|
0
|
1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> |
|
|
2 <HTML> |
|
|
3 <HEAD> |
|
|
4 <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> |
|
|
5 <TITLE>DCC FAQ</TITLE> |
|
|
6 <META http-equiv="Content-Style-Type" content="text/css"> |
|
|
7 <STYLE type="text/css"> |
|
|
8 <!-- |
|
|
9 BODY {background-color:white; color:black} |
|
|
10 UL.FAQlist {margin-left:10%; margin-right:10%} |
|
|
11 DL.FAQbody {margin-left:5%} |
|
|
12 DT {font-weight:bolder} |
|
|
13 .small {font-size:smaller} |
|
|
14 IMG.logo {width:6em; vertical-align:middle} |
|
|
15 --> |
|
|
16 </STYLE> |
|
|
17 </HEAD> |
|
|
18 |
|
|
19 <BODY> |
|
|
20 <H1>Distributed Checksum Clearinghouse (DCC) Frequently Answered Questions</H1> |
|
|
21 |
|
|
22 <P> |
|
|
23 <A HREF="http://www.rhyolite.com/dcc/FAQ.html">Current versions</A> |
|
|
24 of this list can be found among the |
|
|
25 <A HREF="http://www.rhyolite.com/dcc/">http://www.rhyolite.com/dcc/</A> |
|
|
26 web pages and their <A HREF="http://www.dcc-servers.net/dcc/FAQ.html">mirror</A> |
|
|
27 at |
|
|
28 <A HREF="http://www.dcc-servers.net/dcc/">http://www.dcc-servers.net/dcc/</A>. |
|
|
29 |
|
|
30 |
|
|
31 <UL class="FAQlist"> |
|
|
32 |
|
|
33 <LI><A HREF="#what-is-it"> |
|
|
34 What is the Distributed Checksum Clearinghouse or DCC?</A> |
|
|
35 <LI><A HREF="#license"> |
|
|
36 Is the DCC source free?</A> |
|
|
37 <LI><A HREF="#source"> |
|
|
38 Where can I get DCC source?</A> |
|
|
39 <LI><A HREF="#binary"> |
|
|
40 Where can I get DCC RPMs, packages or other binary forms?</A> |
|
|
41 <LI><A HREF="#fuzzy-personalize"> |
|
|
42 Do the fuzzy checksums ignore <Q lang="en-us">personalizations</Q>?</A> |
|
|
43 <LI><A HREF="#system-load"> |
|
|
44 How much bandwidth, disk space, and computing does the DCC require?</A> |
|
|
45 <LI><A HREF="#need-server"> |
|
|
46 Do I need to run a DCC server?</A> |
|
|
47 <LI><A HREF="#crash"> |
|
|
48 What happens to my mail if the DCC break?</A> |
|
|
49 <LI><a HREF="#mark-only"> |
|
|
50 How do I mark spam without rejecting it?</A> |
|
|
51 <LI><A HREF="#bad-man"> |
|
|
52 Why doesn't the man command find the man pages?</A> |
|
|
53 <LI><A HREF="#sendmail-only"> |
|
|
54 Must sendmail be used with DCC?</A> |
|
|
55 <LI><A HREF="#smtpd"> |
|
|
56 Can the DCC be used with smtpd?</A> |
|
|
57 <LI><A HREF="#exim"> |
|
|
58 Can the DCC be used with Exim?</A> |
|
|
59 <LI><A HREF="#other-MUAs"> |
|
|
60 How can the DCC be used with mail user agents?</A> |
|
|
61 <LI><A HREF="#spamass"> |
|
|
62 Can the DCC be used with SpamAssassin or other spam filters?</A> |
|
|
63 <LI><A HREF="#dcc-delay"> |
|
|
64 How long must SpamAssassin or an MTA wait for DCC results?</A> |
|
|
65 <LI><A HREF="#root-needed"> |
|
|
66 Must I have the root password to use DCC?</A> |
|
|
67 <LI><A HREF="#firewall-ports2"> |
|
|
68 Why don't the public DCC servers work? Do I need a client-ID?</A> |
|
|
69 <LI><A HREF="#firewall-ports"> |
|
|
70 Which ports do I need to open in my firewall?</A> |
|
|
71 <LI><A HREF="#cleaning1"> |
|
|
72 Why does the dccd database grow without bound?</A> |
|
|
73 <LI><A HREF="#cleaning2"> |
|
|
74 The dccd database is corrupt. What should I do?</A> |
|
|
75 <LI><A HREF="#cleaning3"> |
|
|
76 How can I stop the log directories from overflowing?</A> |
|
|
77 <LI><A HREF="#bad-locks"> |
|
|
78 Why do my DCC clients including cdcc and dccproc |
|
|
79 complain about <Q lang="en-us">Resource temporarily unavailable</Q>?</A> |
|
|
80 <LI><A HREF="#maxprocs"> |
|
|
81 Why does dccifd or dccm complain about |
|
|
82 <Q lang="en-us">thread_create() failed: 11, try again</Q>? or |
|
|
83 <Q lang="en-us">pthread_create(): Cannot allocate memory</Q>?</A> |
|
|
84 <LI><A HREF="#max-work"> |
|
|
85 Why does dccm or dccifd complain about |
|
|
86 <Q lang="en-us">too many simultaneous mail messages</Q>?</A> |
|
|
87 <LI><A HREF="#server-pick"> |
|
|
88 Why doesn't my DCC client pick my local DCC server?</A> |
|
|
89 <LI><A HREF="#IDs1"> |
|
|
90 If I have a server-ID, do I need a DCC client-ID, or vice versa?</A> |
|
|
91 <LI><A HREF="#IDs2">Why does my DCC server complain about |
|
|
92 "rejected server-IDs" among flooded checksum reports?</A> |
|
|
93 <LI><A HREF="#server-rate-limits"> |
|
|
94 Why does my DCC server refuse to accept more than 50 operations per second?</A> |
|
|
95 <LI><A HREF="#private-server"> |
|
|
96 How do I keep strangers from using my DCC server?</A> |
|
|
97 <LI><A HREF="#dccm-log1"> |
|
|
98 How can I determine why dccm reported |
|
|
99 a message as spam or with a recipient count of "MANY"?</A> |
|
|
100 <LI><A HREF="#dblist1"> |
|
|
101 How can I see what checksums my server has heard from its clients?</A> |
|
|
102 <LI><A HREF="#whitelist13"> |
|
|
103 How do I stop DCC false positives?</A> |
|
|
104 <LI><A HREF="#whitelist1"> |
|
|
105 Why is mail from my favorite mailing list marked with an |
|
|
106 <I>X-DCC</I> header line that says it is spam?</A> |
|
|
107 <LI><A HREF="#whitelist11"> |
|
|
108 Why are acknowledgments of spam reports mistakenly |
|
|
109 marked as spam by DCC?</A> |
|
|
110 <LI><A HREF="#x-dcc-header1"> |
|
|
111 Why are some checksums missing from my <I>X-DCC</I> header lines?</A> |
|
|
112 <LI><A HREF="#whitelist9"> |
|
|
113 How do I maintain client whitelists?</A> |
|
|
114 <LI><A HREF="#whitelist2"> |
|
|
115 Do I need both server and client whitelists?</A> |
|
|
116 <LI><A HREF="#whitelist3"> |
|
|
117 When the whitelist file used by dccd, dccm or dccifd is changed, |
|
|
118 what must be done to tell the software about the change?</A> |
|
|
119 <LI><A HREF="#whitelist14"> |
|
|
120 How do I test a whiteclnt file?</A> |
|
|
121 <LI><A HREF="#reg-exps1"> |
|
|
122 Can I use wild cards or regular expressions in DCC whitelists?</A> |
|
|
123 <LI><A HREF="#whitelist10"> |
|
|
124 How do I whitelist mail from a legitimate |
|
|
125 bulk mailer using its name or SMTP headers such as Mailing-List or the |
|
|
126 Habeas SWE headers?</A> |
|
|
127 <LI><A HREF="#incompat-whitelists"> |
|
|
128 Why does dccm or dccifd complain about "incompatible whitelists"?</A> |
|
|
129 <LI><A HREF="#whitelist4"> |
|
|
130 Why do legitimate mail messages have |
|
|
131 <I>X-DCC</I> header lines that say they are "bulk", "many", or spam?</A> |
|
|
132 <LI><A HREF="#whitelist5"> |
|
|
133 Are IP address blocks in whitelists used by dccproc?</A> |
|
|
134 <LI><A HREF="#whitelist6"> |
|
|
135 Why is dccproc is ignoring <I>env_from</I> whitelist entries?</A> |
|
|
136 <LI><A HREF="#delck"> |
|
|
137 What if I make a mistake with |
|
|
138 dccproc -t many and report legitimate mail as spam?</A> |
|
|
139 <LI><A HREF="#whitelist8"> |
|
|
140 Can the sendmail "spamfriend" mechanism tell |
|
|
141 dccm to not check mail sent to some addresses?</A> |
|
|
142 <LI><A HREF="#whitelist12"> |
|
|
143 How do I tell dccm to not check mail for an entire domain?</A> |
|
|
144 <LI><A HREF="#false-positives"> |
|
|
145 How can I avoid polluting the databases of DCC servers with |
|
|
146 checksums of my mail that is not spam?</A> |
|
|
147 <LI><A HREF="#spamtrap"> |
|
|
148 Can DCC be fed with <Q lang="en-us">spam traps</Q>?</A> |
|
|
149 <LI><A HREF="#flood3"> |
|
|
150 How many flooding peers does my DCC server need?</A> |
|
|
151 <LI><A HREF="#flood1"> |
|
|
152 Do I need to tell the operators of other DCC servers |
|
|
153 the password for controlling my server to turn on flooding?</A> |
|
|
154 <LI><A HREF="#flood2"> |
|
|
155 How can I figure out why flooding is not working?</A> |
|
|
156 <LI><A HREF="#rtt"> |
|
|
157 Why didn't the RTT reported by |
|
|
158 the cdcc info |
|
|
159 operation change when my network topology changed?</A> |
|
|
160 <LI><A HREF="#socks1"> |
|
|
161 When my clients are configured to use SOCKS, they do not |
|
|
162 realize immediately when a server is down.</A> |
|
|
163 </UL> |
|
|
164 |
|
|
165 <P> |
|
|
166 <HR> |
|
|
167 |
|
|
168 <DL class="FAQbody"> |
|
|
169 |
|
|
170 <DT><A NAME="what-is-it"> |
|
|
171 What is the Distributed Checksum Clearinghouse or DCC?</A> |
|
|
172 <DD> |
|
|
173 The DCC or Distributed Checksum Clearinghouse is an anti-spam content filter |
|
|
174 that runs on a variety of |
|
|
175 <A HREF="INSTALL.html#Compatibility">operating systems</A>. |
|
|
176 The idea of the DCC is that if mail recipients could compare |
|
|
177 the mail they receive, they could recognize unsolicited bulk mail. |
|
|
178 A DCC server totals reports of "fuzzy" checksums of |
|
|
179 messages from clients and answers queries about the total counts |
|
|
180 for checksums of mail messages. |
|
|
181 <P> |
|
|
182 See the main <A HREF="dcc.html">DCC man page</A> as well as the |
|
|
183 <A HREF="http://www.rhyolite.com/dcc/#overview">DCC web page</A> |
|
|
184 and its <A HREF="http://www.dcc-servers.net/dcc/#overview">mirror</A>. |
|
|
185 |
|
|
186 |
|
|
187 <P><DT><A NAME="license"> |
|
|
188 Is the DCC source free</A> |
|
|
189 <DD> |
|
|
190 The non-commercial Distributed Checksum Clearinghouse source carries a |
|
|
191 <A HREF="LICENSE">license</A> |
|
|
192 that is free only to organizations that do not sell filtering devices or |
|
|
193 services except to their own users and that participate in the global |
|
|
194 DCC network. |
|
|
195 ISPs that use DCC to filter mail for their |
|
|
196 own users are intended to be covered by the free license. |
|
|
197 You can redistribute unchanged copies of the free source, but you <B>may not</B> |
|
|
198 redistribute modified, "fixed," or "improved" versions of the source |
|
|
199 or binaries. |
|
|
200 You also can't call it your own or blame anyone for the results of using it. |
|
|
201 <P> |
|
|
202 Organizations that do not qualify for the free license are welcome to |
|
|
203 inquire about licenses for the commercial version by email to |
|
|
204 <A HREF="mailto:sales@rhyolite.com">sales@rhyolite.com</A> |
|
|
205 or via the |
|
|
206 <A HREF="http://www.rhyolite.com/cgi-bin/ct.cgi?sb=Commercial+DCC+License">form</A>. |
|
|
207 The commercial version supports |
|
|
208 <A HREF="http://www.rhyolite.com/dcc/reputations.html">DCC |
|
|
209 Reputations</A>. |
|
|
210 <P> |
|
|
211 Please note that organizations that do not qualify for the free DCC license |
|
|
212 have never been allowed to use the public DCC servers. |
|
|
213 |
|
|
214 |
|
|
215 <P><DT><A NAME="source"> |
|
|
216 Where can I get DCC source?</A> |
|
|
217 <DD> |
|
|
218 The official DCC source repositories are at |
|
|
219 <A HREF="http://www.rhyolite.com/dcc/source/dcc.tar.Z">www.rhyolite.com/dcc/</A> |
|
|
220 and |
|
|
221 <A HREF="http://www.dcc-servers.net/dcc/source/dcc.tar.Z">http://www.dcc-servers.net/dcc/</A>. |
|
|
222 <P> |
|
|
223 Please do not try to use ancient versions of DCC software dating from early |
|
|
224 2005 and redistributed by third parties including some Linux packagers. |
|
|
225 Those versions do not detect bulk mail as well as more recent versions. |
|
|
226 Installations using those old versions also have problems using the |
|
|
227 public DCC servers that often make it necessary to add their IP addresses |
|
|
228 to the blacklist that protects the public DCC servers. |
|
|
229 Even worse, all known Linux redistributions of DCC software have been |
|
|
230 changed in ways that break things, including the |
|
|
231 <A HREF="misc/updatedcc.in">libexec/updatedcc</A> shell script that could |
|
|
232 otherwise be used to fetch, configure, compile, install, and restart |
|
|
233 a current version. |
|
|
234 <P> |
|
|
235 When installing DCC software, please consider the installation instructions |
|
|
236 in the |
|
|
237 <A HREF="INSTALL.html">INSTALL.html</A> file included with |
|
|
238 the source or in the |
|
|
239 <A HREF="http://www.dcc-servers.net/dcc/INSTALL.html">on line source trees</A>. |
|
|
240 |
|
|
241 |
|
|
242 <P><DT><A NAME="binary"> |
|
|
243 Where can I get DCC RPMs, packages or other binary forms?</A> |
|
|
244 <DD> |
|
|
245 There are no official distributions of DCC binaries, |
|
|
246 whether simple a.out files, RPM Package Manager (RPM) packages, |
|
|
247 or BSD style ports or packages (pkg). |
|
|
248 There are many unofficial sources of DCC binaries, including |
|
|
249 Linux RPMs and BSD style packages. |
|
|
250 <P> |
|
|
251 As of 2008, the FreeBSD packages are not too far out of date and |
|
|
252 include a working version of the |
|
|
253 <A HREF="misc/updatedcc.in">libexec/updatedcc</A> shell script that |
|
|
254 fetches, configures, compiles, installs, and restarts |
|
|
255 a current version. |
|
|
256 <P> |
|
|
257 As far as known in 2008, all DCC RPMs offered by Linux distributors |
|
|
258 are based on DCC software from 2005 and <STRONG>should not</STRONG> be used. |
|
|
259 |
|
|
260 |
|
|
261 <P><DT><A NAME="fuzzy-personalize"> |
|
|
262 Do the fuzzy checksums ignore <Q lang="en-us">personalizations</Q>?</A> |
|
|
263 <DD> |
|
|
264 Yes, they ignore many <Q lang="en-us">personalizations</Q> and |
|
|
265 <Q lang="en-us">hash busters</Q>. |
|
|
266 |
|
|
267 |
|
|
268 <P><DT><A NAME="system-load"> |
|
|
269 How much bandwidth, disk space, and computing does the DCC require?</A> |
|
|
270 <DD> |
|
|
271 The UDP packets used by a DCC client to obtain the checksum totals |
|
|
272 from a DCC server for a mail message generally use less bandwidth than |
|
|
273 the DNS queries required to receive the same message. |
|
|
274 A DCC client needs very little disk space. |
|
|
275 <P> |
|
|
276 Bulk messages are usually logged by DCC clients. |
|
|
277 On systems receiving a lot of mail, the mechanisms for automatically |
|
|
278 creating new log directories every minute, day, or hour |
|
|
279 can keep any single log directory from becoming too large. |
|
|
280 See the <A HREF="dccm.html#OPTION-l">dccm</A> |
|
|
281 and |
|
|
282 <A HREF="dccproc.html#OPTION-l">dccproc</A> |
|
|
283 man pages. |
|
|
284 <P> |
|
|
285 About 1.4 GBytes/day are exchanged between each pair of DCC servers. |
|
|
286 Each server has 3 or 4 peers. |
|
|
287 The resulting database is about 3 GBytes with the default expiration |
|
|
288 parameters.. |
|
|
289 However, while <A HREF="dbclean.html">dbclean</A> is deleting old checksums, |
|
|
290 there are three copies of the database. |
|
|
291 The DCC clients and server do not need many CPU cycles, |
|
|
292 but the daily executions of <A HREF="dbclean.html">dbclean</A> |
|
|
293 on a system with a DCC server |
|
|
294 require a computer with at least 2 or 3 GBytes of RAM. |
|
|
295 In 2006, |
|
|
296 a DCC server prefers 4 GBytes of RAM and can use 6 GBytes. |
|
|
297 12 to 18 GBytes of disk space are also needed. |
|
|
298 <P> |
|
|
299 DCC servers used by clients handling 100,000 or more messages per day |
|
|
300 need to be larger. |
|
|
301 Each additional 100,000 messages/day need about 100 MBytes of disk space |
|
|
302 and system memory, given the default expiration used by |
|
|
303 <A HREF="dbclean.html#OPTION-e">dbclean</A>. |
|
|
304 |
|
|
305 |
|
|
306 <P><DT><A NAME="need-server">Do I need to run a DCC server?</A> |
|
|
307 <DD> |
|
|
308 A mail system that processes fewer than 100,000 mail messages per day |
|
|
309 uses less of its own bandwidth and the bandwidth of other DCC servers |
|
|
310 by using the <A HREF="http://www.dcc-servers.net/dcc/#public-servers">public |
|
|
311 DCC servers</A>. |
|
|
312 Each mail message needs a DCC transaction that requires |
|
|
313 about 100 bytes, and so 100,000 mail messages/day imply about 10 |
|
|
314 MBytes/day of DCC client-server traffic. Each DCC server needs to |
|
|
315 exchange "floods" or streams of checksms with 4 other servers. Each |
|
|
316 flood is currently about 1.4 GBytes/day for a current total of about |
|
|
317 3 GBytes/day. |
|
|
318 <P> |
|
|
319 When normally installed by the included Makefiles, DCC clients are |
|
|
320 configured to use the |
|
|
321 <A HREF="http://www.dcc-servers.net/dcc/#public-servers">public DCC servers</A> |
|
|
322 without any additional configuration except opening firewalls to port UDP 6277. |
|
|
323 <P> |
|
|
324 Mail systems that process more than 100,000 mail messages per day |
|
|
325 need local DCC servers connected to the global network of DCC servers. |
|
|
326 The public DCC servers include denial of service defenses which |
|
|
327 ignore requests in excess of about 240,000 per day per client. |
|
|
328 <P> |
|
|
329 It is wrong to resell the CPU cycles, network bandwidth, |
|
|
330 disk space, and, most important, human system administration work of the |
|
|
331 public DCC servers. |
|
|
332 Vendors of "anti-spam appliances" or similar |
|
|
333 that do not steal from the operators |
|
|
334 of the public DCC servers have always run their own DCC servers. |
|
|
335 |
|
|
336 |
|
|
337 <P><DT><A NAME="crash"> |
|
|
338 What happens to my mail if the DCC break?</A> |
|
|
339 <DD> |
|
|
340 When in doubt or trouble, the DCC clients including |
|
|
341 <A HREF="dccproc.html">dccproc</A> and <A HREF="dccm.html">dccm</A> |
|
|
342 deliver mail. They wait only a little while for a DCC server |
|
|
343 to answer before giving up. They then avoid asking a server for a while |
|
|
344 to avoid slowing down mail. |
|
|
345 <P> |
|
|
346 If the DCC sendmail interface or milter program, dccm, crashes, |
|
|
347 the default parameters in <A HREF="misc/dcc.m4">misc/dcc.m4</A> |
|
|
348 for the sendmail.cf Xdcc line |
|
|
349 tell sendmail to wait only about 30 seconds before |
|
|
350 giving up and delivering the mail. |
|
|
351 <P> |
|
|
352 The DCC client code keeps track of the speeds of the |
|
|
353 servers it knows about, and uses the fastest or closest. |
|
|
354 Every hour or so it re-resolves A records |
|
|
355 and checks the speeds of the servers it |
|
|
356 is not using. When the current server stops working or gets significantly |
|
|
357 slower, the client code switches to a better server. |
|
|
358 |
|
|
359 |
|
|
360 <P><DT><A NAME="mark-only"> |
|
|
361 How do I mark spam without rejecting it?</A> |
|
|
362 <DD> |
|
|
363 Unless given thresholds at which to reject mail, |
|
|
364 <A HREF="dccm.html#OPTION-t">dccm</A> |
|
|
365 and |
|
|
366 <A HREF="dccproc.html#OPTION-c">dccproc</A> do not reject mail. |
|
|
367 When dccm is given a threshold by setting DCCM_REJECT_AT in |
|
|
368 <A HREF="homedir/dcc_conf.in">dcc_conf</A> in the DCC home directory, |
|
|
369 DCCM_ARGS can also be set to <A HREF="dccm.html#OPTION-a">"-a IGNORE</A> |
|
|
370 so that spam is marked but not rejected. |
|
|
371 |
|
|
372 |
|
|
373 <P><DT><A NAME="bad-man"> |
|
|
374 Why doesn't the man command find the man pages?</A> |
|
|
375 <DD> |
|
|
376 The nroff source, formated nroff output, and HTML versions of the |
|
|
377 man pages are in the top-level source directory. |
|
|
378 Formatted or nroff source is installed by default somewhere in /usr/local/man |
|
|
379 depending on the target system. |
|
|
380 It may be necessary to add /usr/local/man to the MANPATH environment variable. |
|
|
381 Even with that, SunOS 5.7 sometimes has trouble finding them unless |
|
|
382 <B>man -F</B> is used. |
|
|
383 |
|
|
384 |
|
|
385 <P><DT><A NAME="sendmail-only"> |
|
|
386 Must sendmail be used with DCC?</A> |
|
|
387 <DD> |
|
|
388 While the sendmail milter interface, <A HREF="dccm.html">dccm</A> |
|
|
389 and the DCC program interface or <A HREF="dccifd.html">dccifd</A> |
|
|
390 are the most efficient ways to report and check DCC checksums, |
|
|
391 <A HREF="dccproc.html">dccproc</A> is also commonly used. |
|
|
392 |
|
|
393 |
|
|
394 <P><DT><A NAME="smtpd"> |
|
|
395 Can the DCC be used with smtpd?</A> |
|
|
396 <DD> |
|
|
397 Yes, <A HREF="dccproc.html">dccproc</A> can be used with Obtuse's smtpd. |
|
|
398 Dave Lugo has contributed a shell script to the |
|
|
399 <A HREF="http://sd.inodes.org/">smtpd-sd project</A> |
|
|
400 which can be used to do DCC checking prior to the end of the SMTP |
|
|
401 DATA command. |
|
|
402 |
|
|
403 |
|
|
404 <P><DT><A NAME="exim"> |
|
|
405 Can the DCC be used with Exim?</A> |
|
|
406 <DD> |
|
|
407 There are comments about using <A HREF="dccproc.html">Dccproc</A> with |
|
|
408 <A HREF="http://www.exim.org/">Exim</A> |
|
|
409 in the |
|
|
410 <A HREF="http://www.rhyolite.com/pipermail/dcc/">DCC mailing list archives</A> |
|
|
411 including these messages: |
|
|
412 <UL> |
|
|
413 <LI><A HREF="http://www.rhyolite.com/pipermail/dcc/2002/000203.html"> |
|
|
414 2002/000203</A> |
|
|
415 <LI><A HREF="http://www.rhyolite.com/pipermail/dcc/2002/000254.html"> |
|
|
416 2002/000254</A> |
|
|
417 </UL> |
|
|
418 <P> |
|
|
419 <STRONG>However</STRONG>, those mailing list messages talked about using |
|
|
420 <A HREF="dccproc.html">dccproc</A> before |
|
|
421 <A HREF="dccifd.html">dccifd</A> was available. |
|
|
422 Dccproc is suitable only for low mail volumes. |
|
|
423 |
|
|
424 |
|
|
425 <P><DT><A NAME="spamass"> |
|
|
426 Can the DCC be used with SpamAssassin or other spam filters?</A> |
|
|
427 <DD> |
|
|
428 The DCC can be used with |
|
|
429 <A HREF="http://spamassassin.apache.org/">SpamAssassin</A> as |
|
|
430 well as other spam and virus filters. |
|
|
431 Note that it is more efficient to arrange to use a DCC client daemon |
|
|
432 such as <A HREF="dccm.html">dccm</A> to mark passing mail and check |
|
|
433 <I>X-DCC</I> header lines in the filter than to start and run |
|
|
434 <A HREF="dccproc.html">dccproc</A> on each message. |
|
|
435 <P> |
|
|
436 Some commercial virus and spam filters include DCC clients that |
|
|
437 query public DCC servers or DCC servers operated by the filter vendor |
|
|
438 and that "flood" or exchange bulk mail checksums with public servers. |
|
|
439 Reputable manufacturers of such devices operate their own DCC servers |
|
|
440 connected to global network of DCC servers instead of stealing and then |
|
|
441 selling the CPU cycles, network bandwidth, disk space, and, most important, |
|
|
442 human system administration efforts of the public DCC servers. |
|
|
443 |
|
|
444 <P><DT><A NAME="dcc-delay"> |
|
|
445 How long must SpamAssassin or an MTA wait for DCC results?</A> |
|
|
446 <DD> |
|
|
447 DCC clients including dccproc, dccifd, and dccm can wait as long as |
|
|
448 about 16 seconds for an answer from a DCC server. |
|
|
449 Except when an anonymous client triggers the progressive delays that are |
|
|
450 among the defenses against denial of service attacks in the public DCC servers, |
|
|
451 delays are almost always less than 10 seconds. |
|
|
452 Delays for DNS blacklists |
|
|
453 (see <A HREF="dccifd.html#OPTION-B">dccifd -B</A>) |
|
|
454 are additional. |
|
|
455 |
|
|
456 |
|
|
457 <P><DT><A NAME="other-MUAs"> |
|
|
458 How can the DCC be used with mail user agents?</A> |
|
|
459 <DD><A HREF="dccproc.html">Dccproc</A> can be used with any mail user |
|
|
460 agent that can check mail headers. |
|
|
461 For example, WD Baseley sent a |
|
|
462 <A HREF="http://www.rhyolite.com/pipermail/dcc/2002/000212.html">note</A> |
|
|
463 to the <A HREF="http://www.rhyolite.com/mailman/listinfo/dcc">DCC |
|
|
464 mailing list</A> |
|
|
465 on how to configure <A HREF="http://www.eudora.com/">Eudora</A> to |
|
|
466 act on X-DCC header lines. |
|
|
467 <P> |
|
|
468 Bharat Mediratta has developed DeepSix for people using mail user agents |
|
|
469 on UNIX boxes connected remote servers such as corporate Exchange servers. |
|
|
470 See his |
|
|
471 project on <A HREF="http://www.sourceforge.net/projects/deepsix">Sourceforge</A> |
|
|
472 as well as his |
|
|
473 <A HREF="http://www.rhyolite.com/pipermail/dcc/2001/000042.html">announcement</A> |
|
|
474 in the DCC mailing list. |
|
|
475 |
|
|
476 |
|
|
477 <P><DT><A NAME="root-needed"> |
|
|
478 Must I have the root password to use DCC?</A> |
|
|
479 <DD> |
|
|
480 No, the procmail or sendmail .forward DCC user program, |
|
|
481 <A HREF="dccproc.html">dccproc</A> |
|
|
482 can be installed in an individual ~/bin directory. |
|
|
483 Then <A HREF="cdcc.html">cdcc</A> |
|
|
484 can create a private map file used with |
|
|
485 <A HREF="dccproc.html#OPTION-h">dccproc -h dir</A> |
|
|
486 or |
|
|
487 <A HREF="dccproc.html#OPTION-m">dccproc -m dir/map</A>. |
|
|
488 <P> |
|
|
489 Also see the <A HREF="INSTALL.html#individual-user">DCC installation |
|
|
490 instructions</A>. |
|
|
491 |
|
|
492 |
|
|
493 <P><DT><A NAME="firewall-ports2"> |
|
|
494 Why don't the public DCC servers work? Do I need a client-ID?</A> |
|
|
495 <DD> |
|
|
496 The public DCC servers accept requests from clients using the |
|
|
497 anonymous client-ID. |
|
|
498 Incorrectly configured firewalls often cause problems. |
|
|
499 Traceroute can be used to send UDP packets to test for interfering firewalls. |
|
|
500 See the answer to the <A HREF="#firewall-ports">firewall question</A>. |
|
|
501 <P> |
|
|
502 After firewalls, the most common cause of problems while trying to |
|
|
503 use the public DCC servers is sending too many requests. |
|
|
504 The DCC server daemon, <A HREF="dccd.html">dccd</A>, includes |
|
|
505 defenses against denial of service or DoS attacks. |
|
|
506 Those defenses include progressively delaying responses |
|
|
507 and eventually ignoring requests. |
|
|
508 The ancient version of the DCC client software included in some |
|
|
509 Linux redistributions tries so hard to reach the fastest server |
|
|
510 that it can trigger those DoS defenses. |
|
|
511 |
|
|
512 <P><DT><A NAME="firewall-ports"> |
|
|
513 Which ports do I need to open in my firewall?</A> |
|
|
514 <DD> |
|
|
515 DCC traffic is like DNS traffic. You should treat port 6277 |
|
|
516 like port 53. |
|
|
517 Allow outgoing packets to distant UDP port 6277 and incoming packets |
|
|
518 from distant UDP port 6277. |
|
|
519 <P> |
|
|
520 If the command `cdcc info` says no DCC servers are answering, |
|
|
521 you may need to adjust your firewall. |
|
|
522 Also consider the other reasons why the |
|
|
523 <A HREF="#firewall-ports2">public DCC servers can ignore requests</A>. |
|
|
524 <P> |
|
|
525 If you run a DCC server, open incoming connections to local TCP port 6277 |
|
|
526 from your flooding peers, |
|
|
527 and outgoing connections to TCP port 6277 on your flooding peers. |
|
|
528 Also open UDP port 6277 to IP address 192.188.61.3 for the DCC server status |
|
|
529 web page. |
|
|
530 <P> |
|
|
531 See also the discussion of Cisco ACLs at |
|
|
532 <A HREF="http://www.dcc-servers.net/dcc/firewall.html">http://www.dcc-servers.net/dcc/firewall.html</A>. |
|
|
533 |
|
|
534 <P><DT><A NAME="cleaning1"> |
|
|
535 Why does the</A> <A HREF="dccd.html#FILE-dcc_db">dccd database</A> |
|
|
536 grow without bound? |
|
|
537 <DD><A HREF="dbclean.html">Dbclean</A> should be run every night when the |
|
|
538 system is least busy |
|
|
539 with the <A HREF="misc/cron-dccd.in">misc/cron-dccd</A> script. |
|
|
540 An entry like <A HREF="misc/crontab.in">misc/crontab</A> should be put into |
|
|
541 the crontab file for the user that runs <A HREF="dccd.html">dccd</A>. |
|
|
542 |
|
|
543 |
|
|
544 <P><DT><A NAME="cleaning2"> |
|
|
545 The dccd database is corrupt. What should I do?</A> |
|
|
546 <DD><A HREF="dbclean.html#OPTION-R">Dbclean -R</A> |
|
|
547 will usually repair a broken |
|
|
548 DCC server database. |
|
|
549 However, |
|
|
550 if your server is "flooding" or exchanging checksums with other servers, |
|
|
551 it is often quicker to stop the DCC server, |
|
|
552 delete the |
|
|
553 <A HREF="dccd.html#FILE-dcc_db">@prefix@/dcc_db</A> and |
|
|
554 <A HREF="dccd.html#FILE-dcc_db.hash">@prefix@/dcc_db.hash</A> files |
|
|
555 and restart <A HREF="dccd.html">dccd</A> with the |
|
|
556 <A HREF="misc/start-dccd.in">libexec/start-dccd</A> script. |
|
|
557 When dccd starts, it will notice that the database has been purged |
|
|
558 and ask its flooding peers to rewind and retransmit their checksums of |
|
|
559 bulk mail. |
|
|
560 |
|
|
561 |
|
|
562 <P><DT><A NAME="cleaning3"> |
|
|
563 How can I stop the log directories from overflowing?</A> |
|
|
564 <DD> |
|
|
565 Global <A HREF="dccm.html#OPTION-l">dccm</A> |
|
|
566 or <A HREF="dccifd.html#OPTION-l">dccifd</A> |
|
|
567 logging can be entirely |
|
|
568 disabled by setting DCCM_LOGDIR="" or DCCIFD_LOGDIR="" in the |
|
|
569 <A HREF="homedir/dcc_conf.in">dcc_conf</A> file in the DCC home directory. |
|
|
570 Logging for individual users can be disabled by not creating or deleting |
|
|
571 thir log directories. |
|
|
572 However, this not only disables logging of rejected mail, but also logging |
|
|
573 of mail that suffered system failures. |
|
|
574 <P> |
|
|
575 To delete old log files, run the |
|
|
576 <A HREF="misc/cron-dccd.in">misc/cron-dccd</A> script |
|
|
577 daily with an entry like <A HREF="misc/crontab.in">misc/crontab</A> |
|
|
578 in the crontab file for the user that runs <A HREF="dccd.html">dccd</A> |
|
|
579 or <A HREF="dccd.html">dccd</A>. |
|
|
580 The DBCLEAN_LOGDAYS parameter in the |
|
|
581 <A HREF="homedir/dcc_conf.in">dcc_conf</A> file in the DCC home directory |
|
|
582 specifies the age of old log files. |
|
|
583 |
|
|
584 |
|
|
585 <P><DT><A NAME="bad-locks"> |
|
|
586 Why do my DCC clients including</A> |
|
|
587 <A HREF="cdcc.html">cdcc</A> and <A HREF="dccproc.html">dccproc</A> |
|
|
588 complain about "Resource temporarily unavailable"? |
|
|
589 <DD> |
|
|
590 Perhaps your operating system has bugs in its implementation of |
|
|
591 <CODE>fcntl</CODE> file locking, particularly for the |
|
|
592 DCC client <A HREF="cdcc.html#FILE-map">map</A> file when it is on |
|
|
593 an NFS file system. |
|
|
594 <P> |
|
|
595 Another common case is using an editor such as some versions of <EM>vi</EM> |
|
|
596 that locks files on the main or a per-user |
|
|
597 <A HREF="homedir/whiteclnt">whiteclnt</A> file, |
|
|
598 |
|
|
599 |
|
|
600 <P><DT><A NAME="maxprocs"> |
|
|
601 Why does dccifd or dccm complain about |
|
|
602 <Q lang="en-us">thread_create() failed: 11, try again</Q>? |
|
|
603 or <Q lang="en-us">pthread_create(): Cannot allocate memory</Q>?</A> |
|
|
604 <DD> |
|
|
605 The most common cause of |
|
|
606 <Q lang="en-us">thread_create() failed: 11, try again</Q> |
|
|
607 or <Q lang="en-us">pthread_create(): Cannot allocate memory</Q> |
|
|
608 error messages from <A HREF="dccm.html">dccm</A> |
|
|
609 and <A HREF="dccifd.html">dccifd</A> |
|
|
610 is a too small limit on the maximum number of processes allowed |
|
|
611 the UID running the dccm or dccifd process. |
|
|
612 The "maxproc" limit seen with the `limit` or `limits` shell command |
|
|
613 should be a dozen or so larger than the sum of |
|
|
614 the queue sizes of dccm or dccifd (or both if both are running). |
|
|
615 <P> |
|
|
616 See also the common question and answer about |
|
|
617 <A HREF="#max-work">too many simultaneous mail messages</A>. |
|
|
618 |
|
|
619 |
|
|
620 <P><DT><A NAME="max-work"> |
|
|
621 Why does dccm or dccifd complain about |
|
|
622 <Q lang="en-us">too many simultaneous mail messages</Q>?</A> |
|
|
623 <DD> |
|
|
624 Dccm or dccifd can fail to create a thread to deal with an incoming |
|
|
625 mail message if there are no available file descriptors or |
|
|
626 other resources. |
|
|
627 Adding <EM>-d</EM> to DCCD_ARGS or DCCIFD_ARGS in |
|
|
628 <A HREF="homedir/dcc_conf.in">dcc_conf</A> in the DCC home directory |
|
|
629 sends a message to the system log that includes the limit on simultaneous mail |
|
|
630 messages and its source, such as a process resource limit on the |
|
|
631 number of file descriptors. |
|
|
632 <P> |
|
|
633 Another common limit is the maximum number of file descriptors |
|
|
634 allowed by the <EM>select</EM> system call. |
|
|
635 This limit can be escaped by building the sendmail milter library to |
|
|
636 use the <EM>poll</EM> system call. |
|
|
637 |
|
|
638 |
|
|
639 |
|
|
640 |
|
|
641 <P><DT><A NAME="server-pick"> |
|
|
642 Why doesn't my DCC client pick my local DCC server?</A> |
|
|
643 <DD> |
|
|
644 The DCC clients including <A HREF="dccm.html">dccm</A> |
|
|
645 and <A HREF="dccproc.html">dccproc</A> pick the nearest and fastest |
|
|
646 server in the list kept in the <A HREF="cdcc.html#FILE-map">@prefix@/map</A> |
|
|
647 file. |
|
|
648 DCC servers not in that list will not be used. |
|
|
649 That list can be viewed with the |
|
|
650 <A HREF="cdcc.html#OPERATION-info">cdcc info</A> |
|
|
651 or |
|
|
652 <A HREF="cdcc.html#OPERATION-RTT">cdcc RTT</A> operations. |
|
|
653 Add to the list with |
|
|
654 <A HREF="cdcc.html#OPERATION-add">cdcc add</A> |
|
|
655 or <A HREF="cdcc.html#OPERATION-load">cdcc load</A>. |
|
|
656 <P> |
|
|
657 A nearby server that seems slower than a more distant server will |
|
|
658 not be chosen. |
|
|
659 The anonymous user delay set with <A HREF="dccd.html#OPTION-u">dccd -u</A> |
|
|
660 is intended to make a server appear slow to "freeloaders." |
|
|
661 The "RTT +/-" value that can be used with |
|
|
662 the <A HREF="cdcc.html#OPERATION-add">cdcc add</A> |
|
|
663 and <A HREF="cdcc.html#OPERATION-load">cdcc load</A> |
|
|
664 operations can be used to force DCC clients to prefer or avoid servers |
|
|
665 except when absolutely necessary. |
|
|
666 |
|
|
667 |
|
|
668 |
|
|
669 <P><DT><A NAME="IDs1"> |
|
|
670 If I have a server-ID, do I need a DCC client-ID, or vice versa?</A> |
|
|
671 <DD> |
|
|
672 DCC <A HREF="dcc.html#Client-and-Server-IDs">server and client-IDs</A> |
|
|
673 serve distinct purposes. |
|
|
674 Servers require server-IDs to identify each other in the floods of checksums |
|
|
675 they exchange and to recognize authorized users of powerful |
|
|
676 cdcc operations such as <A HREF="cdcc.html#OPERATION-stop">stop</A>. |
|
|
677 DCC servers require client-IDs to identify paying clients that should |
|
|
678 be given quicker service that anonymous clients, to refuse reports from |
|
|
679 anonymous clients, or to refuse even to answer queries from anonymous |
|
|
680 clients. |
|
|
681 |
|
|
682 |
|
|
683 <P><DT><A NAME="IDs2"> |
|
|
684 Why does my DCC server complain about |
|
|
685 "rejected server-IDs" among flooded checksum reports?</A> |
|
|
686 <DD> |
|
|
687 You have turned on IDS tracing, but do not have a |
|
|
688 <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file that is complete. |
|
|
689 You don't need and probably will not have a complete file unless you |
|
|
690 are assigning DCC server-IDs. |
|
|
691 <P>Redundant paths among DCC servers exchanging |
|
|
692 or flooding reports of checksums would cause duplicate entries in |
|
|
693 each server's database without the mechanism that depends on every DCC server |
|
|
694 having a unique server-ID. |
|
|
695 With IDS tracing enabled, <A HREF="dccd.html#OPTION-T">dccd</A> complains |
|
|
696 about server-IDs that are not listed in the local |
|
|
697 <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file. |
|
|
698 |
|
|
699 <P><DT><A NAME="server-rate-limits"> |
|
|
700 Why does my DCC server refuse to accept more than |
|
|
701 50 operations per second?</A> |
|
|
702 <DD> |
|
|
703 A common cause of such problems is one of the DCC server's |
|
|
704 defenses against denial of service attacks. |
|
|
705 A DCC server cannot know anything about anonymous clients, |
|
|
706 or clients using client-ID 1 or without a client-ID and matching password |
|
|
707 from the <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file. |
|
|
708 As far as your server can know, an anonymous client sending many |
|
|
709 operations is run by an unhappy sender of unsolicited bulk mail trying |
|
|
710 to flood your server with a denial of service attack. |
|
|
711 It is easy to tell your client its ID with the |
|
|
712 <A HREF="cdcc.html#OPERATION-add">cdcc add</A> |
|
|
713 or <A HREF="cdcc.html#OPERATION-load">load</A> operations. |
|
|
714 <P> |
|
|
715 The default limits can changed by |
|
|
716 adding an <A HREF="dccd.html#OPTION-R">dccd -R</A> argument |
|
|
717 can be added to DCCD_ARGS in the |
|
|
718 <A HREF="homedir/dcc_conf.in">dcc_conf</A> file in the DCC home directory, |
|
|
719 |
|
|
720 |
|
|
721 <P><DT><A NAME="private-server"> |
|
|
722 How do I keep strangers from using my DCC server?</A> |
|
|
723 <DD> |
|
|
724 See the <A HREF="dccd.html#OPTION-u">dccd -u</A> option. |
|
|
725 |
|
|
726 |
|
|
727 <P><DT><A NAME="dccm-log1"> |
|
|
728 How can I determine why</A> <A HREF="dccm.html">dccm</A> reported |
|
|
729 a message as spam or with a recipient count of "MANY"? |
|
|
730 <DD> |
|
|
731 Dccm is usually configured to log mail with recipient counts greater |
|
|
732 than the <A HREF="dccm.html#OPTION-t">-t ,log-thold,</A> |
|
|
733 as well as mail with some conflicts among |
|
|
734 <A HREF="dcc.html#White-and-Blacklists">whitelist</A> entries. |
|
|
735 Each log file contains a single message, its checksums, its disposition, |
|
|
736 and other information as described in the |
|
|
737 <A HREF="dccm.html#FILE-logdir">dccm man page</A>. |
|
|
738 <P> |
|
|
739 See also the <A HREF="dblist.html#OPTION-C">dblist -C</A> command. |
|
|
740 |
|
|
741 |
|
|
742 <P><DT><A NAME="dblist1"> |
|
|
743 How can I see what checksums my server has heard from its clients?</A> |
|
|
744 <DD> |
|
|
745 The <A HREF="dblist.html#OPTION-v">dblist -Hv</A> |
|
|
746 command displays the contents of the database. |
|
|
747 Look for records with your |
|
|
748 <A HREF="dcc.html#Client-and-Server-IDs">server-ID</A> |
|
|
749 with <A HREF="dblist.html#OPTION-I">dblist -I</A>. |
|
|
750 |
|
|
751 |
|
|
752 <P><DT><A NAME="whitelist13"> |
|
|
753 How do I stop DCC false positives?</A> |
|
|
754 <DD> |
|
|
755 You are probably not seeing false positives. |
|
|
756 The Distributed Checksum Clearing Houses detect both solicited |
|
|
757 and unsolicited bulk mail, while spam is only unsolicited bulk email. |
|
|
758 For your DCC client, <A HREF="dccm.html">dccm</A>, |
|
|
759 <A HREF="dccifd.html">dccifd</A>, or |
|
|
760 <A HREF="dccproc.html">dccproc</A>, to know to ignore bulk mail messages |
|
|
761 that are solicited, it must be told by entries the main or a per-user |
|
|
762 whitelist or <A HREF="homedir/whiteclnt">whiteclnt</A> file. |
|
|
763 |
|
|
764 |
|
|
765 |
|
|
766 <P><DT><A NAME="whitelist1"> |
|
|
767 Why is mail from my favorite mailing list marked with an |
|
|
768 <I>X-DCC</I> header line that says it is spam?</A> |
|
|
769 <DD> |
|
|
770 Sources of solicited bulk mail including mailing lists to which |
|
|
771 you have subscribed should usually be in your DCC client |
|
|
772 <A HREF="dcc.html#White-and-Blacklists">whitelist</A> |
|
|
773 so that they receive no <I>X-DCC</I> header lines. |
|
|
774 |
|
|
775 |
|
|
776 <P><DT><A NAME="whitelist11"> |
|
|
777 Why are acknowledgments of spam reports mistakenly marked as spam by DCC?</A> |
|
|
778 <DD> |
|
|
779 There is probably no mistake. |
|
|
780 DCC detect bulk mail and not only unsolicited bulk mail. |
|
|
781 Whether a bulk message is spam depends on whether you solicited or asked for it. |
|
|
782 Some INTERNET service providers have sent literally millions of |
|
|
783 acknowledgments of spam reports, which makes them bulk mail. |
|
|
784 Bulk mail you want to receive should be |
|
|
785 <A HREF="dcc.html#White-and-Blacklists">whitelisted</A> |
|
|
786 in your master or per-user |
|
|
787 <A HREF="homedir/whiteclnt">whiteclnt</A> file. |
|
|
788 |
|
|
789 |
|
|
790 <P><DT><A NAME="x-dcc-header1"> |
|
|
791 Why are some checksums missing from my <I>X-DCC</I> header lines?</A> |
|
|
792 <DD> |
|
|
793 If the DCC client was not able to compute a checksum for a message, |
|
|
794 it will not ask the server about that checksum and the checksum will |
|
|
795 not appear in the <I>X-DCC</I> header. |
|
|
796 For example, if <A HREF="dccproc.html">dccproc</A> is not told and |
|
|
797 cannot figure out the IP address of the source of the message, |
|
|
798 that checksum will be missing. |
|
|
799 The <I>Fuz1</I> and <I>Fuz2</I> checksums cannot be computed for |
|
|
800 messages that are too small, and so will be missing for them. |
|
|
801 A checksum will also be missing if the DCC server is configured to not count |
|
|
802 it. |
|
|
803 |
|
|
804 |
|
|
805 <P><DT>Do I need both server and client |
|
|
806 <A NAME="whitelist2" HREF="dcc.html#White-and-Blacklists"> |
|
|
807 whitelists</A>? |
|
|
808 <DD> |
|
|
809 The <A HREF="homedir/whitelist">server whitelist file</A> |
|
|
810 used explicitly by <A HREF="dbclean.html#FILE-whitelist">dbclean</A> |
|
|
811 and implicitly by <A HREF="dccd.html#FILE-whitelist">dccd</A> |
|
|
812 is not very useful and probably a bad idea. |
|
|
813 <P> |
|
|
814 The <A HREF="homedir/whiteclnt">client whitelist files</A> |
|
|
815 used by |
|
|
816 <A HREF="dccproc.html#FILE-whiteclnt">dccproc</A>, |
|
|
817 <A HREF="dccm.html#FILE-whiteclnt">dccm</A>, |
|
|
818 and |
|
|
819 <A HREF="dccifd.html#FILE-whiteclnt">dccifd</A> |
|
|
820 are generally required. |
|
|
821 Client whitelists apply only to the stream of mail handled by the |
|
|
822 DCC client, |
|
|
823 while server whitelists apply to reports of mail from all DCC clients |
|
|
824 of the DCC server. |
|
|
825 <P> |
|
|
826 <A HREF="dccproc.html">Dccproc</A> is intended for use by individual users |
|
|
827 with programs such as |
|
|
828 <A HREF="http://www.procmail.org/">procmail</A>. |
|
|
829 Because the global whiteclnt file usually found in the DCC home directory |
|
|
830 is as likely to be used as a private file, |
|
|
831 the file name must be explicitly specified with |
|
|
832 <A HREF="dccproc.html#OPTION-w">dccproc -w whiteclnt</A>. |
|
|
833 A perhaps inconvenient implication is programs such as |
|
|
834 <A HREF="http://spamassassin.apache.org/">SpamAssassin</A> that |
|
|
835 switch unpredictably between dccproc and <A HREF=dccifd.html>dccifd</A> |
|
|
836 might get inconsistent results unless they invoke dccproc with the global |
|
|
837 whiteclnt file. |
|
|
838 |
|
|
839 |
|
|
840 <P><DT><A NAME="whitelist9"></A> |
|
|
841 How do I maintain client |
|
|
842 <A HREF="dcc.html#White-and-Blacklists">whitelists</A>? |
|
|
843 <DD> |
|
|
844 Start by monitoring bulk mail in the |
|
|
845 global log directories specified with |
|
|
846 <A HREF="dccproc.html#OPTION-l">dccproc -l</A> |
|
|
847 and with DCCM_LOGDIR and DCCM_USERDIRS in the |
|
|
848 <A HREF="homedir/dcc_conf.in">@prefix@/dcc_conf</A> file |
|
|
849 for <A HREF="dccm.html#OPTION-l">dccm</A>, |
|
|
850 and |
|
|
851 <A HREF="dccifd.html#OPTION-U">dccifd</A>. |
|
|
852 Then add entries to whitelist files. |
|
|
853 <P> |
|
|
854 The global |
|
|
855 <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> file |
|
|
856 and the whitelists specified with |
|
|
857 <A HREF="dccproc.html#OPTION-w">dccproc -w</A> are maintained |
|
|
858 with ordinary text editors. |
|
|
859 <P> |
|
|
860 Per-user whitelists in whiteclnt files |
|
|
861 specified with DCCM_USERDIRS in the |
|
|
862 <A HREF="homedir/dcc_conf.in">@prefix@/dcc_conf</A> file |
|
|
863 are easily maintained with ordinary text editors by the system administrator. |
|
|
864 However, it is often better to let individual users deal with their |
|
|
865 own whitelists. |
|
|
866 The DCC source includes sample CGI scripts |
|
|
867 in the <A HREF="cgi-bin/">cgi-bin directory</A> in the DCC source |
|
|
868 to let individual end-users monitor their private logs of bulk mail |
|
|
869 and their individual whitelists. |
|
|
870 See the <A HREF="cgi-bin/README">README</A> file for those scripts. |
|
|
871 There is also a |
|
|
872 <A HREF="http://www.rhyolite.com/dcc/#cgi-demo">demonstration</A> |
|
|
873 of the cgi scripts. |
|
|
874 |
|
|
875 |
|
|
876 <P><DT><A NAME="whitelist3"></A> |
|
|
877 When the <A HREF="homedir/whiteclnt">whitelist file</A> |
|
|
878 used by <A HREF="dccm.html#FILE-whiteclnt">dccm</A>, |
|
|
879 <A HREF="dccd.html#FILE-whitelist">dccd</A>, |
|
|
880 or <A HREF="dccifd.html#FILE-whiteclnt">dccifd</A> |
|
|
881 is changed, |
|
|
882 what must be done to tell the software about the change? |
|
|
883 <DD> |
|
|
884 The DCC clients notice when their whiteclnt files |
|
|
885 as well as included files change and automatically rebuild the corresponding |
|
|
886 <A HREF="dccm.html#FILE-whiteclnt.dccw">.dccw hash table</A> files. |
|
|
887 <P> |
|
|
888 Changes to the DCC server or dccd |
|
|
889 <A HREF="dccd.html#FILE-whitelist">whitelist</A> |
|
|
890 are not effective until after <A HREF="dbclean.html">dbclean</A> is run. |
|
|
891 <P> |
|
|
892 Some text editors including versions of <EM>vi</EM> lock their files. |
|
|
893 <A HREF="dccm.html#FILE-whiteclnt">Dccm</A>, |
|
|
894 <A HREF="dccproc.html#FILE-whiteclnt">dccproc</A>, |
|
|
895 and <A HREF="dccifd.html#FILE-whiteclnt">dccifd</A> |
|
|
896 are unable to read whitelist files while they are locked. |
|
|
897 |
|
|
898 |
|
|
899 <P><DT><A NAME="whitelist14"> |
|
|
900 How do I test a whiteclnt file?</A> |
|
|
901 <DD> |
|
|
902 An easy way to test a DCC client whitelist or |
|
|
903 <A HREF="homedir/whiteclnt">whiteclnt</A> file |
|
|
904 is to feed dccproc with a test message. |
|
|
905 For example, the following shell script would test whether the IP address |
|
|
906 127.0.0.1 |
|
|
907 and the SMPT envelope Mail_From value postmaster@example.com are in the |
|
|
908 <EM>whiteclnt</EM> file in the DCC home directory: |
|
|
909 <PRE> |
|
|
910 #!/bin/sh |
|
|
911 /usr/local/bin/dccproc -QCw whiteclnt \ |
|
|
912 -a 127.0.0.1 -f postmaster@example.com <<EOF |
|
|
913 Message-ID: <1234@example.com> |
|
|
914 |
|
|
915 text |
|
|
916 EOF |
|
|
917 </PRE> |
|
|
918 If the script produces something like |
|
|
919 <PRE> |
|
|
920 X-DCC--Metrics: calcite.rhyolite.com; whitelist |
|
|
921 reported: 0 checksum wlist |
|
|
922 IP: e475b896 492c60fc efecb432 6e29e3c5 ok |
|
|
923 env_From: bef98dc1 cc6ea4d7 b8daf07c a2bfbc9e |
|
|
924 Message-ID: 26573398 2ab927cd 681a89fa e502496d |
|
|
925 </PRE> |
|
|
926 then you know that SMTP client IP (mail sender) IP address 127.0.0.1 |
|
|
927 is whitelisted, but the SMTP envelope Mail_From value is not. |
|
|
928 |
|
|
929 |
|
|
930 <P><DT> |
|
|
931 Can I use wild cards or regular expressions in DCC |
|
|
932 <A NAME="reg-exps1" HREF="dcc.html#White-and-Blacklists"> |
|
|
933 whitelists</A>? |
|
|
934 <DD> |
|
|
935 No, regular expressions cannot be used, |
|
|
936 because DCC client and server whitelists are converted to lists of checksums. |
|
|
937 The same basic idea is used for DCC client whitelists |
|
|
938 as for the DCC protocol. |
|
|
939 A DCC client computes the checksums for a message, and then looks |
|
|
940 for those checksums in the local whitelist. |
|
|
941 Depending on the values associated with those checksums, |
|
|
942 the DCC client asks a DCC server about them. |
|
|
943 <P> |
|
|
944 To use regular expressions with the DCC, consider procmail. |
|
|
945 Procmail is included with many UNIX-like systems. |
|
|
946 See also the |
|
|
947 <A HREF="http://www.procmail.org/">Procmail Homepage</A>. |
|
|
948 <P> |
|
|
949 DCC clients can be configured to white- or blacklist |
|
|
950 using called "substitute" headers. |
|
|
951 See <A HREF="dccproc.html#OPTION-S">dccproc -S</A> or |
|
|
952 <A HREF="dccm.html#OPTION-S">dccm -S</A>. |
|
|
953 <P> |
|
|
954 It is also possible to use a sendmail access_db file entries to |
|
|
955 white- or blacklist based on portions of SMTP envelope and |
|
|
956 client IP addresses. |
|
|
957 For example, an access_db file line of "From:example.com OK" |
|
|
958 can be used to tell dccm to whitelist all mail from SMTP clients |
|
|
959 in the example.com domain. |
|
|
960 See the -O argument to the |
|
|
961 <A HREF="misc/hackmc">misc/hackmc</A> script. |
|
|
962 |
|
|
963 |
|
|
964 <P><DT> |
|
|
965 <A NAME="whitelist10">How do I whitelist mail from a legitimate |
|
|
966 bulk mailer using its name or SMTP headers such as Mailing-List |
|
|
967 headers?</A> |
|
|
968 <DD> |
|
|
969 Start by determining an envelope value or SMTP header that distinguishes |
|
|
970 the bulk mail from a sample message or DCC log file. |
|
|
971 The name of the sending computer is the <EM>mail_host</EM> value in |
|
|
972 <A HREF="dccm.html#FILE-logdir">dccm log files</A>. |
|
|
973 If the distinguishing header or envelope value is not among the main |
|
|
974 <A HREF="dcc.html#White-and-Blacklists">DCC whitelist values</A>, |
|
|
975 then a "substitute" value must be used. |
|
|
976 An "ok substitute ..." line must be added to the whitelist file |
|
|
977 and the DCC client program must be told with |
|
|
978 <A HREF="dccproc.html#OPTION-S">dccproc -S</A> or |
|
|
979 <A HREF="dccm.html#OPTION-S">dccm -S</A>. |
|
|
980 There are example whitelist entries in the sample |
|
|
981 <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> file. |
|
|
982 <P> |
|
|
983 |
|
|
984 <P><DT><A NAME="incompat-whitelists"> |
|
|
985 Why does dccm or dccifd complain about "incompatible whitelists"?</A> |
|
|
986 <DD> |
|
|
987 There are several points during an SMTP transaction when an SMTP server |
|
|
988 can reject a mail message. |
|
|
989 Early points are when the SMTP client specifies the recipients of the |
|
|
990 mail message. |
|
|
991 The last point is after the entire message has been received by the SMTP |
|
|
992 server. |
|
|
993 Spam filters that check mail message bodies must wait until that last point. |
|
|
994 The SMTP protocol does not allow an SMTP server to reject the |
|
|
995 mail message for only some recipients. |
|
|
996 The SMTP server must tell the SMTP client that the message has been |
|
|
997 accepted for all or rejected for recipients. |
|
|
998 This is a problem when the recipients of a single mail message have |
|
|
999 differing |
|
|
1000 <A HREF="dcc.html#White-and-Blacklists">DCC thresholds or other parameters</A> |
|
|
1001 in their individual whitelist files |
|
|
1002 that require that the mail message be delivered to some mailboxes but |
|
|
1003 rejected for other mailboxes. |
|
|
1004 <P> |
|
|
1005 The DCC client programs solve this conflict in one of two ways. |
|
|
1006 One is telling the SMTP client |
|
|
1007 that the mail message has been accepted for all recipients and then |
|
|
1008 discarding instead of delivering the message for mailboxes with parameters |
|
|
1009 that make it spam. |
|
|
1010 This solution has the disadvantage of not informing senders of the |
|
|
1011 refusal to deliver the message. |
|
|
1012 The other solution is to temporarily reject recipients with possibly |
|
|
1013 incompatible parameters early in the SMTP transaction with the same |
|
|
1014 SMTP error status number as too many recipients for a single SMTP transaction. |
|
|
1015 This second solution has the advantage of ensuring that senders know |
|
|
1016 when their mail is rejected but the disadvantage of sometimes |
|
|
1017 requiring as many SMTP transactions as there are recipients for a mail message. |
|
|
1018 <P> |
|
|
1019 Which solution is used is determined by the |
|
|
1020 <A HREF="dcc.html#White-and-Blacklists">forced-discard-ok</A> |
|
|
1021 and <A HREF="dcc.html#White-and-Blacklists">forced-discard-nok</A> |
|
|
1022 settings in the global and per-user |
|
|
1023 <A HREF="dccm.html#FILE-whiteclnt">whiteclnt</A> files. |
|
|
1024 Unless all recipients for a mail message agree on the first solution, |
|
|
1025 perhaps by <EM>forced-discard-ok</EM> in the main |
|
|
1026 <A HREF="homedir/whiteclnt">whiteclnt</A> file, |
|
|
1027 the second solution is used. |
|
|
1028 |
|
|
1029 |
|
|
1030 <P><DT><A NAME="whitelist4"> |
|
|
1031 Why do legitimate mail messages have |
|
|
1032 <I>X-DCC</I> header lines that say they are "bulk", "many", or spam?</A> |
|
|
1033 <DD> |
|
|
1034 There are several possible causes of such problems. |
|
|
1035 The first and most obvious is that the mail is solicited bulk mail |
|
|
1036 and that the source needs to be added to your |
|
|
1037 <A HREF="dcc.html#White-and-Blacklists">whitelist</A>. |
|
|
1038 |
|
|
1039 <P>Another possible reason is that your individual legitimate mail messages |
|
|
1040 have not been marked as spam because their <I>Body</I> or <I>Fuz1</I> |
|
|
1041 checksum counts are small, but that the IP address or other checksum |
|
|
1042 counts are large. |
|
|
1043 The IP address checksum count, for example, is the total of all reports |
|
|
1044 of addressees for that checksum. |
|
|
1045 That total is independent of the other checksums, and so counts |
|
|
1046 all reports for all messages with that source IP address. |
|
|
1047 A source of legitimate mail that has sent a message that was reported |
|
|
1048 as spam by one of its recipients will often have the totals |
|
|
1049 for the checksums of its IP address, From header, and |
|
|
1050 other values be <I>MANY</I>. |
|
|
1051 This is why it usually does not make sense to reject mail based on what the |
|
|
1052 DCC server reports for the IP address, From header, and other values that |
|
|
1053 are not unique to the message. |
|
|
1054 Only the last Received header line, the Message-ID line, and body checksums |
|
|
1055 can be expected to be unique and sometimes not the Message-ID |
|
|
1056 and Received header lines. |
|
|
1057 |
|
|
1058 <P><DT><A NAME="qmail2"> |
|
|
1059 Why is legitimate mail from someone using <I>qmail</I> |
|
|
1060 marked as spam?</A> |
|
|
1061 <DD> |
|
|
1062 A common cause for that and similar complaints involves |
|
|
1063 null or missing Message-ID header lines. |
|
|
1064 Spam often lacks Message-ID lines or has a null or "<>" ID, |
|
|
1065 so rejecting mail with null or missing Message-IDs can be an |
|
|
1066 effective filter. |
|
|
1067 DCC clients treat missing Message-ID lines as if they were present but null. |
|
|
1068 The sample <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> |
|
|
1069 <A HREF="dcc.html#White-and-Blacklists">whitelist</A> file in the DCC source |
|
|
1070 includes the line: |
|
|
1071 <PRE> |
|
|
1072 many message-id <> |
|
|
1073 </PRE> |
|
|
1074 Some Mail Transfer Agents violate section 3.6.4 of RFC 2822 and |
|
|
1075 do not include Message-ID header lines in mail they send, |
|
|
1076 including some combinations of qmail and |
|
|
1077 "<B>sendmail -bs</B>" acting as the originating MTA, |
|
|
1078 and qmail by itself when it is generates a non-delivery message or "bounce." |
|
|
1079 Solutions to this problem include removing that line from your |
|
|
1080 <A HREF="dcc.html#White-and-Blacklists">whitelists</A> |
|
|
1081 or adding lines specifying the From or envelope |
|
|
1082 from values of senders of legitimate mail lacking Message-ID header lines. |
|
|
1083 |
|
|
1084 |
|
|
1085 <P><DT><A NAME="whitelist5"></A> |
|
|
1086 Are <A HREF="dcc.html#White-and-Blacklists">IP address blocks</A> |
|
|
1087 in <A HREF="homedir/whiteclnt">whitelists</A> used by |
|
|
1088 <A HREF="dccproc.html">dccproc</A>? |
|
|
1089 <DD> |
|
|
1090 Yes, <A HREF="dccproc.html">dccproc</A> can whitelist mail |
|
|
1091 by the IP address of the immediately |
|
|
1092 preceding SMTP client, |
|
|
1093 but only if it knows that IP address. |
|
|
1094 Unless the <A HREF="dccproc.html#OPTION-a">dccproc -a</A> |
|
|
1095 or <A HREF="dccproc.html#OPTION-R">dccproc -R</A> |
|
|
1096 options are used, dccproc does not know the IP address. |
|
|
1097 |
|
|
1098 |
|
|
1099 <P><DT><A NAME="whitelist6"> |
|
|
1100 Why is</A> <A HREF="dccproc.html">dccproc</A> is ignoring |
|
|
1101 <A HREF="dcc.html#White-and-Blacklists"><I>env_from</I> whitelist</A> |
|
|
1102 entries? |
|
|
1103 <DD> |
|
|
1104 DCC checksums are of the entire header line or envelope value. |
|
|
1105 An entry in the whitelist file for <I>jsmith@example.com</I> |
|
|
1106 will have no effect on mail with an envelope value of |
|
|
1107 <I>"J.Smith" jsmith@example.com</I>. |
|
|
1108 The file must contain <I>"J.Smith" jsmith@example.com</I>. |
|
|
1109 <P> |
|
|
1110 Another common cause for this problem is implied by the fact that |
|
|
1111 for an <I>env_from</I> whitelist entry |
|
|
1112 to have any effect, dccproc must be able to find the envelope value |
|
|
1113 in the message in a <I>Return-Path</I> header, |
|
|
1114 an old UNIX-style <I>From_</I> header, or an <B>-f</B> argument. |
|
|
1115 If your mail delivery agent does not add a <I>Return-Path</I> header |
|
|
1116 and you do not use |
|
|
1117 <A HREF="dccproc.html#OPTION-f">dccproc -f</A>, |
|
|
1118 then dccproc cannot know about |
|
|
1119 white or blacklist entries for envelope return addresses. |
|
|
1120 <P> |
|
|
1121 Note also that dccproc has no whitelist by default and |
|
|
1122 that <A HREF="dccproc.html#OPTION-w">dccproc -w</A> |
|
|
1123 must be used. |
|
|
1124 |
|
|
1125 |
|
|
1126 <P><DT><A NAME="delck"> |
|
|
1127 What if I make a mistake with</A> |
|
|
1128 <A HREF="dccproc.html#OPTION-t">dccproc -t many</A> |
|
|
1129 and report legitimate mail as spam? |
|
|
1130 <DD> |
|
|
1131 It is possible to delete checksums from the distributed DCC |
|
|
1132 database with the <A HREF="cdcc.html#OPERATION-delck-type-hex1-hex2-hex3-hex4"> |
|
|
1133 cdcc delck</A> |
|
|
1134 operation. |
|
|
1135 However, it is not worth the trouble. |
|
|
1136 Unless the same (as far as the fuzzy checksums are concerned) message |
|
|
1137 is sent again, no one is likely to notice the mistake before the |
|
|
1138 report of the message's checksums expire from the DCC servers' |
|
|
1139 databases for lack of repetition. |
|
|
1140 |
|
|
1141 |
|
|
1142 <P><DT><A NAME="whitelist8"> |
|
|
1143 Can the sendmail "spamfriend" mechanism tell</A> |
|
|
1144 <A HREF="dccm.html">dccm</A> to not check mail sent to some addresses? |
|
|
1145 <DD> |
|
|
1146 Sendmail decisions to accept, reject, or discard mail are largely |
|
|
1147 independent of the decisions made by dccm. |
|
|
1148 The DCC equivalent is to add |
|
|
1149 <A HREF="dcc.html#White-and-Blacklists">env_to</A> entries to the |
|
|
1150 <A HREF="dccm.html#FILE-whiteclnt">dccm whitelist</A>. |
|
|
1151 See the sample <A HREF="homedir/whiteclnt">@prefix@/whiteclnt</A> file in the |
|
|
1152 DCC source |
|
|
1153 <P> |
|
|
1154 However, if your sendmail.cf file sets the |
|
|
1155 <I>dcc_notspam</I> macro while processing the |
|
|
1156 envelope, then the message will by whitelisted. |
|
|
1157 This is related to the <I>dcc_isspam</I> macro |
|
|
1158 used by sendmail.cf modified by <A HREF="misc/hackmc">misc/hackmc -R</A> |
|
|
1159 to tell dccm to report blacklisted messages as spam to the DCC server. |
|
|
1160 |
|
|
1161 |
|
|
1162 <P><DT><A NAME="whitelist12"> |
|
|
1163 How do I tell</A> <A HREF="dccm.html">dccm</A> |
|
|
1164 to not check mail for an entire domain? |
|
|
1165 <DD> |
|
|
1166 To whitelist all mail addressed to mailboxes in a domain, |
|
|
1167 add the following line to the sendmail access_DB file and rebuild |
|
|
1168 the database with the sendmail tool, <I>makemap</I>: |
|
|
1169 <PRE> |
|
|
1170 To:domain.com DCC:OK |
|
|
1171 </PRE> |
|
|
1172 <P> |
|
|
1173 You can apply finer control by adding |
|
|
1174 a third argument to the FEATURE(dcc) macro in your sendmail.mc file |
|
|
1175 as described in |
|
|
1176 <A HREF="misc/dcc.m4.in">misc/dcc.m4</A>. |
|
|
1177 All mail for the domain can use a single "per-user" |
|
|
1178 <A HREF="homedir/whiteclnt">whiteclnt</A> file, |
|
|
1179 often in the @prefix@/userdirs/esmtp/example.com, where @prefix@/userdirs |
|
|
1180 is the default value for <EM>DCCM_USERDIRS</EM>in the DCC configuration file |
|
|
1181 <A HREF="homedir/dcc_conf.in">@prefix@/dcc_conf</A>. |
|
|
1182 Making @prefix@/userdirs/esmtp a symbolic link to @prefix@/userdir/local |
|
|
1183 can be handy. |
|
|
1184 |
|
|
1185 |
|
|
1186 <P><DT><A NAME="false-positives"> |
|
|
1187 How can I avoid polluting databases of DCC servers with |
|
|
1188 checksums of my mail that is not spam?</A> |
|
|
1189 <DD> |
|
|
1190 Reports of checksums with |
|
|
1191 <A HREF="dcc.html#White-and-Blacklists">whitelist</A> |
|
|
1192 entries in your server's database are not flooded to its peers. |
|
|
1193 The checksums of messages whitelisted with entries in local |
|
|
1194 <A HREF="dccm.html">dccm</A> or <A HREF="dccproc.html">dccproc</A> |
|
|
1195 whitelists are not reported to DCC servers. |
|
|
1196 It is good to add entries to DCC server and client |
|
|
1197 <A HREF="dcc.html#White-and-Blacklists">whitelists</A> |
|
|
1198 for localhost, your IP address blocks, and your domains if |
|
|
1199 you know that none of your users will ever send spam. |
|
|
1200 <P> |
|
|
1201 However, in the common mode in which the DCC is used, no |
|
|
1202 checksums of mail are pollution. |
|
|
1203 Checksums of genuinely private mail will have target counts of |
|
|
1204 1 or a small number, and so will not be flooded by your server to |
|
|
1205 other servers. |
|
|
1206 Strangers will not see your private mail and so will not be able |
|
|
1207 to ask any DCC server about the checksums of your private mail. |
|
|
1208 On the other hand, the DCC functions best by collecting reports |
|
|
1209 of the receipt of bulk mail as soon as possible. |
|
|
1210 That implies that it is generally desirable |
|
|
1211 to send reports of all mail to a DCC server. |
|
|
1212 The DCC flooding protocol does not send checksums with counts |
|
|
1213 below 10 <!--fix if BULK_THRESHOLD changes--> |
|
|
1214 to other servers. |
|
|
1215 |
|
|
1216 |
|
|
1217 <P><DT><A NAME="spamtrap"> |
|
|
1218 Can DCC be fed with <Q lang="en-us">spam traps</Q>?</A> |
|
|
1219 <DD> |
|
|
1220 A spam trap is a mail address that should practically |
|
|
1221 never receive legitimate mail, |
|
|
1222 and that treats any mail that it does receive as spam. |
|
|
1223 A spam trap might a common name such as |
|
|
1224 <Q lang="en-us">user1</Q> that has never been valid |
|
|
1225 and is discovered by unsolicited bulk email |
|
|
1226 advertisers by <Q lang="en-us">dictionary attacks</Q> or guessing. |
|
|
1227 It might instead be an address hidden in a web page |
|
|
1228 or a mailbox of an account that has been disabled for many months. |
|
|
1229 <P> |
|
|
1230 Any spam trap might receive legitimate mail. |
|
|
1231 For example, a spam trap that differs from an ordinary mailbox by a |
|
|
1232 single character might receive mail intended for the ordinary mailbox. |
|
|
1233 It might be best for a system to reject mail sent to such a trap so |
|
|
1234 that legitimate mail senders know that their messages have gone astray. |
|
|
1235 A mailbox that is a long string of arbitrary letters and digits is much |
|
|
1236 less likely to receive legitimate messages and so might best accept |
|
|
1237 all messages without complaint. |
|
|
1238 <P> |
|
|
1239 There are several ways to connect |
|
|
1240 <Q lang="en-us">spam trap</Q> mailboxes to DCC: |
|
|
1241 <DL> |
|
|
1242 <DT><A HREF="dccproc.html">dccproc</A> |
|
|
1243 <DD> |
|
|
1244 For example, |
|
|
1245 <PRE>dccproc -R -tMANY -cCMN,MANY -o/dev/null</PRE> |
|
|
1246 will accept a message on STDIN, |
|
|
1247 look for the IP address of the sender among |
|
|
1248 <Q lang="en-us">Received:</Q> SMTP fields, |
|
|
1249 reports the message to the DCC server as spam and the IP address as the sender, |
|
|
1250 and exit with the default value of |
|
|
1251 <A HREF="dccproc.html#OPTION-x">dccproc -x</A>. |
|
|
1252 <P> |
|
|
1253 <DT>dccif-test |
|
|
1254 <DD> |
|
|
1255 dccif-test was written to test the interface to the DCC interface daemon, |
|
|
1256 <A HREF="dccifd.html">dccifd</A>. |
|
|
1257 When wired to a spam trap, it is more efficient than dccproc. |
|
|
1258 For example, |
|
|
1259 <PRE>dccif-test -cclnt-IP-addr -oSPAM -O/dev/null</PRE> |
|
|
1260 will do much the same as the dccproc example above. |
|
|
1261 <P> |
|
|
1262 <DT><A HREF="dcc.html#White-and-Blacklists">whiteclnt file</A> option line |
|
|
1263 <DD> |
|
|
1264 The best way to build a spam trap is with a |
|
|
1265 per-user <A HREF="dccm.html#OPTION-w">whiteclnt file</A> |
|
|
1266 with an |
|
|
1267 <EM>option spam-trap-accept</EM> or <EM>option spam-trap-reject</EM> |
|
|
1268 line. |
|
|
1269 <P> |
|
|
1270 With sendmail, virtual user mapping can be used to send mail to invalid |
|
|
1271 mailboxes to a single mailbox whose corresponding DCC per-user |
|
|
1272 whiteclnt file contains an |
|
|
1273 <EM>option spam-trap-accept</EM> or <EM>option spam-trap-reject</EM> |
|
|
1274 line. |
|
|
1275 </DL> |
|
|
1276 |
|
|
1277 |
|
|
1278 <P><DT><A NAME="flood3"> |
|
|
1279 How many flooding peers does my DCC server need?</A> |
|
|
1280 <DD> |
|
|
1281 A single flooding peer delivers all reports of checksums of bulk |
|
|
1282 mail seen by any DCC server. Additional peers provided reports |
|
|
1283 sooner and so help the clients of a peer detect spews of spam sooner. |
|
|
1284 However, more peers will cause more reports to be duplicates. |
|
|
1285 <P> |
|
|
1286 A DCC server in a network of many servers should have at least three |
|
|
1287 flooding peers to ensure that the failure of a single server or network |
|
|
1288 link cannot partition the network. |
|
|
1289 Limiting the number the number of peers of any server to four or perhaps |
|
|
1290 a few more ensures that no single server is critical to the network. |
|
|
1291 To minimize the distances in the network, four peers |
|
|
1292 per server seem necessary. |
|
|
1293 <P> |
|
|
1294 An organization with more than one server can be viewed as a single |
|
|
1295 server by other organizations, with its servers flooding each other |
|
|
1296 and external peers spread among its servers. |
|
|
1297 This protects the network should the organization suffer large scale problems |
|
|
1298 while protecting the organization from single points of failure. |
|
|
1299 |
|
|
1300 |
|
|
1301 <P><DT><A NAME="flood1"> |
|
|
1302 Do I need to tell the operators of other DCC servers |
|
|
1303 the password for controlling my server to turn on flooding?</A> |
|
|
1304 <DD> |
|
|
1305 No, you do not need to and generally should not tell other DCC server |
|
|
1306 operators the passwords for controlling your server with |
|
|
1307 the <A HREF="cdcc.html">cdcc</A> command. |
|
|
1308 Every Inter-server flood of checksums is authorized by lines in |
|
|
1309 each server's <A HREF="dccd.html#FILE-flod">@prefix@/flod</A> file |
|
|
1310 and authenticated by the password associated with the |
|
|
1311 <A HREF="dccd.html#FILE-flod">passwd-ID</A> in those lines. |
|
|
1312 The passwd-ID is a <A HREF="dcc.html#Client-and-Server-IDs">server-ID</A> |
|
|
1313 defined in the <A HREF="dccd.html#FILE-ids">@prefix@/ids</A> file |
|
|
1314 that should generally be used only to authenticate floods of checksums. |
|
|
1315 |
|
|
1316 |
|
|
1317 <P><DT><A NAME="flood2"> |
|
|
1318 How can I figure out why flooding is not working?</A> |
|
|
1319 <DD> |
|
|
1320 Many DCC server problems can be diagnosed by turning |
|
|
1321 on one or more of the tracing modes in the server with the |
|
|
1322 <A HREF="cdcc.html#OPERATION-trace">cdcc trace</A> operation |
|
|
1323 or by restarting the server with |
|
|
1324 <A HREF="dccd.html#OPTION-T">dccd -T</A>. |
|
|
1325 <P> |
|
|
1326 The <A HREF="cdcc.html#OPERATION-flood-list">cdcc flood list</A> |
|
|
1327 operation displays the current flooding peers of a DCC server. |
|
|
1328 Counts of checksum reports sent and received to and from |
|
|
1329 a single peer can be displayed with |
|
|
1330 <A HREF="cdcc.html#OPERATION-flood-stats">cdcc "flood stats ID"</A> |
|
|
1331 <P> |
|
|
1332 The positions in the local database of outgoing streams of checksums |
|
|
1333 are displayed by the start of <A HREF="dblist.html">dblist -Hv</A>. |
|
|
1334 |
|
|
1335 |
|
|
1336 <P><DT><A NAME="rtt"> |
|
|
1337 Why didn't the RTT reported by the</A> |
|
|
1338 <A HREF="cdcc.html#OPERATION-info">cdcc info</A> operation |
|
|
1339 change when my network topology changed? |
|
|
1340 <DD> |
|
|
1341 The RTT or round trip time is an average value. |
|
|
1342 Changes in network topology, server load, and so forth are not |
|
|
1343 immediately reflected in the RTT to avoid switching DCC servers |
|
|
1344 too frequently. |
|
|
1345 |
|
|
1346 |
|
|
1347 <P><DT><A NAME="socks1"> |
|
|
1348 When my clients are configured to use SOCKS, they do not |
|
|
1349 realize immediately when a server is down.</A> |
|
|
1350 <DD> |
|
|
1351 When configured to use SOCKS, DCC clients cannot "connect" |
|
|
1352 to a server and so do not receive ICMP errors and must wait for |
|
|
1353 timeouts to know the server is not answering. |
|
|
1354 |
|
|
1355 |
|
|
1356 </DL> |
|
|
1357 |
|
|
1358 <P> |
|
|
1359 <HR> |
|
|
1360 <P class=small> |
|
|
1361 This document describes DCC version 1.3.103. |
|
|
1362 <P> |
|
|
1363 <A HREF="http://www.dcc-servers.net/dcc/"> |
|
|
1364 <IMG SRC="http://logos.dcc-servers.net/border.png" |
|
|
1365 class=logo ALT="DCC logo"> |
|
|
1366 </A> |
|
|
1367 <A HREF="http://validator.w3.org/check?uri=referer"> |
|
|
1368 <IMG class=logo ALT="Valid HTML 4.01 Strict" |
|
|
1369 SRC="http://www.w3.org/Icons/valid-html401"> |
|
|
1370 </A> |
|
|
1371 </BODY> |
|
|
1372 </HTML> |
|
|
1373 <!-- LocalWords: dccproc libmilter pthreads procmail dccm dccd DCC libmilter |
|
|
1374 --> |
|
|
1375 <!-- LocalWords: homedir dbclean setenv nbsp Solaris crontab Linux ICMP flod |
|
|
1376 --> |
|
|
1377 <!-- LocalWords: gmake FreeBSD NetBSD CFLAGS PTHREAD LDFLAGS LIBS HPUX IDs DT |
|
|
1378 --> |
|
|
1379 <!-- LocalWords: cdcc DL DD ids var RTT TD TR whiteclnt dccifd whitelist MTA |
|
|
1380 --> |
|
|
1381 <!-- LocalWords: hackmc busters whitelisted dblist SpamAssassin |
|
|
1382 --> |
|
|
1383 <!-- LocalWords: ARGS |
|
|
1384 --> |
