Subject: Re: spam patch compilation problem

From: Rick Murphy <[email-masked]>
Date: Thu, 31 May 2001 22:59:06 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

At 03:22 PM 5/31/01 -0400, Don Pro wrote:
>/usr/local/fwtk/smap/smap.c:654: undefined reference to `res_query'
>/usr/local/fwtk/smap/smap.c:654: undefined reference to `res_query'
>collect2: ld returned 1 exit status
Add "-lresolv" to the AUXLIB line in Makefile.config.
         -Rick

---

From: Don Pro <[email-masked]>
Date: Fri, 01 Jun 2001 10:17:00 -0400

Hi Ted,

Thanks for all you help.  I am happy to report that after initial
testing, it looks to be working quite well.  I have tested by sending
e-mail from outside accounts that contain spam as well as blocked users
and they have been rejected accordingly.  I am quite pleased.

If you don't mind, I have a few questions pertaining to the three files
responsible for rejecting.

spam
------
This file seems to be using the message envelope to block e-mail from
1) specific I.P. (wild card accepted)
2) specific domain (wild card accepted)
3) specific e-mail (must be enclosed between < >)

Is the above analysis correct including the need to enclose email
addressed in < > such as <[email-masked]>?

block
====
This file seems also uses the message envelope to block e-mail.
What is the difference between this file and the 'spam' file?
I'm also unsure of the syntax as I see various syntax such as:

<root@printername>              <*>
<*>     <root@printername>
<[email-masked]>        <[email-masked]

Finally, how do I use this file to block e-mail that comes in for
internal users who have long departed my organization?

spamlist.dat
=========
This file uses the message contents (header and body) top block e-mail
1) anything prefaced by 'tag' appears to block by domain.  Is this
redundant as it seems I can use the 'spam' file to accomplish this?
2) Besides 'tag' and 'text', are there any other keys?
3) Where can I update this list (as will as the 'spam' file)?
4) Can I disable using this file if I find that the perfomance his is
much for my hardware?

Thanks again for all your help,
Don

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 1 Jun 2001 10:52:25 -0400

On Thu, May 31, 2001 at 03:22:40PM -0400, Don Pro wrote:
> I am attempting to compile Ted Keller's smap/smapd anti-spam, anti-relay
> patch.  I am getting the following compilation error when I try to
> compile:
> 
> smap.o: In function `main':
> make: *** [smap] Error 1
> I am running RedHat 6.2 out of the box.  Is this error documented?

Yes.  Add -lres to the end of the libraries.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Ted Keller <[email-masked]>
Date: Fri, 1 Jun 2001 23:25:37 -0400 (EDT)

Hi Don,

I'll attempt to answer your questions....

> addressed in < > such as <[email-masked]>?

You analysis appears correct.  The program uses the nacasematch which
comes from the original tool kit.  This appears to support wild-card
processing (although I have not used it).  You are correct - domains and
IP numbers are listed without the <> brackets.  E-mail address include the
<> brackets.

> internal users who have long departed my organization?

The spam file is a basic block mechanism based on the connecting host or
from address.  The block file deals with the from/to address combinations.
In the above examples...

<root@printername>              <*>
<*>     <root@printername>

We block a internal system that was generating noise to an external site -
and block an external site from responding to a bounced address.  I had
this occur one evening where one of my internal systems was ping-ponging
between its printer daemon and an external site.  Simply chewing up
resources and filling up logs.  Since this was after hours - I couldn't
call the site to resolve the problem.  This was an effective way to block
that traffic.

<[email-masked]>        <[email-masked]>

In this case - the internal user did not want to see e-mail from this one
address at aol.com.  The reasons aren't important - but it is an effective
way to prevent abuse of your e-mail system by an external entity.

<*>	<[email-masked]>

This example blocks all mail to [email-masked] - a past employee who had
signed up for many list servers...

In each case - the remote system gets a user not found message - and we
don't accept the mail into our network.

> 4) Can I disable using this file if I find that the perfomance his is

The spam file deals with the envelop.  The spamlist.dat file deals with
the message body (header and first few lines of text).

What we find a lot is people (spammers) will put anything in the headers -
few of these things are valid - or at least don't match the envelop.  This
mechanism allows us to do content filtering - at least to some degree.

The types are....

from - header from: address.  The from string must be "stand-alone". This
implies that the string is either at the start or end of the line - or it
is separated by white space.  Multiple white space characters are
omitted.  The exception is the "@" <abc@   or @domain.com>  In these
cases, the @ does not have to be preceded or followed by white space.
Kind of allows us to block anyone from xxx.com.

to - header to: adrress.  Again - the string must be stand alone. - Same
rules apply as far as the @ character.

subject - the subject line - text must be "stand alone"

header - the text appears on any header line - bcc, ...

text - body of the message - string is "stand alone". - note html body
tags are ignored (replace by single space).

Now comes the more interesting ones....

tag - this represents a text string located within an html tag.  This is
handy for the lines like...

<href=www.abcnude.com>  (or what ever).  In this case - a line

tag nude

will capture this message as spam.

Likewise (and I'm not sure you have this support yet)

string nude

will capture anything with the characters nude in the line - not
necesarliy stand alone.

This last options is great for things like

casino .. casino!  .. casino!!!

sting will capture all of these with a single entry.  Be careful, however,
a line like

string sex

will capture the sex site - and sexton.com - a site that you may actually
value (well at least I do).

you have similar issues with blindly using adult - this captures adult
education and the like.

I've also added one additional support (again you probably don't have this
one yet) which allows the mapping of users - and the overriding of file
size limits for specific e-mail addresses.  Our general limit is 15mb
messages.  However, we do have situations where, due to contract
requirements, messages sizes larger than 15mb are required.  With the
stock smap, this is a hard feature to permit.  The mapping file allows
overrides for specific from or to address combinations.  I'll get this out
in my next tarball.

Hope this helps.

ted keller

---

From: Ted Keller <[email-masked]>
Date: Mon, 4 Jun 2001 14:26:05 -0400 (EDT)

Don,

This would be an easy fix - but beware.....

in the check_content routing, change strncmp to strncasecmp and things
will be case insensitive.

Now - by doing this, you will get into issues like

Free vs FREE

I have users who argue that Free is acceptable while FREE is most
certainly spam (ie - we send out Free Samples in our business).

I've tried to adopt the more conservative approach - but you are correct -
it make for more entries - and therefore slower processing.

your call...

ted keller

On Mon, 4 Jun 2001, Don Pro wrote:

> Hi Ted,
>
> Thanks for your excellent response.  I understand quite clearly now.
>
> An observation and a question,
>
> 1) I notice that any text I place next to types in the spamlist.dat file
> appears to be case sensitive.  In other words,
>
> header Make Money on the Internet
> header Make MONEY on the Internet
>
> are treated as two separate headers.  Do you have any plans to eliminate (at
> least as an option) case sensitivity?  Otherwise, I am forced to write
> redundant lines.
>
> 2) When stable, can you send me the patch that include support for "string"?
>
> Thanks,
> Don
>
> Ted Keller wrote:
>
> > Hi Don,
> >

---

From: Don Pro <[email-masked]>
Date: Mon, 04 Jun 2001 10:42:50 -0400

Hi Ted,

Thanks,
Don