|
0
|
1 dccifd(8) Distributed Checksum Clearinghouse dccifd(8) |
|
|
2 |
|
|
3 NNAAMMEE |
|
|
4 ddcccciiffdd -- Distributed Checksum Clearinghouse Interface Daemon |
|
|
5 |
|
|
6 SSYYNNOOPPSSIISS |
|
|
7 ddcccciiffdd [--VVddbbxxAANNQQ] [--GG _o_n | _o_f_f | _n_o_I_P | _I_P_m_a_s_k_/_x_x] [--hh _h_o_m_e_d_i_r] [--II _u_s_e_r] |
|
|
8 [--pp _/_s_o_c_k | _h_o_s_t_,_p_o_r_t_,_r_h_o_s_t_/_b_i_t_s] [--oo _/_s_o_c_k | _h_o_s_t_,_p_o_r_t] |
|
|
9 [--DD _l_o_c_a_l_-_d_o_m_a_i_n] [--mm _m_a_p] [--ww _w_h_i_t_e_c_l_n_t] [--UU _u_s_e_r_d_i_r_s] |
|
|
10 [--aa _I_G_N_O_R_E | _R_E_J_E_C_T | _D_I_S_C_A_R_D] [--tt _t_y_p_e_,[_l_o_g_-_t_h_o_l_d_,]_r_e_j_-_t_h_o_l_d] |
|
|
11 [--gg [_n_o_t_-]_t_y_p_e] [--SS _h_e_a_d_e_r] [--ll _l_o_g_d_i_r] [--RR _r_u_n_d_i_r] |
|
|
12 [--rr _r_e_j_e_c_t_i_o_n_-_m_s_g] [--TT _t_m_p_d_i_r] [--jj _m_a_x_j_o_b_s] |
|
|
13 [--BB _d_n_s_b_l_-_o_p_t_i_o_n] [--LL _l_t_y_p_e_,_f_a_c_i_l_i_t_y_._l_e_v_e_l] |
|
|
14 |
|
|
15 DDEESSCCRRIIPPTTIIOONN |
|
|
16 ddcccciiffdd is a daemon intended to connect spam filters such as SpamAssasin |
|
|
17 and mail transfer agents (MTAs) other than sendmail to DCC servers. The |
|
|
18 MTA or filter ddcccciiffdd which in turn reports related checksums to the near- |
|
|
19 est DCC server and adds an _X_-_D_C_C SMTP header line to the message. The |
|
|
20 MTA is told to reject the message if it is unsolicited bulk. |
|
|
21 |
|
|
22 DDcccciiffdd is similar to the DCC sendmail milter interface, dccm(8) and the |
|
|
23 DCC Procmail interface, dccproc(8). DDcccciiffdd is more efficient than |
|
|
24 dccproc(8) but not restricted to use with sendmail like dccm(8). All |
|
|
25 three send reports of checksums related to mail received by DCC clients |
|
|
26 and queries about the total number of reports of particular checksums. |
|
|
27 |
|
|
28 MTA programs use a simple ASCII protocol a subset of SMTP to send a mail |
|
|
29 message including its SMTP envelope to the daemon. DDcccciiffdd responds with |
|
|
30 an indication of whether the message is unsolicited bulk and an optional |
|
|
31 copy of the message with an _X_-_D_C_C header added. The ASCII protocol is |
|
|
32 described below and in the _i_n_c_l_u_d_e_/_d_c_c_i_f_._h file in the DCC source. There |
|
|
33 is a sample C interface routine in the _d_c_c_l_i_b_/_d_c_c_i_f_._c file in the DCC |
|
|
34 source and the _d_c_c_l_i_b_._a library generated from the source. A _P_e_r_l ver- |
|
|
35 sion of the interface routine is in _d_c_c_i_f_d_/_d_c_c_i_f_._p_l. Test or demonstra- |
|
|
36 tion programs in the style of dccproc(8) that use those interface rou- |
|
|
37 tines are in _d_c_c_i_f_d_/_d_c_c_i_f_-_t_e_s_t. |
|
|
38 |
|
|
39 A subset of ESMTP can be used instead of the ASCII protocol to connect |
|
|
40 ddcccciiffdd to postfix as a "Before-Queue Content Filter." See the --oo flag. |
|
|
41 |
|
|
42 Since the checksums of messages that are whitelisted locally by the --ww |
|
|
43 _w_h_i_t_e_c_l_n_t file are not reported to the DCC server, ddcccciiffdd knows nothing |
|
|
44 about the total recipient counts for their checksums and so cannot add |
|
|
45 _X_-_D_C_C header lines to such messages. |
|
|
46 |
|
|
47 Enable the daemon and put its parameters in the _d_c_c___c_o_n_f file and start |
|
|
48 the daemon with the _s_t_a_r_t_-_d_c_c_i_f_d script. |
|
|
49 |
|
|
50 The list of servers that ddcccciiffdd contacts is in the memory mapped file _m_a_p |
|
|
51 shared by local DCC clients. The file is maintained with cdcc(8). |
|
|
52 |
|
|
53 OOPPTTIIOONNSS |
|
|
54 The following options are available: |
|
|
55 |
|
|
56 --VV displays the version of ddcccciiffdd. |
|
|
57 |
|
|
58 --dd enables debugging output from the DCC client software. Additional |
|
|
59 --dd options increase the number of messages. A single --dd |
|
|
60 aborted SMTP transactions including those from some "dictionary |
|
|
61 attacks." |
|
|
62 |
|
|
63 --bb causes the daemon to not detach itself from the controlling tty and |
|
|
64 put itself into the background. |
|
|
65 |
|
|
66 --xx causes the daemon to try "extra hard" to contact a DCC server. |
|
|
67 Since it is usually more important to deliver mail than to report |
|
|
68 its checksums, ddcccciiffdd normally does not delay too long while trying |
|
|
69 to contact a DCC server. It will not try again for several seconds |
|
|
70 after a failure. With --xx, it will always try to contact the DCC |
|
|
71 server and it will tell the MTA to answer the DATA command with a |
|
|
72 4yz temporary failure. |
|
|
73 |
|
|
74 --AA adds to existing X-DCC headers in the message instead of replacing |
|
|
75 existing headers of the brand of the current server. |
|
|
76 |
|
|
77 --NN neither adds, deletes, nor replaces existing X-DCC headers in the |
|
|
78 message. Each message is logged, rejected, and otherwise handled |
|
|
79 the same. |
|
|
80 |
|
|
81 --QQ only queries the DCC server about the checksums of messages instead |
|
|
82 of reporting and querying. This is useful when ddcccciiffdd is used to |
|
|
83 filter mail that has already been reported to a DCC server by |
|
|
84 another DCC client. No single mail message should be reported to a |
|
|
85 DCC server more than once per recipient, because each report will |
|
|
86 increase the apparent "bulkness" of the message. |
|
|
87 |
|
|
88 It is better to use _M_X_D_C_C lines in the global _w_h_i_t_e_c_l_n_t file for |
|
|
89 your MX mail servers that use DCC than --QQ. |
|
|
90 |
|
|
91 --GG _o_n | _o_f_f | _n_o_I_P | _I_P_m_a_s_k_/_x_x |
|
|
92 controls _g_r_e_y_l_i_s_t_i_n_g. At least one working greylist server must be |
|
|
93 listed in the _m_a_p file in the DCC home directory. If more than one |
|
|
94 is named, they must "flood" or change checksums and they must use |
|
|
95 the same --GG parameters. See dccd(8). Usually all dccm or dccifd |
|
|
96 DCC client processes use the same --GG parameters. |
|
|
97 |
|
|
98 _I_P_m_a_s_k_/_x_x and _n_o_I_P remove part or all of the IP address from the |
|
|
99 greylist triple. The CIDR block size, _x_x, must be between 1 and |
|
|
100 128. 96 is added to block sizes smaller than 33 to make them appro- |
|
|
101 priate for the IPv6 addresses used by the DCC. _I_P_m_a_s_k_/_9_6 differs |
|
|
102 from _n_o_I_P for IPv4 addresses, because the former retains the IPv4 to |
|
|
103 IPv6 mapping prefix. |
|
|
104 |
|
|
105 --hh _h_o_m_e_d_i_r |
|
|
106 overrides the default DCC home directory, _/_v_a_r_/_d_c_c. |
|
|
107 |
|
|
108 --II _u_s_e_r |
|
|
109 specifies the UID and GID of the process. |
|
|
110 |
|
|
111 --pp _/_s_o_c_k_/_n_a_m_e | _h_o_s_t_,_p_o_r_t_,_r_h_o_s_t_/_b_i_t_s |
|
|
112 overrides the default address at which programs contact ddcccciiffdd. The |
|
|
113 default is a UNIX domain socket named dccifd in the DCC home direc- |
|
|
114 tory. |
|
|
115 |
|
|
116 The second form specifies a local host name or IP address, a local |
|
|
117 TCP port number, and the host names or IP addresses of computers |
|
|
118 that can use ddcccciiffdd. 127.0.0.1 or _l_o_c_a_l_h_o_s_t are common choices for |
|
|
119 _h_o_s_t. The string _@ specifies IN_ADDRANY or all local IP addresses. |
|
|
120 127.0.0.0/8 is a common choice for _r_h_o_s_t_/_b_i_t_s. |
|
|
121 |
|
|
122 --oo _/_s_o_c_k | _h_o_s_t_,_p_o_r_t |
|
|
123 enables SMTP proxy mode instead of the ASCII protocol and specifies |
|
|
124 the output connection when ddcccciiffdd acts as an SMTP proxy. It is the |
|
|
125 address of the SMTP server for which ddcccciiffdd acts as SMTP client. |
|
|
126 When _/_s_o_c_k is _/_d_e_v_/_n_u_l_l, ddcccciiffdd acts as if there were downstream |
|
|
127 SMTP server that always answers "250 ok". The string _@ specifies |
|
|
128 the same IP address as the incoming TCP connection. |
|
|
129 |
|
|
130 The input to ddcccciiffdd in SMTP proxy mode is specified with ----pp. For |
|
|
131 example, --pp _1_2_7_._0_._0_._1_,_1_0_0_2_5_,_1_2_7_._0_._0_._1_/_3_2 --oo _1_2_7_._0_._0_._1_,_1_0_0_2_6 could be |
|
|
132 used to connect ddcccciiffdd with Postfix as described in the documenta- |
|
|
133 tion in version 2.2.1 Postfix documentation. |
|
|
134 |
|
|
135 See below concerning the subset of ESMTP used in this mode. |
|
|
136 |
|
|
137 --mm _m_a_p |
|
|
138 specifies a name or path of the memory mapped parameter file instead |
|
|
139 of the default _m_a_p file in the DCC home directory. It should be |
|
|
140 created with the cdcc(8) command. |
|
|
141 |
|
|
142 --ww _w_h_i_t_e_c_l_n_t |
|
|
143 specifies an optional file containing filtering parameters as well |
|
|
144 as SMTP client IP addresses, SMTP envelope values, and header values |
|
|
145 of mail that is spam or is not spam and does not need a _X_-_D_C_C |
|
|
146 header, and whose checksums should not be reported to the DCC |
|
|
147 server. |
|
|
148 |
|
|
149 If the pathname _w_h_i_t_e_c_l_n_t is not absolute, it is relative to the DCC |
|
|
150 home directory. |
|
|
151 |
|
|
152 The format of the ddcccciiffdd whiteclnt file is the same as the _w_h_i_t_e_l_i_s_t |
|
|
153 files used by dbclean(8) and the _w_h_i_t_e_c_l_n_t file used by dccproc(8). |
|
|
154 See dcc(8) for a description of DCC white and blacklists. Because |
|
|
155 the contents of the _w_h_i_t_e_c_l_n_t file are used frequently, a companion |
|
|
156 file is automatically created and maintained. It has the same path- |
|
|
157 name but with an added suffix of _._d_c_c_w and contains a memory mapped |
|
|
158 hash table of the main file. |
|
|
159 |
|
|
160 A whitelist entry ("OK") or two or more semi-whitelistings ("OK2") |
|
|
161 for one of the message's checksums prevents all of the message's |
|
|
162 checksums from being reported to the DCC server and the addition of |
|
|
163 a _X_-_D_C_C header line by ddcccciiffdd A whitelist entry for a checksum also |
|
|
164 prevents rejecting or discarding the message based on DCC recipient |
|
|
165 counts as specified by --aa and --tt. Otherwise, one or more checksums |
|
|
166 with blacklisting entries ("MANY") cause all of the message's check- |
|
|
167 sums to be reported to the server with an addressee count of "MANY". |
|
|
168 |
|
|
169 If the message has a single recipient, an _e_n_v___T_o _w_h_i_t_e_c_l_n_t entry of |
|
|
170 "OK" for the checksum of its recipient address acts like any other |
|
|
171 _w_h_i_t_e_c_l_n_t entry of "OK." When the SMTP message has more than one |
|
|
172 recipient, the effects can be complicated. When a message has sev- |
|
|
173 eral recipients with some but not all listed in the _w_h_i_t_e_c_l_n_t file, |
|
|
174 ddcccciiffdd tries comply with the wishes of the users who want filtering |
|
|
175 as well as those who don't by silently not delivering the message to |
|
|
176 those who want filtering (i.e. are not whitelisted) and delivering |
|
|
177 the message to don't want filtering. |
|
|
178 |
|
|
179 --UU _u_s_e_r_d_i_r_s |
|
|
180 enables per-user _w_h_i_t_e_c_l_n_t files and log directories. Each target |
|
|
181 of a message can have a directory of log files named |
|
|
182 _u_s_e_r_d_i_r_s_/_a_d_d_r_/_l_o_g where _a_d_d_r is the local user or mailbox name com- |
|
|
183 puted by the MTA. The name of each user's log directory must be |
|
|
184 _l_o_g. If it is not absolute, _u_s_e_r_d_i_r_s is relative to the DCC home |
|
|
185 directory. The directory containing the log files must be named _l_o_g |
|
|
186 and it must be writable by the ddcccciiffdd process. Each log directory |
|
|
187 must exist or logging for the corresponding is silently disabled. |
|
|
188 The files created in the log directory are owned by the UID of the |
|
|
189 ddcccciiffdd process, but they have _g_r_o_u_p and _o_t_h_e_r read and write permis- |
|
|
190 sions copied from the corresponding _l_o_g directory. To ensure the |
|
|
191 privacy of mail, it may be good to make the directories readable |
|
|
192 only by _o_w_n_e_r and _g_r_o_u_p, and to use a cron script that changes the |
|
|
193 owner of each file to match the grandparent _a_d_d_r directory. |
|
|
194 |
|
|
195 There can also be a per -user whitelist file named |
|
|
196 _u_s_e_r_d_i_r_s_/_a_d_d_r_/_w_h_i_t_e_c_l_n_t for each address _a_d_d_r_. Any checksum that is |
|
|
197 not white- or blacklisted by an individual addressee's _w_h_i_t_e_c_l_n_t |
|
|
198 file is checked in the main --ww --wwhhiitteeccllnntt file. A missing per- |
|
|
199 addressee _w_h_i_t_e_c_l_n_t file is the same as an empty file. Relative |
|
|
200 paths for files included in per-addressee files are resolved in the |
|
|
201 DCC home directory. The _w_h_i_t_e_c_l_n_t files and the _a_d_d_r directories |
|
|
202 containing them must be writable by the ddcccciiffdd process. |
|
|
203 |
|
|
204 _O_p_t_i_o_n lines in per-user whiteclnt files can be used to modify many |
|
|
205 aspects of ddcccciiffdd filtering, as described in the main dcc man page. |
|
|
206 For example, an _o_p_t_i_o_n _d_c_c_-_o_f_f line turns off DCC filtering for |
|
|
207 individual mailboxes. |
|
|
208 |
|
|
209 --aa _I_G_N_O_R_E | _R_E_J_E_C_T | _D_I_S_C_A_R_D |
|
|
210 specifies the action taken when ddcccciiffdd is in proxy mode with --oo and |
|
|
211 DCC server counts or --tt thresholds say that a message is unsolicited |
|
|
212 and bulk. _I_G_N_O_R_E causes the message to be unaffected except for |
|
|
213 adding the _X_-_D_C_C header line to the message. This turns off DCC |
|
|
214 filtering. |
|
|
215 |
|
|
216 Spam can also be _R_E_J_E_C_Ted or (when in proxy mode with --oo) accepted |
|
|
217 and silently _D_I_S_C_A_R_Ded without being delivered to local mailboxes. |
|
|
218 The default is _R_E_J_E_C_T. |
|
|
219 |
|
|
220 Mail forwarded via IP addresses marked _M_X or _M_X_D_C_C in the main |
|
|
221 _w_h_i_t_e_c_l_n_t file is treated as if --aa _D_I_S_C_A_R_D were specified. This |
|
|
222 prevents "bouncing" spam. |
|
|
223 |
|
|
224 The effects of the --ww _w_h_i_t_e_c_l_n_t are not affected by --aa. |
|
|
225 |
|
|
226 --tt _t_y_p_e_,[_l_o_g_-_t_h_o_l_d_,]_r_e_j_-_t_h_o_l_d |
|
|
227 sets logging and "spam" thresholds for checksum _t_y_p_e. The checksum |
|
|
228 types are _I_P, _e_n_v___F_r_o_m, _F_r_o_m, _M_e_s_s_a_g_e_-_I_D, _s_u_b_s_t_i_t_u_t_e, _R_e_c_e_i_v_e_d, |
|
|
229 _B_o_d_y, _F_u_z_1, _F_u_z_2, _r_e_p_-_t_o_t_a_l, and _r_e_p. The first six, _I_P through |
|
|
230 _s_u_b_s_t_i_t_u_t_e, have no effect except when a local DCC server configured |
|
|
231 with --KK is used. The _s_u_b_s_t_i_t_u_t_e thresholds apply to the first sub- |
|
|
232 stitute heading encountered in the mail message. The string _A_L_L |
|
|
233 sets thresholds for all types, but is unlikely to be useful except |
|
|
234 for setting logging thresholds. The string _C_M_N specifies the com- |
|
|
235 monly used checksums _B_o_d_y, _F_u_z_1, and _F_u_z_2. _R_e_j_-_t_h_o_l_d and _l_o_g_-_t_h_o_l_d |
|
|
236 must be numbers, the string _N_E_V_E_R, or the string _M_A_N_Y indicating |
|
|
237 millions of targets. Counts from the DCC server as large as the |
|
|
238 threshold for any single type are taken as sufficient evidence that |
|
|
239 the message should be logged or rejected. |
|
|
240 |
|
|
241 _L_o_g_-_t_h_o_l_d is the threshold at which messages are logged. It can be |
|
|
242 handy to log messages at a lower threshold to find solicited bulk |
|
|
243 mail sources such as mailing lists. If no logging threshold is set, |
|
|
244 only rejected mail and messages with complicated combinations of |
|
|
245 white and blacklisting are logged. Messages that reach at least one |
|
|
246 of their rejection thresholds are logged regardless of logging |
|
|
247 thresholds. |
|
|
248 |
|
|
249 _R_e_j_-_t_h_o_l_d is the threshold at which messages are considered "bulk," |
|
|
250 and so should be rejected or discarded if not whitelisted. |
|
|
251 |
|
|
252 DCC Reputation thresholds in the commercial version of the DCC are |
|
|
253 controlled by thresholds on checksum types _r_e_p and _r_e_p_-_t_o_t_a_l. Mes- |
|
|
254 sages from an IP address that the DCC database says has sent more |
|
|
255 than --tt _r_e_p_-_t_o_t_a_l_,_l_o_g_-_t_h_o_l_d messages are logged. A DCC Reputation |
|
|
256 is computed for messages received from IP addresses that have sent |
|
|
257 more than --tt _r_e_p_-_t_o_t_a_l_,_l_o_g_-_t_h_o_l_d messages. The DCC Reputation of an |
|
|
258 IP address is the percentage of its messages that have been detected |
|
|
259 as bulk or having at least 10 recipients. The defaults are equiva- |
|
|
260 lent to --tt _r_e_p_,_n_e_v_e_r and --tt _r_e_p_-_t_o_t_a_l_,_n_e_v_e_r_,_2_0. |
|
|
261 |
|
|
262 Bad DCC Reputations do not reject mail unless enabled by an _o_p_t_i_o_n |
|
|
263 _D_C_C_-_r_e_p_-_o_n line in a _w_h_i_t_e_c_l_n_t file. |
|
|
264 |
|
|
265 The checksums of locally whitelisted messages are not checked with |
|
|
266 the DCC server and so only the number of targets of the current copy |
|
|
267 of a whitelisted message are compared against the thresholds. |
|
|
268 |
|
|
269 The default is _A_L_L_,_N_E_V_E_R, so that nothing is discarded, rejected, or |
|
|
270 logged. A common choice is _C_M_N_,_2_5_,_5_0 to reject or discard mail with |
|
|
271 common bodies except as overridden by the whitelist of the DCC |
|
|
272 server, the sendmail _$_{_d_c_c___i_s_s_p_a_m_} and _$_{_d_c_c___n_o_t_s_p_a_m_} macros, and |
|
|
273 --gg, and --ww. |
|
|
274 |
|
|
275 --gg [_n_o_t_-]_t_y_p_e |
|
|
276 indicates that whitelisted, _O_K or _O_K_2, counts from the DCC server |
|
|
277 for a type of checksum are to be believed. They should be ignored |
|
|
278 if prefixed with _n_o_t_-. _T_y_p_e is one of the same set of strings as |
|
|
279 for --tt. Only _I_P, _e_n_v___F_r_o_m, and _F_r_o_m are likely choices. By default |
|
|
280 all three are honored, and hence the need for _n_o_t_-. |
|
|
281 |
|
|
282 --SS _h_d_r |
|
|
283 adds to the list of substitute or locally chosen headers that are |
|
|
284 checked with the --ww _w_h_i_t_e_c_l_n_t file and sent to the DCC server. The |
|
|
285 checksum of the last header of type _h_d_r found in the message is |
|
|
286 checked. _H_d_r can be _H_E_L_O to specify the SMTP envelope HELO value. |
|
|
287 _H_d_r can also be _m_a_i_l___h_o_s_t to specify the host name from the |
|
|
288 Mail_from value in the SMTP envelope. As many as six different sub- |
|
|
289 stitute headers can be specified, but only the checksum of the first |
|
|
290 of the six will be sent to the DCC server. |
|
|
291 |
|
|
292 --ll _l_o_g_d_i_r |
|
|
293 specifies a directory in which files containing copies of messages |
|
|
294 processed by ddcccciiffdd are kept. They can be copied to per-user direc- |
|
|
295 tories specified with --UU. Information about other recipients of a |
|
|
296 message is deleted from the per-user copies. |
|
|
297 |
|
|
298 See the FILES section below concerning the contents of the files. |
|
|
299 See also the _o_p_t_i_o_n _l_o_g_-_s_u_b_d_i_r_e_c_t_o_r_y_-_{_d_a_y_,_h_o_u_r_,_m_i_n_u_t_e_} lines in |
|
|
300 _w_h_i_t_e_c_l_n_t files described in dcc(8). |
|
|
301 |
|
|
302 The directory is relative to the DCC home directory if it is not |
|
|
303 absolute |
|
|
304 |
|
|
305 --RR _r_u_n_d_i_r |
|
|
306 specifies the "run" directory where the file containing the daemon's |
|
|
307 process ID is stored. The default value is _/_v_a_r_/_r_u_n_/_d_c_c. |
|
|
308 |
|
|
309 --TT _t_m_p_d_i_r |
|
|
310 changes the default directory for temporary files from the default. |
|
|
311 The default is the directory specified with --ll or the system default |
|
|
312 if --ll is not used. The system default is often _/_t_m_p. |
|
|
313 |
|
|
314 --DD _l_o_c_a_l_-_d_o_m_a_i_n |
|
|
315 specifies a host or domain name by which the system is known. There |
|
|
316 can be several --DD settings. |
|
|
317 |
|
|
318 To find the per-user log directory and whitelist for each mail |
|
|
319 recipient, ddcccciiffdd must know each recipient's user name. The ASCII |
|
|
320 protocol used between and the MTA includes an optional user name |
|
|
321 with each SMTP recipient address. When the user name is absent when |
|
|
322 the ASCII protocol is used or when the subset of ESMTP enabled with |
|
|
323 --oo is used, and when the SMTP recipient address includes an _a_t _s_i_g_n |
|
|
324 (@) each mail address is checked against the list of _l_o_c_a_l_-_d_o_m_a_i_ns. |
|
|
325 The part of the recipient address remaining after longest matching |
|
|
326 _l_o_c_a_l_-_d_o_m_a_i_n (if any) is taken as the user name. The match is |
|
|
327 anchored at the right or the end of the recipient address. It must |
|
|
328 start at a period (.) or _a_t _s_i_g_n (@) in the domain name part of the |
|
|
329 address. |
|
|
330 |
|
|
331 If _l_o_c_a_l_-_d_o_m_a_i_n starts with an asterisk (*) indicating a wildcard, |
|
|
332 preceding sub-domain names are discarded to compute the user name. |
|
|
333 Otherwise, the computed user name will include any unmatched sub- |
|
|
334 domain names. |
|
|
335 |
|
|
336 The default value of _l_o_c_a_l_-_d_o_m_a_i_n when there are no --DD settings is |
|
|
337 the host name of the system. |
|
|
338 |
|
|
339 --rr _r_e_j_e_c_t_i_o_n_-_m_s_g |
|
|
340 specifies the rejection message in --oo proxy mode for unsolicited |
|
|
341 bulk mail or for mail temporarily blocked by _g_r_e_y_l_i_s_t_i_n_g when --GG is |
|
|
342 specified. The first --rr _r_e_j_e_c_t_i_o_n_-_m_s_g replaces the default bulk |
|
|
343 mail rejection message, "5.7.1 550 mail %ID from %CIP rejected by |
|
|
344 DCC". The second replaces "4.2.1 452 mail %ID from %CIP temporary |
|
|
345 greylist embargoed". The third --rr _r_e_j_e_c_t_i_o_n_-_m_s_g replaces the |
|
|
346 default SMTP rejection message "5.7.1 550 %ID bad reputation; see |
|
|
347 http://commercial-dcc.rhyolite.com/cgi-bin/reps.cgi?tgt=%CIP" for |
|
|
348 mail with bad DCC Reputations. If _r_e_j_e_c_t_i_o_n_-_m_s_g is the zero-length |
|
|
349 string, the --rr setting is counted but the corresponding message is |
|
|
350 not changed. |
|
|
351 |
|
|
352 _R_e_j_e_c_t_i_o_n_-_m_s_g can contain specific information about the mail mes- |
|
|
353 sage. The following strings starting with % are replaced with the |
|
|
354 corresponding values: |
|
|
355 %ID message ID such as the unique part of log file name or |
|
|
356 sendmail queue ID |
|
|
357 %CIP SMTP client IP address |
|
|
358 %BTYPE type of DNS blacklist hit, such as "SMTP client", |
|
|
359 "mail_host", or "URL NS" |
|
|
360 %BTGT IP address or name declared bad by DNS blacklist |
|
|
361 %BPROBE domain name found in DNS blacklist such as |
|
|
362 4.3.2.10.example.com |
|
|
363 %BRESULT value of the %BPROBE domain name found in DNS black- |
|
|
364 list |
|
|
365 |
|
|
366 A common alternate for the bulk mail rejection message is "4.7.1 451 |
|
|
367 Access denied by DCC" to tell the sending mail system to continue |
|
|
368 trying. Use a 4yz response with caution, because it is likely to |
|
|
369 delay for days a delivery failure message for false positives. If |
|
|
370 the rejection message does not start with an RFC 1893 status code |
|
|
371 and RFC 2821 reply code, 5.7.1 and 550 or 4.2.1 and 452 are used. |
|
|
372 |
|
|
373 See also --BB _s_e_t_:_r_e_j_-_m_s_g_=_r_e_j_e_c_t_i_o_n_-_m_s_g to set the status message for |
|
|
374 mail rejected by DNS blacklists. |
|
|
375 |
|
|
376 --jj _m_a_x_j_o_b_s |
|
|
377 limits the number of simultaneous requests that will be processed. |
|
|
378 The default value is the maximum number that seems to be possible |
|
|
379 given system limits on open files, select() bit masks, and so forth. |
|
|
380 Start ddcccciiffdd with --dd and see the starting message in the system log |
|
|
381 to see the limit. |
|
|
382 |
|
|
383 --BB _d_n_s_b_l_-_o_p_t_i_o_n |
|
|
384 enables DNS blacklist checks of the SMTP client IP address, SMTP |
|
|
385 envelope Mail_From sender domain name, and of host names in URLs in |
|
|
386 the message body. Body URL blacklisting has too many false posi- |
|
|
387 tives to use on abuse mailboxes. It is less effective than |
|
|
388 greylisting with dccm(8) or dccifd(8) but can be useful in situa- |
|
|
389 tions where greylisting cannot be used. |
|
|
390 |
|
|
391 _D_n_s_b_l_-_o_p_t_i_o_n is either one of the --BB _s_e_t_:_o_p_t_i_o_n forms or |
|
|
392 --BB _d_o_m_a_i_n[_,_I_P_a_d_d_r[_/_x_x[_,_b_l_t_y_p_e]]] |
|
|
393 _D_o_m_a_i_n is a DNS blacklist domain such as example.com that will be |
|
|
394 searched. _I_P_a_d_d_r[_/_x_x_x] is the string "any" an IP address in the DNS |
|
|
395 blacklist that indicates that the mail message should be rejected, |
|
|
396 or a CIDR block covering results from the DNS blacklist. |
|
|
397 "127.0.0.2" is assumed if _I_P_a_d_d_r is absent. IPv6 addresses can be |
|
|
398 specified with the usual colon (:) notation. Names can be used |
|
|
399 instead of numeric addresses. The type of DNS blacklist is speci- |
|
|
400 fied by _b_l_t_y_p_e as _n_a_m_e, _I_P_v_4, or _I_P_v_6. Given an envelope sender |
|
|
401 domain name or a domain name in a URL of spam.domain.org and a |
|
|
402 blacklist of type _n_a_m_e, spam.domain.org.example.com will be tried. |
|
|
403 Blacklist types of _I_P_v_4 and _I_P_v_6 require that the domain name in a |
|
|
404 URL sender address be resolved into an IPv4 or IPv6 address. The |
|
|
405 address is then written as a reversed string of decimal octets to |
|
|
406 check the DNS blacklist, as in 2.0.0.127.example.com, |
|
|
407 |
|
|
408 More than one blacklist can be specified and blacklists can be |
|
|
409 grouped. All searching within a group is stopped at the first posi- |
|
|
410 tive result. |
|
|
411 |
|
|
412 Positive results are ignored after being logged unless an |
|
|
413 _o_p_t_i_o_n _D_N_S_B_L_-_o_n line appears in the global or per-user _w_h_i_t_e_c_l_n_t |
|
|
414 file. |
|
|
415 |
|
|
416 --BB _s_e_t_:_n_o_-_c_l_i_e_n_t |
|
|
417 says that SMTP client IP addresses and reverse DNS domain names |
|
|
418 should not be checked in the following blacklists. |
|
|
419 --BB _s_e_t_:_c_l_i_e_n_t restores the default for the following black- |
|
|
420 lists. |
|
|
421 |
|
|
422 --BB _s_e_t_:_n_o_-_m_a_i_l___h_o_s_t |
|
|
423 says that SMTP envelope Mail_From sender domain names should |
|
|
424 not be checked in the following blacklists. --BB _s_e_t_:_m_a_i_l___h_o_s_t |
|
|
425 restores the default. |
|
|
426 |
|
|
427 --BB _s_e_t_:_n_o_-_U_R_L |
|
|
428 says that URLs in the message body should not be checked in the |
|
|
429 in the following blacklists. --BB _s_e_t_:_U_R_L restores the default. |
|
|
430 |
|
|
431 --BB _s_e_t_:_n_o_-_M_X |
|
|
432 says MX servers of sender Mail_From domain names and host names |
|
|
433 in URLs should not be checked in the following blacklists. |
|
|
434 --BB _s_e_t_:_M_X restores the default. |
|
|
435 |
|
|
436 --BB _s_e_t_:_n_o_-_N_S |
|
|
437 says DNS servers of sender Mail_From domain names and host |
|
|
438 names in URLs should not be checked in the following black- |
|
|
439 lists. --BB _s_e_t_:_N_S restores the default. |
|
|
440 |
|
|
441 --BB _s_e_t_:_d_e_f_a_u_l_t_s |
|
|
442 is equivalent to all of --BB _s_e_t_:_n_o_-_t_e_m_p_-_f_a_i_l --BB _s_e_t_:_c_l_i_e_n_t |
|
|
443 --BB _s_e_t_:_m_a_i_l___h_o_s_t --BB _s_e_t_:_U_R_L --BB _s_e_t_:_M_X and --BB _s_e_t_:_N_S |
|
|
444 |
|
|
445 --BB _s_e_t_:_g_r_o_u_p_=_X |
|
|
446 adds later DNS blacklists specified with |
|
|
447 --BB _d_o_m_a_i_n[_,_I_P_a_d_d_r[_/_x_x[_,_b_l_t_y_p_e]]] |
|
|
448 to group 1, 2, or 3. |
|
|
449 |
|
|
450 --BB _s_e_t_:_d_e_b_u_g_=_X |
|
|
451 sets the DNS blacklist logging level |
|
|
452 |
|
|
453 --BB _s_e_t_:_m_s_g_-_s_e_c_s_=_S |
|
|
454 limits ddcccciiffdd to _S seconds total for checking all DNS black- |
|
|
455 lists. The default is 25. |
|
|
456 |
|
|
457 --BB _s_e_t_:_U_R_L_-_s_e_c_s_=_S |
|
|
458 limits ddcccciiffdd to at most _S seconds resolving and checking any |
|
|
459 single URL. The default is 11. Some spam contains dozens of |
|
|
460 URLs and that some "spamvertised" URLs contain host names that |
|
|
461 need minutes to resolve. Busy mail systems cannot afford to |
|
|
462 spend minutes checking each incoming mail message. |
|
|
463 |
|
|
464 --BB _s_e_t_:_r_e_j_-_m_s_g_=_r_e_j_e_c_t_i_o_n_-_m_s_g |
|
|
465 sets the SMTP rejection message for the following blacklists. |
|
|
466 _R_e_j_e_c_t_i_o_n_-_m_s_g must be in the same format as for --rr. If |
|
|
467 _r_e_j_e_c_t_i_o_n_-_m_s_g is null, the default is restored. The default |
|
|
468 DNS blacklist rejection message is the first message set with |
|
|
469 --rr. |
|
|
470 |
|
|
471 --BB _s_e_t_:_t_e_m_p_-_f_a_i_l |
|
|
472 causes ddcccciiffdd to the MTA to answer the SMTP DATA command with |
|
|
473 452 4.2.1 mail %ID from %CIP temporary delayed for DNSBL |
|
|
474 if any DNS answer required for a DNSBL in the current group |
|
|
475 times out, including resolving names in URLs. |
|
|
476 |
|
|
477 --BB _s_e_t_:_n_o_-_t_e_m_p_-_f_a_i_l |
|
|
478 restores the default of assuming a negative answer for DNS |
|
|
479 responses that take too long. |
|
|
480 |
|
|
481 --BB _s_e_t_:_m_a_x_j_o_b_s_=_X |
|
|
482 sets maximum number of helper processes to _X. In order to use |
|
|
483 typical single-threaded DNS resolver libraries, ddcccciiffdd uses |
|
|
484 fleets of helper processes. It is rarely a good idea to change |
|
|
485 the default, which is the same as the maximum number of simul- |
|
|
486 taneous jobs set with --jj. |
|
|
487 |
|
|
488 --BB _s_e_t_:_p_r_o_g_p_a_t_h_=_/_v_a_r_/_d_c_c_/_l_i_b_e_x_e_c_/_d_n_s_-_h_e_l_p_e_r |
|
|
489 changes the path to the helper program. |
|
|
490 |
|
|
491 --LL _l_t_y_p_e_,_f_a_c_i_l_i_t_y_._l_e_v_e_l |
|
|
492 specifies how messages should be logged. _L_t_y_p_e must be _e_r_r_o_r, _i_n_f_o, |
|
|
493 or _o_f_f to indicate which of the two types of messages are being con- |
|
|
494 trolled or to turn off all syslog(3) messages from ddcccciiffdd. _L_e_v_e_l |
|
|
495 must be a syslog(3) level among _E_M_E_R_G, _A_L_E_R_T, _C_R_I_T, _E_R_R, _W_A_R_N_I_N_G, |
|
|
496 _N_O_T_I_C_E, _I_N_F_O, and _D_E_B_U_G. _F_a_c_i_l_i_t_y must be among _A_U_T_H, _A_U_T_H_P_R_I_V, |
|
|
497 _C_R_O_N, _D_A_E_M_O_N, _F_T_P, _K_E_R_N, _L_P_R, _M_A_I_L, _N_E_W_S, _U_S_E_R, _U_U_C_P, and _L_O_C_A_L_0 |
|
|
498 through _L_O_C_A_L_7. The default is equivalent to |
|
|
499 --LL _i_n_f_o_,_M_A_I_L_._N_O_T_I_C_E --LL _e_r_r_o_r_,_M_A_I_L_._E_R_R |
|
|
500 |
|
|
501 ddcccciiffdd normally sends counts of mail rejected and so forth to the system |
|
|
502 log at midnight. The SIGUSR1 signal sends an immediate report to the |
|
|
503 system log. The reports will be repeated every 24 hours at the same |
|
|
504 minute as the signal instead of at midnight. |
|
|
505 |
|
|
506 PPrroottooccooll |
|
|
507 DDcccciiffdd uses a simple ASCII protocol to receive mail messages to be |
|
|
508 checked and to return results. For each message, the MTA must open a |
|
|
509 connection to the interface daemon, send options, envelope recipients, |
|
|
510 and the message, receive the results, and close the connection. |
|
|
511 |
|
|
512 Instead of the ASCII protocol, a subset of ESMTP is enabled by --oo. Only |
|
|
513 the familiar HELO, EHLO, Mail, Rcpt, DATA, RSET, and QUIT commands and |
|
|
514 the Postfix extensions XFORWARD and XCLIENT are honored. Since SMTP has |
|
|
515 no provisions for user names, the protocol enabled by --oo depends on a |
|
|
516 list of local domain names specified with --DD to find per-user log direc- |
|
|
517 tories and whitelist files. If neither XFORWARD nor XCLIENT are used, |
|
|
518 ddcccciiffdd uses the IP address of the MTA and the value of the HELO command. |
|
|
519 |
|
|
520 In the ASCII protocol, each of the following lines are sent in order to |
|
|
521 ddcccciiffdd. Each ends with a newline ('\n') character. |
|
|
522 options zero or more blank-separated strings among: |
|
|
523 _s_p_a_m the message is already known to be spam |
|
|
524 _b_o_d_y return all of the headers with the added |
|
|
525 _X_-_D_C_C header line and the body |
|
|
526 _h_e_a_d_e_r return the _X_-_D_C_C header |
|
|
527 _q_u_e_r_y ask the DCC server about the message without |
|
|
528 reporting it, as if ddcccciiffdd were running with |
|
|
529 --QQ. |
|
|
530 _g_r_e_y_-_q_u_e_r_y only query the greylist server for this mes- |
|
|
531 sage. --GG _o_n must be in use. |
|
|
532 _n_o_-_r_e_j_e_c_t suppress the overall, one character line 'R' |
|
|
533 result. This can be useful when using ddcccciiffdd |
|
|
534 only for greylisting. |
|
|
535 _l_o_g ensure that this message is logged as if |
|
|
536 ddcccciiffdd were running with --tt --aallll,,00,, |
|
|
537 client IP address of the SMTP client in a "dotted" or "coloned" |
|
|
538 ASCII string and reverse-DNS host name. If the host name |
|
|
539 is present, it must follow a carriage return character |
|
|
540 ('\r') after the IP address. The client IP address must be |
|
|
541 present and non-null if the host name is present. The |
|
|
542 string "0.0.0.0\n" is understood the same as the null |
|
|
543 string, meaning that both the IP address and host name are |
|
|
544 absent. If the client IP address is absent, then the IP |
|
|
545 address and host name are taken from the first non-local |
|
|
546 Received header if it has the standard "name (name [IP |
|
|
547 address])..." format. Non-standard Received headers com- |
|
|
548 monly added by qmail as well as Received headers specifying |
|
|
549 IP addresses marked _M_X or _M_X_D_C_C in the global --ww _w_h_i_t_e_c_l_n_t |
|
|
550 file are skipped. |
|
|
551 HELO SMTP HELO value or nothing, followed by a newline ('\n') |
|
|
552 character. If the HELO value is null and the IP address of |
|
|
553 the SMTP client are not supplied, they will be taken from |
|
|
554 the same Received: header that supplies the IP address. |
|
|
555 sender or SMTP _M_a_i_l _F_r_o_m command value for the env_from checksum. |
|
|
556 If the sender is null, the contents of the first Return- |
|
|
557 Path: or UNIX style From_ header is used. |
|
|
558 recipients or SMTP _R_c_p_t _T_o recipient mailboxes followed by correspond- |
|
|
559 ing local user names, one (mailbox,user) pair to a line. |
|
|
560 Each optional local user name is separated from the corre- |
|
|
561 sponding mailbox recipient address by a carriage return |
|
|
562 ('\r'). A local user name can be null if it is not known, |
|
|
563 but each recipient mailbox must be non-null. If there are |
|
|
564 no lines of (mailbox,user) pairs and if the _s_p_a_m option is |
|
|
565 not included, then the _q_u_e_r_y is assumed. Mailboxes without |
|
|
566 user names will lack per-user log files and will not invoke |
|
|
567 a per-user whitelist. |
|
|
568 |
|
|
569 The last recipient-user name pair is followed by an empty line and the |
|
|
570 headers and body of the message. The end of the body of the mail message |
|
|
571 is signaled by the MTA half-closing the connection. See shutdown(2). |
|
|
572 |
|
|
573 DDcccciiffdd responds with three things. First is a one character line of the |
|
|
574 overall result advising the MTA: |
|
|
575 A accept the message for all recipients and answer the SMTP DATA |
|
|
576 command with a 2yz result. |
|
|
577 G answer with a 4yz result to embargo the message for greylisting. |
|
|
578 R reject the message and answer the DATA command with a 5yz result. |
|
|
579 S accept the message for some recipients and so answer the DATA com- |
|
|
580 mand with a 2yz result. |
|
|
581 T temporary failure by the DCC system and so answer with a 4yz |
|
|
582 result. |
|
|
583 |
|
|
584 Second is a line of characters indicating the disposition of the message |
|
|
585 for each corresponding recipient: |
|
|
586 A deliver the message |
|
|
587 G discard the message during a greylist embargo |
|
|
588 R discard the message as spam |
|
|
589 The SMTP protocol allows only a single result for the DATA command for |
|
|
590 all recipients that were not rejected before body of the message was |
|
|
591 offered with the DATA command. To accept the message for some recipients |
|
|
592 and reject it for others, the MTA must tell the SMTP client it is accept- |
|
|
593 ing the message for all recipients and then discard it for those that |
|
|
594 would reject it. |
|
|
595 |
|
|
596 Finally, if the _b_o_d_y or _h_e_a_d_e_r strings are in the first line of _o_p_t_i_o_n_s |
|
|
597 sent by the MTA to the daemon, then the _X_-_D_C_C header line or the entire |
|
|
598 body with the _X_-_D_C_C header line follows. |
|
|
599 |
|
|
600 FFIILLEESS |
|
|
601 /var/dcc is the DCC home directory in which other files are found. |
|
|
602 /var/dcc/libexec/start-dccifd |
|
|
603 and |
|
|
604 /var/dcc/libexec/rcDCC |
|
|
605 are scripts used to start the daemon. |
|
|
606 dcc/dcc_conf |
|
|
607 contains parameters used by the scripts to start DCC daemons |
|
|
608 and cron jobs. |
|
|
609 logdir is an optional directory specified with --ll and containing |
|
|
610 marked mail. Each file in the directory contains one mes- |
|
|
611 sage, at least one of whose checksums reached its --tt thresh- |
|
|
612 olds or that is interesting for some other reason. Each file |
|
|
613 starts with lines containing the date when the message was |
|
|
614 received, the IP address of the SMTP client, and SMTP enve- |
|
|
615 lope values. Those lines are followed by the body of the |
|
|
616 SMTP message including its header as it was received. Only |
|
|
617 approximately the first 32 KBytes of the body are recorded |
|
|
618 unless modified by _._/_c_o_n_f_i_g_u_r_e _-_-_w_i_t_h_-_m_a_x_-_l_o_g_-_s_i_z_e_=_x_x The |
|
|
619 checksums for the message follow the body. They are followed |
|
|
620 by lines indicate that one of the checksums is white- or |
|
|
621 blacklisted by the --ww _w_h_i_t_e_c_l_n_t file. Each log file ends |
|
|
622 with the _X_-_D_C_C header line added to the message and the dis- |
|
|
623 position of the message. |
|
|
624 map is the memory mapped file of information concerning DCC |
|
|
625 servers in the DCC home directory. |
|
|
626 whiteclnt contains the client whitelist in the format described in |
|
|
627 dcc(8). |
|
|
628 whiteclnt.dccw |
|
|
629 is a memory mapped hash table of the _w_h_i_t_e_c_l_n_t file. |
|
|
630 dccifd.pid in the --RR _r_u_n_d_i_r directory contains daemon's process ID. |
|
|
631 |
|
|
632 EEXXAAMMPPLLEESS |
|
|
633 Dccifd can be used as Postfix Before-Queue Content filter. In some tests |
|
|
634 these values for --pp and --oo in _d_c_c___c_o_n_f. |
|
|
635 |
|
|
636 DCCIFD_ENABLE=on |
|
|
637 DCCIFD_ARGS="-p 127.0.0.1,10025,127.0.0.1/32 -o 127.0.0.1,10026 |
|
|
638 |
|
|
639 worked with these lines in /etc/postfix/master.cf |
|
|
640 |
|
|
641 smtp inet n - n - - smtpd |
|
|
642 -o smtpd_proxy_filter=127.0.0.1:10025 |
|
|
643 127.0.0.1:10026 inet n - n - - smtpd |
|
|
644 -o smtpd_authorized_xforward_hosts=127.0.0.0/8 |
|
|
645 -o smtpd_client_restrictions= |
|
|
646 -o smtpd_helo_restrictions= |
|
|
647 -o smtpd_sender_restrictions= |
|
|
648 -o smtpd_recipient_restrictions=permit_mynetworks,reject |
|
|
649 -o smtpd_data_restrictions= |
|
|
650 -o mynetworks=127.0.0.0/8 |
|
|
651 -o receive_override_options=no_unknown_recipient_checks |
|
|
652 |
|
|
653 SSEEEE AALLSSOO |
|
|
654 cdcc(8), dbclean(8), dcc(8), dccd(8), dblist(8), dccm(8), dccproc(8), |
|
|
655 dccsight(8), |
|
|
656 |
|
|
657 HHIISSTTOORRYY |
|
|
658 Implementation of ddcccciiffdd Distributed Checksum Clearinghouses are based on |
|
|
659 an idea of Paul Vixie with code designed and written at Rhyolite Software |
|
|
660 starting in 2000. was started at Rhyolite Software in 2002. This docu- |
|
|
661 ment describes version 1.3.103. |
|
|
662 |
|
|
663 BBUUGGSS |
|
|
664 ddcccciiffdd uses --tt where dccproc(8) uses --cc. |
|
|
665 |
|
|
666 By default ddcccciiffdd look for its UNIX domain socket in the DCC home direc- |
|
|
667 tory, but dccm(8) looks in its --RR _r_u_n_d_i_r. |
|
|
668 |
|
|
669 Systems without setrlimit(2) and getrlimit(2) RLIMIT_NOFILE can have |
|
|
670 problems with the default limit on the number of simultaneous jobs, the |
|
|
671 value of --jj. Every job requires four open files. These problems are |
|
|
672 usually seen with errors messages that say something like |
|
|
673 dccifd[24448]: DCC: accept(): Result too large |
|
|
674 A fix is to use a smaller value for --jj or to allow ddcccciiffdd to open more |
|
|
675 files. |
|
|
676 |
|
|
677 February 26, 2009 |
