README revision 31728
130581Sjmb Filtering out SPAM from your site 230581Sjmb 330581SjmbIntroduction: 430581Sjmb The FreeBSD Project filters spam, unsolicited commerical 530581Sjmbe-mail, from its mailing lists. The filter has two parts: databases 631467Sjmband rulesets. We have rulesets to /etc/sendmail.cf, check_rcpt, 731467Sjmbcheck_relay, check_rbl, check_mail and xlat. (xlat is for testing 831467Sjmbonly, as explained in /etc/mail/sendmail.cf.additions.) These 931467Sjmbrulesets use three databases. The denyip, a list of IP addresses, 1031467Sjmbspamsites, a list of domains, and fakenames, a list of bogus 1131467Sjmbusernames (such as investor and success). We do not accept mail 1231728Snatefrom any machine that matches a entry in either database, or users 1331467Sjmbin the fakenames database. 1430581Sjmb 1530581SjmbFiltering at your site: 1630581Sjmb To filter spam at your site you need to: 1730581Sjmb 1. modify your /etc/sendmail.cf, 1830581Sjmb 2. retrieve the database source files from the master site, 1930581Sjmb 3. make the databases and 2030581Sjmb 4. finally signal sendmail that the configuration file has changed. 2130581Sjmb 2230581Sjmb1. Modifying your /etc/sendmail.cf 2330581Sjmb Add the database declarations and the rulesets contained 2430581Sjmbin /etc/mail/sendmail.cf.additions to your .mc file. If you do 2530581Sjmbnot use m4 to generate your /etc/sendmail.cf, add the database 2630581Sjmbdeclarations to your /etc/sendmail.cf. 2730581Sjmb 2830581Sjmb2. Fetching the database source files: 2930581Sjmb The database source files are available from Gulf Coast 3030581SjmbInternet via anonymous FTP. The Makefile in /etc/mail will retreive 3130581Sjmbthe source files for you: as root, type "cd /etc/mail; make" at 3230581Sjmbthe command line. The previous version of the database source 3330581Sjmbfiles is moved to <filename>.0. Local additions should be kept in 3430581Sjmbseparate files. We use spamsites.local and denyip.local. You may 3530581Sjmbwant to diff the new versions of the files against the previous 3630581Sjmbversions to see what has changed. 3730581Sjmb 3830581Sjmb3. Make the databases: 3930581Sjmb As root, type "cd /etc/mail; make install" will build the 4030581Sjmbtwo databases from the retrieved source files and the local additions 4130581Sjmbfiles. 4230581Sjmb 4330581Sjmb4. Signaling sendmail: 4430581Sjmb Sendmail will reread its configuration whenever sendmail 4530581Sjmbreceives a HUP signal. As root, type "kill -HUP `cat 4630581Sjmb/var/run/sendmail.pid`". Check sendmail's log file to be sure that 4730581Sjmbit has restarted. /var/log/maillog should contain the line: "Oct 4830581Sjmb15 08:59:16 hub sendmail[6565]: restarting /usr/sbin/sendmail on 4930581Sjmbsignal". Most likely, the date, time, hostname and process id will 5030581Sjmbbe differ. 5130581Sjmb 5230581SjmbTesting the spam filter: 5330581Sjmb 5430581SjmbHow can I tell if its working: 5530581Sjmb The mail log file, /var/log/maillog, will contain a line 5630581Sjmbfor every message filtered. The lines will be similar to one of 5730581Sjmbthese two log entries: 5830581Sjmb 5930581SjmbCheck_mail rejects: 6031467SjmbOct 15 02:43:26 hub sendmail[6565]: CAA06565: ruleset=check_mail, 6130581Sjmbarg1=<announce@martianconsulate.com>, relay=xxx.isp.net [###.###.###.###], 6231467Sjmbreject=521 <announce@martianconsulate.com> 6330581Sjmb 6431467SjmbNov 30 15:56:37 hub sendmail[15058]: PAA15058: ruleset=check_mail, 6531467Sjmbarg1=<ultramax@s2.eddelwissl.NET>, relay=relay.somewhere.com 6631467Sjmb[###.###.###.###], reject=451 <ultramax@s2.eddelwissl.NET>... Domain 6731467Sjmbdoes not resolve 6831467Sjmb 6931467Sjmb 7030581SjmbCheck_relay rejects: 7130581SjmbOct 19 04:45:24 hub sendmail[3503]: NOQUEUE: ruleset=check_relay, 7230581Sjmbarg1=imsp015.netvigator.com, arg2=205.252.144.206, relay=root@localhost, 7330581Sjmbreject=521 blocked.contact postmaster@FreeBSD.ORG 7431467Sjmb 7531467Sjmbcheck_rcpt reject: 7631467SjmbNov 30 15:04:08 hub sendmail[12390]: PAA12390: ruleset=check_rcpt, 7731467Sjmbarg1=investor@100percent.per.year.com, relay=newfed.frb.gov 7831467Sjmb[198.3.221.5], reject=553 investor@100percent.per.year.com... 7931467Sjmb521<investor@100percent.per.year.com>#blocked.contact postmaster 8031467SjmbSun Nov 16 11:40:53 PST 1997 81