Sendmail anti-spam modifications

The sendmail modifications below replace and supercede the procmail-based filtering I was working on earlier.

LICENSE TERMS:

This code is Copyright Graham Toal, 1997.  I reserve all rights
to this code and accompanying data files except those granted
explicitly here.

I grant paid-up members of the Texas ISP Association (TISPA) a license
to use this code within their own organisations.  They may modify the
software for their own internal use, but modifying the software does not
create any rights to the underlying code that extend beyond this limited
license

This license does not grant the licensees the right to sell or convey the
software or data files to any persons who are not members of TISPA,
although they may pass on any binaries they generate and/or any
documentation they create on how to build the necessary data files.

The right to use this current release of code by a TISPA member
cannot be revoked by me.  However TISPA members have no automatic
right to receive further developments of this code which I may
create for commercial sale or otherwise.

This code was written entirely in my own time and my employer
has no rights in it; however I grant my employer (Valley Tech)
the same rights as Tispa members as listed above.

Anyone who uses this code MUST inform me that they are doing
so.  email to gtoal@gtoal.com will suffice.

Anyone else who is not a Tispa member who wishes to use this code
must request and be given explicit permission from me.  Anyone who
is interested in using this code in or adopting this code for a
commercial program for sale must negotiate licensing terms with me.

This limited license for TISPA members is not transferrable.

By downloading the code pointed to on these pages you agree to these terms.

You may not put pointers to the code anywhere that bypasses this license.

This software is provided on an as is basis, without warranty of any kind,
express or implied.

Graham Toal, 28 May 1997.

There. I'm not a lawyer but I think the intent is obvious enough to hold up in court. Basically I'm just trying to protect my interests if there's a chance I can sell this stuff to a big organisation like Netscape, Microsoft or maybe Cyber Patrol. SpamNOTS anyone?

I am currently working on a replacement for the checkcompat() function in conf.c in the sendmail source which both stops third-party spam and can reject or tag junk mail. Although fairly complex, it is safe to apply this patch to your sendmail because the default behaviour is not to bounce or filter. These features are enabled when appropriate files are created and pointed to in sendmail.cf; also they are not enabled site-wide but per-user according to the presence or otherwise of a ".spamfilter" file in the user's home directory.

This is the first release of the code and does not have all the features that the procmail-based code had, but it is cleaner code, it is datafile-driven and it implements scoring so that the risk of mail being falsely identified as spam is now minimal.

Among the missing features are: user-customizable additions/exceptions to the spam-detection rules; making some of the spam scoring values that are implemented in the C code soft rather than hard-wired.

Here is how to upgrade your sendmail:

Fetch the sendmail sources if you don't have them (from here)
Make an unmodified sendmail, make sure it matches the one you run already
Edit source file conf.c and find the function checkcompat(). Delete the function and insert this file at the same place.
(Here's the whole file if you have the latest sendmail and are not super-paranoid about merging changes)
Rebuild and make sure mail still works (keep a copy of your old sendmail, and do a make install
mkdir /etc/sendmail-config

Now, if you want to block third-party spam, you must

Create a file listing the IP addresses of all your local clients (here's an example - this is my own local network)
Create a file listing all the domains for which you may relay mail offsite to because you are a backup MX for them (again, here's my example)
Edit sendmail.cf to add the following two lines:
KAuthorizedNetworks hash /etc/sendmail-config/localips.db
KRelayedDomains hash /etc/sendmail-config/secondarymx.db
(If you are generating your sendmail.cf file from a .mc file, put those lines immediately after LOCAL_CONFIG in the .mc file.)
If you do not have an executable of makemap, go into the makemap directory of the sendmail sources and build it.
Restart sendmail, make sure it is still behaving properly.
cd /etc/sendmail-config
makemap hash secondary-mx.db < secondary-mx
makemap hash localips.db < localips
Once those are in place, create the file /etc/sendmail-config/blocking-YES
Restart sendmail again to pick up the new database.

Test the patch by going to a system not listed in localips and sending mail to user%external_host@patched_host
Alternatively, use this test program If it doesn't work for you, change the /usr/bin/perl in the script to point to your local perl5

If you want to turn off blocking of third-party mail, rename the file blocking-YES to blocking-NO

To enable spam filtering for a user, you need to do the following:

mkdir /etc/sendmail-config/scores
cd /etc/sendmail-config/scores
tar -xvf scores.tar
(The individual files look like this; Here they are separately)
As you did for the third-party blocking, add these lines to sendmail.cf:
- KSpamDomains hash /etc/sendmail-config/scores/DOMAINS.db
- KUserNames hash /etc/sendmail-config/scores/USERS.db
- Kbadusers hash /etc/sendmail-config/scores/EMAILADDRS.db
Don't restart sendmail yet.
Run the Makefile in /etc/sendmail-config. Now you can restart sendmail.
For one test user, touch ~user/.spamfilter
From an external system, send that user mails with the following titles:
- Subject: junkmail minor spam test
- Subject: junkmail major spam test
- Subject: junkmail regex test
- Subject: junkmail case insensitive test
- Subject: JUNKMAIL BOUNCE TEST
The latter test should bounce; the others should mark the spam in the headers. A 'maybe' spam is marked as
Received: by spamtest
A 'pretty sure of it' spam is marked as
Received: by spamfilter
The user will never see spams that have been 100% identified, and will be able to judge the severity of the remainder by filtering the Received: headers for either "spamfilter" (severe, almost certainly spam) or "spamtest" (a few clues, nothing definite - should really check these by eye)
NOTE: during development I've inhibited the bouncing of mail and instead add a "Received: by spamdelete" header, so we can see what mail would have been deleted. Eventually I'll make the header/direct deletion an option. Meanwhile the user can auto-delete by filtering on the word "spamdelete".

STOP PRESS: it has been pointed out to me that there are some missing files in the above distribution, including a critical Makefile and the fastmap source: you can get ALL the files here in dist.tar.

This page is maintained by Graham Toal