it)
112
<li>In all 5 cases, mail can be optionally saved to disk so that you can
112
<li>In all 5 cases, mail can be optionally saved to disk so that you can
113
    inspect all the mails you've rejected or /dev/nulled
113
    inspect all the mails you've rejected or /dev/nulled
114
</ul>
114
</ul>
115
115
116
You can also (and probably should <img src="/gifs/people/smile.happy.gif" alt=":-)" align=TOP WIDTH=16 HEIGHT=16>) use the new greylisting support for even
116
You can also (and probably should <img src="/gifs/people/smile.happy.gif" alt=":-)" align=TOP WIDTH=16 HEIGHT=16>) use the new greylisting support for even
117
better spam control
117
better spam control
118
118
119
119
120
<P>
120
<P>
121
For more details, you should look at the self-documented 
121
For more details, you should look at the self-documented 
122
<a href="files/sa-exim.conf">config file</a> and you can see 
122
<a href="files/sa-exim.conf">config file</a> and you can see 
123
<a href="sa-exim.demo.txt">some sample rejects and what you get in the logs</a>
123
<a href="sa-exim.demo.txt">some sample rejects and what you get in the logs</a>
124
124
125
125
126
<BR><BR>
126
<BR><BR>
127
<h3><A NAME="greylisting">Greylisting you say?</A></h3>
127
<h3><A NAME="greylisting">Greylisting you say?</A></h3>
128
While when sa-exim first came out, its strongest point was being one of the
128
While when sa-exim first came out, its strongest point was being one of the
129
first programs (if not the first) that let you reject Spam at SMTP time, its
129
first programs (if not the first) that let you reject Spam at SMTP time, its
130
coolest feature now is adaptive greylisting support<BR>
130
coolest feature now is adaptive greylisting support<BR>
131
In a nutshell, you get the advantages of greylisting without the disadvantages:
131
In a nutshell, you get the advantages of greylisting without the disadvantages:
132
<ul>
132
<ul>
133
<li>mails with a low spam score are accepted without delay
133
<li>mails with a low spam score are accepted without delay
134
<li>mails with an average spam score are greylisted, 
134
<li>mails with an average spam score are greylisted, 
135
    <b>and only those are delayed</b>
135
    <b>and only those are delayed</b>
136
<li>mails with high spam scores are rejected regardless (no greylisting)
136
<li>mails with high spam scores are rejected regardless (no greylisting)
137
</ul>
137
</ul>
138
138
139
This method is the best combination I've seen out there so far, and
139
This method is the best combination I've seen out there so far, and
140
while I've been talking about it for a while, I don't yet know of other 
140
while I've been talking about it for a while, I don't yet know of other 
141
programs that implement this method (if you do, please let me know so that
141
programs that implement this method (if you do, please let me know so that
142
I can acknowledge them)
142
I can acknowledge them)
143
<BR>
143
<BR>
144
For more details on how this works, check out the <a href="files/sa-exim-cvs/README.greylisting">greylisting README</a>
144
For more details on how this works, check out the <a href="files/sa-exim-cvs/README.greylisting">greylisting README</a>
145
145
146
146
147
<BR><BR>
147
<BR><BR>
148
<h3>Ok, where's the code? / Downloads</h3>
148
<h3>Ok, where's the code? / Downloads</h3>
149
<ul>
149
<ul>
150
<li>The latest version is here (<a href="files/sa-exim-current/">browsable tree</a> or <a href="files/sa-exim-current.tar.gz">tar.gz</a>). You can also
150
<li>The latest version is here (<a href="files/sa-exim-current/">browsable tree</a> or <a href="files/sa-exim-current.tar.gz">tar.gz</a>). You can also
151
get it from <A href="http://sourceforge.net/projects/sa-exim/">sf.net</a><BR>
151
get it from <A href="http://sourceforge.net/projects/sa-exim/">sf.net</a><BR>
152
<li>The CVS version is here (<a href="files/sa-exim-cvs/">browsable tree</a>)
152
<li>The CVS version is here (<a href="files/sa-exim-cvs/">browsable tree</a>)
153
and you can also get the CVS tree from
153
and you can also get the CVS tree from
154
<A HREF="http://sourceforge.net/cvs/?group_id=56124">sf.net</A>
154
<A HREF="http://sourceforge.net/cvs/?group_id=56124">sf.net</A>
155
<li>The latest config file with documentation is 
155
<li>The latest config file with documentation is 
156
<a href="files/sa-exim.conf">here</a>
156
<a href="files/sa-exim.conf">here</a>
157
<li>Debian packages (source and binary) are <a href="files/debian/">here</a>
157
<li>Debian packages (source and binary) are <a href="files/debian/">here</a>
158
</ul>
158
</ul>
159
<P>
159
<P>
160
160
161
As explained in the archive, you can either copy <tt>sa-exim.c</tt> over exim's
161
As explained in the archive, you can either copy <tt>sa-exim.c</tt> over exim's
162
<tt>src/local_scan.c</tt> You need to copy local_scan in src in the exim source
162
<tt>src/local_scan.c</tt> You need to copy local_scan in src in the exim source
163
tree and rebuild it, or you can build sa-exim as a loadable module (you need
163
tree and rebuild it, or you can build sa-exim as a loadable module (you need
164
to patch exim to support loadable modules though)
164
to patch exim to support loadable modules though)
165
<P>
165
<P>
166
You can also browse all my exim files <A HREF="files/">here</A>
166
You can also browse all my exim files <A HREF="files/">here</A>
167
167
168
<BR><BR>
168
<BR><BR>
169
<h3>Mailing list</h3>
169
<h3>Mailing list</h3>
170
You should probably subscribe to this low traffic 
170
You should probably subscribe to this low traffic 
171
<a href="http://lists.merlins.org/lists/listinfo/sa-exim">mailing list</a> if
171
<a href="http://lists.merlins.org/lists/listinfo/sa-exim">mailing list</a> if
172
you download the code to keep apprised of bug fixes and enhancements
172
you download the code to keep apprised of bug fixes and enhancements
173
173
174
<BR><BR>
174
<BR><BR>
175
<h3>Integration with Exim 4</h3>
175
<h3>Integration with Exim 4</h3>
176
This code works without anything in the exim conf, but you probably want to use
176
This code works without anything in the exim conf, but you probably want to use
177
some knobs to disable scanning for some users (like setting 
177
some knobs to disable scanning for some users (like setting 
178
<tt>X-SA-Do-Not-Rej</tt> or <tt>X-SA-Do-Not-Run</tt> in the rcpt ACL and 
178
<tt>X-SA-Do-Not-Rej</tt> or <tt>X-SA-Do-Not-Run</tt> in the rcpt ACL and 
179
removing those headers in the right places).<BR>
179
removing those headers in the right places).<BR>
180
See <A HREF="http://marc.merlins.org/linux/exim/#conf">my exim4 conf tree</a>
180
See <A HREF="http://marc.merlins.org/linux/exim/#conf">my exim4 conf tree</a>
181
and more specifically the 
181
and more specifically the 
182
<A HREF="http://marc.merlins.org/linux/exim/exim4-conf/exim4.conf">exim4.conf</A> 
182
<A HREF="http://marc.merlins.org/linux/exim/exim4-conf/exim4.conf">exim4.conf</A> 
183
file
183
file
184
<P>
184
<P>
185
You can look at the <A HREF="files/sa-exim-cvs/README">README</A> for more 
185
You can look at the <A HREF="files/sa-exim-cvs/README">README</A> for more 
186
integration details.
186
integration details.
187
187
188
188
189
<BR><BR>
189
<BR><BR>
190
<h3>Changelog/Download</h3>
190
<h3>Changelog/Download</h3>
191
191
192
<Changelog>
192
<Changelog>
193
</Changelog>
193
</Changelog>
194
194
195
<P>
195
<P>
196
More generally, all the files can also be found <A HREF="files/">here</A>
196
More generally, all the files can also be found <A HREF="files/">here</A>
197
<P>
197
<P>
198
<A HREF="/perso/contact.html">Feedback is appreciated</A> (but please
198
<A HREF="/perso/contact.html">Feedback is appreciated</A> (but please
199
prefer the use of the 
199
prefer the use of the 
200
<a href="http://lists.merlins.org/lists/listinfo/sa-exim">sa-exim list</a>)
200
<a href="http://lists.merlins.org/lists/listinfo/sa-exim">sa-exim list</a>)
201
201
202
<BR><BR>
202
<BR><BR>
203
<h3>Acknowledgements</h3>
203
<h3>Acknowledgements</h3>
204
204
205
<Acknowledgements>
205
<Acknowledgements>
206
</Acknowledgements>
206
</Acknowledgements>
207
207
208
208
209
<P ALIGN="center">
209
<P ALIGN="center">
210
<img src="/gifs/lines/misc/lampline.gif" alt="" WIDTH=720 HEIGHT=14>
210
<img src="/gifs/lines/misc/lampline.gif" alt="" WIDTH=720 HEIGHT=14>
211
</P>
211
</P>
212
<br>
212
<br>
213
<img src="/gifs/misc/wizard.gif" alt="" align="middle" WIDTH=72 HEIGHT=61>
213
<img src="/gifs/misc/wizard.gif" alt="" align="middle" WIDTH=72 HEIGHT=61>
214
<img src="/gifs/linux/damn-powered.gif" alt="" align="right" WIDTH=170 HEIGHT=29>
214
<img src="/gifs/linux/damn-powered.gif" alt="" align="right" WIDTH=170 HEIGHT=29>
215
<IMG SRC="/gifs/icons/msfree.gif" ALT="[ms free site]" ALIGN="right" WIDTH=95 HEIGHT=31>
215
<IMG SRC="/gifs/icons/msfree.gif" ALT="[ms free site]" ALIGN="right" WIDTH=95 HEIGHT=31>
216
<a href="http://sourceforge.net"><img src="http://sourceforge.net/sflogo.php?group_id=56124&amp;type=1" width="88" height="31" border="0" align="right" alt="SourceForge.net Logo"></a>
216
<a href="http://sourceforge.net"><img src="http://sourceforge.net/sflogo.php?group_id=56124&amp;type=1" width="88" height="31" border="0" align="right" alt="SourceForge.net Logo"></a>
217
<A HREF="/perso/contact.html">Email</A><BR>
217
<A HREF="/perso/contact.html">Email</A><BR>
218
<A HREF="/">Link to Home Page</A>
218
<A HREF="/">Link to Home Page</A>
219
<P>
219
<P>
220
</body>
220
</body>
221
</html>
221
</html>