|
0
|
1 .\" Copyright (c) 2008 by Rhyolite Software, LLC |
|
|
2 .\" |
|
|
3 .\" This agreement is not applicable to any entity which sells anti-spam |
|
|
4 .\" solutions to others or provides an anti-spam solution as part of a |
|
|
5 .\" security solution sold to other entities, or to a private network |
|
|
6 .\" which employs the DCC or uses data provided by operation of the DCC |
|
|
7 .\" but does not provide corresponding data to other users. |
|
|
8 .\" |
|
|
9 .\" Permission to use, copy, modify, and distribute this software without |
|
|
10 .\" changes for any purpose with or without fee is hereby granted, provided |
|
|
11 .\" that the above copyright notice and this permission notice appear in all |
|
|
12 .\" copies and any distributed versions or copies are either unchanged |
|
|
13 .\" or not called anything similar to "DCC" or "Distributed Checksum |
|
|
14 .\" Clearinghouse". |
|
|
15 .\" |
|
|
16 .\" Parties not eligible to receive a license under this agreement can |
|
|
17 .\" obtain a commercial license to use DCC by contacting Rhyolite Software |
|
|
18 .\" at sales@rhyolite.com. |
|
|
19 .\" |
|
|
20 .\" A commercial license would be for Distributed Checksum and Reputation |
|
|
21 .\" Clearinghouse software. That software includes additional features. This |
|
|
22 .\" free license for Distributed ChecksumClearinghouse Software does not in any |
|
|
23 .\" way grant permision to use Distributed Checksum and Reputation Clearinghouse |
|
|
24 .\" software |
|
|
25 .\" |
|
|
26 .\" THE SOFTWARE IS PROVIDED "AS IS" AND RHYOLITE SOFTWARE, LLC DISCLAIMS ALL |
|
|
27 .\" WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES |
|
|
28 .\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL RHYOLITE SOFTWARE, LLC |
|
|
29 .\" BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES |
|
|
30 .\" OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
|
|
31 .\" WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, |
|
|
32 .\" ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS |
|
|
33 .\" SOFTWARE. |
|
|
34 .\" |
|
|
35 .\" Rhyolite Software DCC 1.3.103-1.120 $Revision$ |
|
|
36 .\" |
|
|
37 .Dd February 26, 2009 |
|
|
38 .ds volume-ds-DCC Distributed Checksum Clearinghouse |
|
|
39 .Dt dccproc 8 DCC |
|
|
40 .Os " " |
|
|
41 .Sh NAME |
|
|
42 .Nm dccproc |
|
|
43 .Nd Distributed Checksum Clearinghouse Procmail Interface |
|
|
44 .Sh SYNOPSIS |
|
|
45 .Nm dccproc |
|
|
46 .Bk -words |
|
|
47 .Op Fl VdAQCHER |
|
|
48 .Op Fl h Ar homedir |
|
|
49 .Op Fl m Ar map |
|
|
50 .Op Fl w Ar whiteclnt |
|
|
51 .Op Fl T Ar tmpdir |
|
|
52 .Op Fl a Ar IP-address |
|
|
53 .Op Fl f Ar env_from |
|
|
54 .Op Fl t Ar targets |
|
|
55 .Op Fl x Ar exitcode |
|
|
56 .br |
|
|
57 .Oo |
|
|
58 .Fl c Xo |
|
|
59 .Sm off |
|
|
60 .Ar type, |
|
|
61 .Op Ar log-thold, |
|
|
62 .Ar rej-thold |
|
|
63 .Sm on |
|
|
64 .Xc |
|
|
65 .Oc |
|
|
66 .Oo |
|
|
67 .Fl g Xo |
|
|
68 .Sm off |
|
|
69 .Op Ar not- |
|
|
70 .Ar type |
|
|
71 .Sm on |
|
|
72 .Xc |
|
|
73 .Oc |
|
|
74 .Op Fl S Ar header |
|
|
75 .br |
|
|
76 .Op Fl i Ar infile |
|
|
77 .Op Fl o Ar outfile |
|
|
78 .Op Fl l Ar logdir |
|
|
79 .Op Fl B Ar dnsbl-option |
|
|
80 .Op Fl L Ar ltype,facility.level |
|
|
81 .Ek |
|
|
82 .Sh DESCRIPTION |
|
|
83 .Nm Dccproc |
|
|
84 copies a complete SMTP message from standard input or a file |
|
|
85 to standard output or another file. |
|
|
86 As it copies the message, |
|
|
87 it computes the DCC checksums for the message, |
|
|
88 reports them to a DCC server, and adds |
|
|
89 a header line to the message. |
|
|
90 Another program such as |
|
|
91 .Xr procmail 1 |
|
|
92 can use the added header line to filter mail. |
|
|
93 Dccproc does not support any thresholds of its own, |
|
|
94 because equivalent effects can be achieved with regular expressions |
|
|
95 and you can apply dccproc several times using different DCC servers |
|
|
96 and then score mail based what all of the DCC servers say. |
|
|
97 .Pp |
|
|
98 Error messages are sent to stderr as well as the system log. |
|
|
99 Connect stderr and stdout to the same file to see errors in context, |
|
|
100 but direct stderr to /dev/null to keep DCC error messages out of the mail. |
|
|
101 The |
|
|
102 .Fl i |
|
|
103 option can also be used to separate the error messages. |
|
|
104 .Pp |
|
|
105 .Nm Dccproc |
|
|
106 sends reports of checksums related to mail received by DCC clients |
|
|
107 and queries about the total number of reports of particular checksums. |
|
|
108 A DCC server receives no |
|
|
109 mail, address, headers, or other information, |
|
|
110 but only cryptographically secure checksums of such information. |
|
|
111 A DCC server cannot determine the text or other information that corresponds |
|
|
112 to the checksums it receives. |
|
|
113 It only acts as a clearinghouse of counts of checksums computed by clients. |
|
|
114 .Pp |
|
|
115 For the sake of privacy for even the checksums of private mail, |
|
|
116 the checksums of senders of purely internal mail or other |
|
|
117 mail that is known to not be unsolicited bulk can be listed in a whitelist |
|
|
118 to not be reported to the DCC server. |
|
|
119 .Pp |
|
|
120 When |
|
|
121 .Xr sendmail 8 |
|
|
122 is used, |
|
|
123 .Xr dccm 8 |
|
|
124 is a better DCC interface. |
|
|
125 .Xr Dccifd 8 |
|
|
126 is more efficient than |
|
|
127 .Nm |
|
|
128 because it is a daemon, but that has costs in complexity. |
|
|
129 See |
|
|
130 .Xr dccsight 8 |
|
|
131 for a way to use previously computed checksums. |
|
|
132 .Ss OPTIONS |
|
|
133 The following options are available: |
|
|
134 .Bl -tag -width 3n |
|
|
135 .It Fl V |
|
|
136 displays the version of the DCC |
|
|
137 .Xr procmail 1 |
|
|
138 interface. |
|
|
139 .It Fl d |
|
|
140 enables debugging output from the DCC client software. |
|
|
141 Additional |
|
|
142 .Fl d |
|
|
143 options increase the number of messages. |
|
|
144 One causes error messages to be sent to STDERR as well as the system log. |
|
|
145 .It Fl A |
|
|
146 adds to existing X-DCC headers (if any) |
|
|
147 of the brand of the current server |
|
|
148 instead of |
|
|
149 replacing existing headers. |
|
|
150 .It Fl Q |
|
|
151 only queries the DCC server about the checksums of messages |
|
|
152 instead of reporting and then querying. |
|
|
153 This is useful when |
|
|
154 .Nm |
|
|
155 is used to filter mail that has already been reported to a DCC |
|
|
156 server by another DCC client such as |
|
|
157 .Xr dccm 8 . |
|
|
158 No single mail message should be reported to a DCC |
|
|
159 server more than once per recipient. |
|
|
160 .Pp |
|
|
161 It is better to use |
|
|
162 .Em MXDCC |
|
|
163 lines in the |
|
|
164 .Fl w Ar whiteclnt |
|
|
165 file for your MX mail servers that use DCC than |
|
|
166 .Fl Q |
|
|
167 .It Fl C |
|
|
168 outputs only the X-DCC header |
|
|
169 and the checksums for the message. |
|
|
170 .It Fl H |
|
|
171 outputs only the X-DCC header. |
|
|
172 .It Fl E |
|
|
173 adds lines to the start of the log file turned on with |
|
|
174 .Fl l |
|
|
175 and |
|
|
176 .Fl c |
|
|
177 describing what might have been the envelope of the message. |
|
|
178 The information for the inferred envelope comes from arguments including |
|
|
179 .Fl a |
|
|
180 and headers in the message when |
|
|
181 .Fl R |
|
|
182 is used. |
|
|
183 No lines are generated for which no information is available, |
|
|
184 such as the envelope recipient. |
|
|
185 .It Fl R |
|
|
186 says the first Received lines have the standard |
|
|
187 "helo\ (name\ [address])..." |
|
|
188 format and the address is that of the SMTP client |
|
|
189 that would otherwise be provided with |
|
|
190 .Fl a . |
|
|
191 The |
|
|
192 .Fl a |
|
|
193 option should be used |
|
|
194 if the local SMTP server adds a Received line with some other format |
|
|
195 or does not add a Received line. |
|
|
196 Received headers specifying IP addresses marked |
|
|
197 .Em MX |
|
|
198 or |
|
|
199 .Em MXDCC |
|
|
200 in the |
|
|
201 .Fl w Ar whiteclnt |
|
|
202 file are skipped. |
|
|
203 .It Fl h Ar homedir |
|
|
204 overrides the default DCC home directory, |
|
|
205 .Pa @prefix@ . |
|
|
206 .It Fl m Ar map |
|
|
207 specifies a name or path of the memory mapped parameter file instead |
|
|
208 of the default |
|
|
209 .Pa map |
|
|
210 in the DCC home directory. |
|
|
211 It should be created with the |
|
|
212 .Ic new map |
|
|
213 operation of the |
|
|
214 .Xr cdcc 8 |
|
|
215 command. |
|
|
216 .It Fl w Ar whiteclnt |
|
|
217 specifies an optional file containing SMTP client IP addresses and |
|
|
218 SMTP headers |
|
|
219 of mail that do not need X-DCC headers and whose checksums should not |
|
|
220 be reported to the DCC server. |
|
|
221 It can also contain checksums of spam. |
|
|
222 If the pathname is not absolute, it is relative to the DCC home directory. |
|
|
223 Thus, individual users with private whitelists usually specify them |
|
|
224 with absolute paths. |
|
|
225 Common whitelists shared by users must be in the DCC home directory or |
|
|
226 one of its subdirectories and owned by the set-UID user of |
|
|
227 .Nm dccproc . |
|
|
228 It is useful to |
|
|
229 .Ar include |
|
|
230 a common or system-wide whitelist in private lists. |
|
|
231 .Pp |
|
|
232 Because the contents of the |
|
|
233 .Ar whiteclnt |
|
|
234 file are used frequently, a companion file is automatically |
|
|
235 created and maintained. |
|
|
236 It has the same pathname but with an added suffix of |
|
|
237 .Ar .dccw . |
|
|
238 It contains a memory mapped hash table of the main file. |
|
|
239 .Pp |
|
|
240 .Ar Option |
|
|
241 lines can be used to modify many aspects of |
|
|
242 .Nm |
|
|
243 filtering, |
|
|
244 as described in the main |
|
|
245 .Xr dcc 8 |
|
|
246 man page. |
|
|
247 For example, an |
|
|
248 .Ar option spam-trap-accept |
|
|
249 line turns off DCC filtering and reports the message as spam. |
|
|
250 .It Fl T Ar tmpdir |
|
|
251 changes the default directory for temporary files from the system default. |
|
|
252 The system default is |
|
|
253 .Pa /tmp . |
|
|
254 .It Fl a Ar IP-address |
|
|
255 specifies the IP address (not the host name) of |
|
|
256 the immediately previous SMTP client. |
|
|
257 It is often not available. |
|
|
258 .Fl a Ar 0.0.0.0 |
|
|
259 is ignored. |
|
|
260 .Fl a . |
|
|
261 The |
|
|
262 .Fl a |
|
|
263 option should be used |
|
|
264 instead of |
|
|
265 .Fl R |
|
|
266 if the local SMTP server adds a Received line with some other format |
|
|
267 or does not add a Received line. |
|
|
268 .It Fl f Ar env_from |
|
|
269 specifies the RFC\ 821 envelope "Mail\ From" value with which the |
|
|
270 message arrived. |
|
|
271 It is often not available. |
|
|
272 If |
|
|
273 .Fl f |
|
|
274 is not present, the contents of the first Return-Path: or UNIX style |
|
|
275 From_ header is used. |
|
|
276 The |
|
|
277 .Ar env_from |
|
|
278 string is often but need not be bracketed with "<>". |
|
|
279 .It Fl t Ar targets |
|
|
280 specifies the number of addressees of the message if other than 1. |
|
|
281 The string |
|
|
282 .Ar many |
|
|
283 instead of a number asserts that there were too many addressees |
|
|
284 and that the message is unsolicited bulk email. |
|
|
285 .It Fl x Ar exitcode |
|
|
286 specifies the code or status with which |
|
|
287 .Nm |
|
|
288 exits if the |
|
|
289 .Fl c |
|
|
290 thresholds are reached or the |
|
|
291 .Fl w Ar whiteclnt |
|
|
292 file blacklists the message. |
|
|
293 .Pp |
|
|
294 The default value is EX_NOUSER. |
|
|
295 EX_NOUSER is 67 on many systems. |
|
|
296 Use 0 to always exit successfully. |
|
|
297 .It Fl c Xo |
|
|
298 .Sm off |
|
|
299 .Ar type, |
|
|
300 .Op Ar log-thold, |
|
|
301 .Ar rej-thold |
|
|
302 .Sm on |
|
|
303 .Xc |
|
|
304 sets logging and "spam" thresholds for checksum |
|
|
305 .Ar type . |
|
|
306 The checksum types are |
|
|
307 .Ar IP , |
|
|
308 .Ar env_From , |
|
|
309 .Ar From , |
|
|
310 .Ar Message-ID , |
|
|
311 .Ar substitute , |
|
|
312 .Ar Received , |
|
|
313 .Ar Body , |
|
|
314 .Ar Fuz1 , |
|
|
315 .Ar Fuz2 , |
|
|
316 .Ar rep-total , |
|
|
317 and |
|
|
318 .Ar rep . |
|
|
319 The first six, |
|
|
320 .Ar IP |
|
|
321 through |
|
|
322 .Ar substitute , |
|
|
323 have no effect except when a local DCC server configured with |
|
|
324 .Fl K |
|
|
325 is used. |
|
|
326 The |
|
|
327 .Ar substitute |
|
|
328 thresholds apply to the first substitute heading encountered in the mail |
|
|
329 message. |
|
|
330 The string |
|
|
331 .Ar ALL |
|
|
332 sets thresholds for all types, but is unlikely to be useful except for |
|
|
333 setting logging thresholds. |
|
|
334 The string |
|
|
335 .Ar CMN |
|
|
336 specifies the commonly used checksums |
|
|
337 .Ar Body , |
|
|
338 .Ar Fuz1 , |
|
|
339 and |
|
|
340 .Ar Fuz2 . |
|
|
341 .Ar Rej-thold |
|
|
342 and |
|
|
343 .Ar log-thold |
|
|
344 must be numbers, the string |
|
|
345 .Ar NEVER , |
|
|
346 or the string |
|
|
347 .Ar MANY |
|
|
348 indicating millions of targets. |
|
|
349 Counts from the DCC server as large as the threshold for any single type |
|
|
350 are taken as sufficient evidence |
|
|
351 that the message should be logged or rejected. |
|
|
352 .Pp |
|
|
353 .Ar Log-thold |
|
|
354 is the threshold at which messages are logged. |
|
|
355 It can be handy to log messages at a lower threshold to find |
|
|
356 solicited bulk mail sources such as mailing lists. |
|
|
357 If no logging threshold is set, |
|
|
358 only rejected mail and messages with complicated combinations of white |
|
|
359 and blacklisting are logged. |
|
|
360 Messages that reach at least one of their rejection thresholds are |
|
|
361 logged regardless of logging thresholds. |
|
|
362 .Pp |
|
|
363 .Ar Rej-thold |
|
|
364 is the threshold at which messages are considered "bulk," |
|
|
365 and so should be rejected or discarded if not whitelisted. |
|
|
366 .Pp |
|
|
367 DCC Reputation thresholds in the commercial version |
|
|
368 of the DCC are controlled by thresholds on checksum types |
|
|
369 .Ar rep |
|
|
370 and |
|
|
371 .Ar rep-total . |
|
|
372 Messages from an IP address that the DCC database says has sent |
|
|
373 more than |
|
|
374 .Fl t Ar rep-total,log-thold |
|
|
375 messages are logged. |
|
|
376 A DCC Reputation is computed for messages received |
|
|
377 from IP addresses that |
|
|
378 have sent more than |
|
|
379 .Fl t Ar rep-total,log-thold |
|
|
380 messages. |
|
|
381 The DCC Reputation of an IP address is the percentage of its messages |
|
|
382 that have been detected as bulk |
|
|
383 or having at least 10 recipients. |
|
|
384 The defaults are equivalent to |
|
|
385 .Fl t Ar rep,never |
|
|
386 and |
|
|
387 .Fl t Ar rep-total,never,20 . |
|
|
388 .Pp |
|
|
389 Bad DCC Reputations do not reject mail unless enabled by an |
|
|
390 .Ar option DCC-rep-on |
|
|
391 line in a |
|
|
392 .Pa whiteclnt |
|
|
393 file. |
|
|
394 .Pp |
|
|
395 The checksums of locally whitelisted messages are not checked with |
|
|
396 the DCC server and so only the number of targets of the current copy of |
|
|
397 a whitelisted message are compared against the thresholds. |
|
|
398 .Pp |
|
|
399 The default is |
|
|
400 .Ar ALL,NEVER , |
|
|
401 so that nothing is discarded, rejected, or logged. |
|
|
402 A common choice is |
|
|
403 .Ar CMN,25,50 |
|
|
404 to reject or discard |
|
|
405 mail with common bodies except as overridden by |
|
|
406 the whitelist of the DCC server, the sendmail |
|
|
407 .Em ${dcc_isspam} |
|
|
408 and |
|
|
409 .Em ${dcc_notspam} |
|
|
410 macros, and |
|
|
411 .Fl g , |
|
|
412 and |
|
|
413 .Fl w . |
|
|
414 .It Fl g Xo |
|
|
415 .Sm off |
|
|
416 .Op Ar not- |
|
|
417 .Ar type |
|
|
418 .Sm on |
|
|
419 .Xc |
|
|
420 indicates that whitelisted, |
|
|
421 .Ar OK |
|
|
422 or |
|
|
423 .Ar OK2 , |
|
|
424 counts from the DCC server for a type of checksum are to be believed. |
|
|
425 They should be ignored if prefixed with |
|
|
426 .Ar not- . |
|
|
427 .Ar Type |
|
|
428 is one of the same set of strings as for |
|
|
429 .Fl c . |
|
|
430 Only |
|
|
431 .Ar IP , |
|
|
432 .Ar env_From , |
|
|
433 and |
|
|
434 .Ar From |
|
|
435 are likely choices. |
|
|
436 By default all three are honored, |
|
|
437 and hence the need for |
|
|
438 .Ar not- . |
|
|
439 .It Fl S Ar hdr |
|
|
440 adds to the list of substitute or locally chosen headers that |
|
|
441 are checked with the |
|
|
442 .Fl w Ar whiteclnt |
|
|
443 file and sent to the DCC server. |
|
|
444 The checksum of the last header of type |
|
|
445 .Ar hdr |
|
|
446 found in the message is checked. |
|
|
447 As many as 6 different substitute headers can be specified, but only |
|
|
448 the checksum of the first of the 6 will be sent to the DCC server. |
|
|
449 .It Fl i Ar infile |
|
|
450 specifies an input file for the entire message |
|
|
451 instead of standard input. |
|
|
452 If not absolute, the pathname is interpreted relative to the |
|
|
453 directory in which |
|
|
454 .Nm |
|
|
455 was started. |
|
|
456 .It Fl o Ar outfile |
|
|
457 specifies an output file for the entire message including headers |
|
|
458 instead of standard output. |
|
|
459 If not absolute, the pathname is interpreted relative to the |
|
|
460 directory in which |
|
|
461 .Nm |
|
|
462 was started. |
|
|
463 .It Fl l Ar logdir |
|
|
464 specifies a directory for copies of messages whose |
|
|
465 checksum target counts exceed |
|
|
466 .Fl c |
|
|
467 thresholds. |
|
|
468 The format of each file is affected by |
|
|
469 .Fl E . |
|
|
470 .Pp |
|
|
471 See the FILES section below concerning the contents of the files. |
|
|
472 See also the |
|
|
473 .Ar option log-subdirectory-{day,hour,minute} |
|
|
474 lines in |
|
|
475 .Pa whiteclnt |
|
|
476 files described in |
|
|
477 .Xr dcc 8 . |
|
|
478 .Pp |
|
|
479 The directory is relative to the DCC home directory if it is not absolute |
|
|
480 .It Fl B Ar dnsbl-option |
|
|
481 enables DNS blacklist checks of the SMTP client IP address, SMTP envelope |
|
|
482 Mail_From sender domain name, and of host names in URLs in the message body. |
|
|
483 Body URL blacklisting has too many false positives to use on |
|
|
484 abuse mailboxes. |
|
|
485 It is less effective than greylisting with |
|
|
486 .Xr dccm 8 |
|
|
487 or |
|
|
488 .Xr dccifd 8 |
|
|
489 but can be useful in situations where |
|
|
490 greylisting cannot be used. |
|
|
491 .Pp |
|
|
492 .Ar Dnsbl-option |
|
|
493 is either one of the |
|
|
494 .Fl B Ar set:option |
|
|
495 forms or |
|
|
496 .Bd -literal -compact -offset 4n |
|
|
497 .Fl B Xo |
|
|
498 .Sm off |
|
|
499 .Ar domain Oo Ar ,IPaddr |
|
|
500 .Op Ar /xx Op Ar ,bltype Oc |
|
|
501 .Sm on |
|
|
502 .Xc |
|
|
503 .Ed |
|
|
504 .Ar Domain |
|
|
505 is a DNS blacklist domain such as example.com |
|
|
506 that will be searched. |
|
|
507 .Ar IPaddr Ns Op Ar /xxx |
|
|
508 is the string "any" |
|
|
509 an IP address in the DNS blacklist |
|
|
510 that indicates that the mail message |
|
|
511 should be rejected, |
|
|
512 or a CIDR block covering results from the DNS blacklist. |
|
|
513 "127.0.0.2" is assumed if |
|
|
514 .Ar IPaddr |
|
|
515 is absent. |
|
|
516 IPv6 addresses can be specified with the usual colon (:) notation. |
|
|
517 Names can be used instead of numeric addresses. |
|
|
518 The type of DNS blacklist |
|
|
519 is specified by |
|
|
520 .Ar bltype |
|
|
521 as |
|
|
522 .Ar name , |
|
|
523 .Ar IPv4 , |
|
|
524 or |
|
|
525 .Ar IPv6 . |
|
|
526 Given an envelope sender domain name or a domain name in a URL of |
|
|
527 spam.domain.org |
|
|
528 and a blacklist of type |
|
|
529 .Ar name , |
|
|
530 spam.domain.org.example.com will be tried. |
|
|
531 Blacklist types of |
|
|
532 .Ar IPv4 |
|
|
533 and |
|
|
534 .Ar IPv6 |
|
|
535 require that the domain name in a URL sender address |
|
|
536 be resolved into an IPv4 or IPv6 |
|
|
537 address. |
|
|
538 The address is then written as a reversed string of decimal |
|
|
539 octets to check the DNS blacklist, as in 2.0.0.127.example.com, |
|
|
540 .Pp |
|
|
541 More than one blacklist can be specified and blacklists can be grouped. |
|
|
542 All searching within a group is stopped at the first positive result. |
|
|
543 .Pp |
|
|
544 Unlike |
|
|
545 .Xr dccm 8 |
|
|
546 and |
|
|
547 .Xr dccifd 8 , |
|
|
548 no |
|
|
549 .Ar option\ DNSBL-on |
|
|
550 line is required in the |
|
|
551 .Pa whiteclnt |
|
|
552 file. |
|
|
553 A |
|
|
554 .Fl B |
|
|
555 argument is sufficient to show that DNSBL filtering is wanted by the |
|
|
556 .Nm |
|
|
557 user. |
|
|
558 .Bl -tag -width 3n |
|
|
559 .It Fl B Ar set:no-client |
|
|
560 says that SMTP client IP addresses and reverse DNS domain names should |
|
|
561 not be checked in the following blacklists. |
|
|
562 .br |
|
|
563 .Fl B Ar set:client |
|
|
564 restores the default for the following blacklists. |
|
|
565 .It Fl B Ar set:no-mail_host |
|
|
566 says that SMTP envelope Mail_From sender domain names should |
|
|
567 not be checked in the following blacklists. |
|
|
568 .Fl B Ar set:mail_host |
|
|
569 restores the default. |
|
|
570 .It Fl B Ar set:no-URL |
|
|
571 says that URLs in the message body should not be checked in the |
|
|
572 in the following blacklists. |
|
|
573 .Fl B Ar set:URL |
|
|
574 restores the default. |
|
|
575 .It Fl B Ar set:no-MX |
|
|
576 says MX servers of sender Mail_From domain names and host names in URLs |
|
|
577 should not be checked in the following blacklists. |
|
|
578 .br |
|
|
579 .Fl B Ar set:MX |
|
|
580 restores the default. |
|
|
581 .It Fl B Ar set:no-NS |
|
|
582 says DNS servers of sender Mail_From domain names and host names in URLs |
|
|
583 should not be checked in the following blacklists. |
|
|
584 .Fl B Ar set:NS |
|
|
585 restores the default. |
|
|
586 .It Fl B Ar set:defaults |
|
|
587 is equivalent to all of |
|
|
588 .Fl B Ar set:no-temp-fail |
|
|
589 .Fl B Ar set:client |
|
|
590 .br |
|
|
591 .Fl B Ar set:mail_host |
|
|
592 .Fl B Ar set:URL |
|
|
593 .Fl B Ar set:MX |
|
|
594 and |
|
|
595 .Fl B Ar set:NS |
|
|
596 .It Fl B Ar set:group=X |
|
|
597 adds later DNS blacklists specified with |
|
|
598 .Bd -literal -compact -offset 4n |
|
|
599 .Fl B Xo |
|
|
600 .Sm off |
|
|
601 .Ar domain Oo Ar ,IPaddr |
|
|
602 .Op Ar /xx Op Ar ,bltype Oc |
|
|
603 .Sm on |
|
|
604 .Xc |
|
|
605 .Ed |
|
|
606 to group 1, 2, or 3. |
|
|
607 .It Fl B Ar set:debug=X |
|
|
608 sets the DNS blacklist logging level |
|
|
609 .It Fl B Ar set:msg-secs=S |
|
|
610 limits |
|
|
611 .Nm |
|
|
612 to |
|
|
613 .Ar S |
|
|
614 seconds total for checking all DNS blacklists. |
|
|
615 The default is 25. |
|
|
616 .It Fl B Ar set:URL-secs=S |
|
|
617 limits |
|
|
618 .Nm |
|
|
619 to at most |
|
|
620 .Ar S |
|
|
621 seconds resolving and checking any single URL. |
|
|
622 The default is 11. |
|
|
623 Some spam contains dozens of URLs and that |
|
|
624 some "spamvertised" URLs contain host names that need minutes to |
|
|
625 resolve. |
|
|
626 Busy mail systems cannot afford to spend minutes checking each incoming |
|
|
627 mail message. |
|
|
628 .El |
|
|
629 .It Fl L Ar ltype,facility.level |
|
|
630 specifies how messages should be logged. |
|
|
631 .Ar Ltype |
|
|
632 must be |
|
|
633 .Ar error , |
|
|
634 .Ar info , |
|
|
635 or |
|
|
636 .Ar off |
|
|
637 to indicate which of the two types of messages are being controlled or |
|
|
638 to turn off all |
|
|
639 .Xr syslog 3 |
|
|
640 messages from |
|
|
641 .Nm . |
|
|
642 .Ar Level |
|
|
643 must be a |
|
|
644 .Xr syslog 3 |
|
|
645 level among |
|
|
646 .Ar EMERG , |
|
|
647 .Ar ALERT , |
|
|
648 .Ar CRIT , ERR , |
|
|
649 .Ar WARNING , |
|
|
650 .Ar NOTICE , |
|
|
651 .Ar INFO , |
|
|
652 and |
|
|
653 .Ar DEBUG . |
|
|
654 .Ar Facility |
|
|
655 must be among |
|
|
656 .Ar AUTH , |
|
|
657 .Ar AUTHPRIV , |
|
|
658 .Ar CRON , |
|
|
659 .Ar DAEMON , |
|
|
660 .Ar FTP , |
|
|
661 .Ar KERN , |
|
|
662 .Ar LPR , |
|
|
663 .Ar MAIL , |
|
|
664 .Ar NEWS , |
|
|
665 .Ar USER , |
|
|
666 .Ar UUCP , |
|
|
667 and |
|
|
668 .Ar LOCAL0 |
|
|
669 through |
|
|
670 .Ar LOCAL7 . |
|
|
671 The default is equivalent to |
|
|
672 .Dl Fl L Ar info,MAIL.NOTICE Fl L Ar error,MAIL.ERR |
|
|
673 .El |
|
|
674 .Pp |
|
|
675 .Nm |
|
|
676 exits with 0 on success and with the |
|
|
677 .Fl x |
|
|
678 value if the |
|
|
679 .Fl c |
|
|
680 thresholds are reached or the |
|
|
681 .Fl w Ar whiteclnt |
|
|
682 file blacklists the message. |
|
|
683 If at all possible, |
|
|
684 the input mail message is output to standard output or the |
|
|
685 .Fl o Ar outfile |
|
|
686 despite errors. |
|
|
687 If possible, error messages are put into the system log instead of |
|
|
688 being mixed with the output mail message. |
|
|
689 The exit status is zero for errors so that the mail message |
|
|
690 will not be rejected. |
|
|
691 .Pp |
|
|
692 If |
|
|
693 .Nm |
|
|
694 is run more than 500 times in fewer than 5000 seconds, |
|
|
695 .Nm |
|
|
696 tries to start |
|
|
697 .Xr Dccifd 8 . |
|
|
698 The attempt is made at most once per hour. |
|
|
699 Dccifd is significantly more efficient than |
|
|
700 .Nm . |
|
|
701 With luck, mechanisms such as SpamAssassin will notice when dccifd is |
|
|
702 running and switch to dccifd. |
|
|
703 .Sh FILES |
|
|
704 .Bl -tag -width whiteclnt -compact |
|
|
705 .It Pa @prefix@ |
|
|
706 DCC home directory in which other files are found. |
|
|
707 .It Pa map |
|
|
708 memory mapped file in the DCC home directory |
|
|
709 of information concerning DCC servers. |
|
|
710 .It Pa whiteclnt |
|
|
711 contains the client whitelist in |
|
|
712 the format described in |
|
|
713 .Xr dcc 8 . |
|
|
714 .It Pa whiteclnt.dccw |
|
|
715 is a memory mapped hash table corresponding to the |
|
|
716 .Pa whiteclnt |
|
|
717 file. |
|
|
718 .It Pa tmpdir |
|
|
719 contains temporary files created and deleted as |
|
|
720 .Nm |
|
|
721 processes the message. |
|
|
722 .It Pa logdir |
|
|
723 is an optional directory specified with |
|
|
724 .Fl l |
|
|
725 and containing marked mail. |
|
|
726 Each file in the directory contains one message, at least one of whose |
|
|
727 checksums reached one of its |
|
|
728 .Fl c |
|
|
729 thresholds. |
|
|
730 The entire body of the SMTP message including its header |
|
|
731 is followed by the checksums for the message. |
|
|
732 .El |
|
|
733 .Sh EXAMPLES |
|
|
734 The following |
|
|
735 .Xr procmailrc 5 |
|
|
736 rule adds an X-DCC header to passing mail |
|
|
737 .Bd -literal -offset 4n |
|
|
738 :0 f |
|
|
739 | /usr/local/bin/dccproc -ERw whiteclnt |
|
|
740 .Ed |
|
|
741 .Pp |
|
|
742 This |
|
|
743 .Xr procmailrc 5 |
|
|
744 recipe rejects mail with total counts of 10 or larger for |
|
|
745 the commonly used checksums: |
|
|
746 .Bd -literal -offset 4n |
|
|
747 :0 fW |
|
|
748 | /usr/local/bin/dccproc -ERw whiteclnt -ccmn,10 |
|
|
749 :0 e |
|
|
750 { |
|
|
751 EXITCODE=67 |
|
|
752 :0 |
|
|
753 /dev/null |
|
|
754 } |
|
|
755 .Ed |
|
|
756 .Sh SEE ALSO |
|
|
757 .Xr cdcc 8 , |
|
|
758 .Xr dcc 8 , |
|
|
759 .Xr dbclean 8 , |
|
|
760 .Xr dccd 8 , |
|
|
761 .Xr dblist 8 , |
|
|
762 .Xr dccifd 8 , |
|
|
763 .Xr dccm 8 , |
|
|
764 .Xr dccsight 8 , |
|
|
765 .Xr mail 1 , |
|
|
766 .Xr procmail 1 . |
|
|
767 .Sh HISTORY |
|
|
768 Distributed Checksum Clearinghouses are based on an idea of Paul Vixie. |
|
|
769 Implementation of |
|
|
770 .Nm |
|
|
771 was started at Rhyolite Software in 2000. |
|
|
772 This document describes version 1.3.103. |
|
|
773 .Sh BUGS |
|
|
774 .Nm |
|
|
775 uses |
|
|
776 .Fl c |
|
|
777 where |
|
|
778 .Xr dccm 8 |
|
|
779 uses |
|
|
780 .Fl t . |
