Differences

This shows you the differences between two versions of the page.

--- exim4:access_control [2016/11/04 10:32] – peter
+++ exim4:access_control [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 26: / Line 26: @@
 </file>
+<WRAP warning>
 **WARNING**:  Pursue **HELO** checking at your own peril.  The HELO is fairly unimportant in the grand scheme of SMTP these days, so don't put too much faith in whatever it contains.  Some spam might seem to use a telltale HELO string, but you might be surprised at how many legitimate messages start off with a questionable HELO as well.  Anyway, it's just as easy for a spammer to send a proper HELO than it is to send HELO im.a.spammer, so consider yourself lucky if you're able to stop much spam this way.
+</WRAP>
@@ Line 143: / Line 145: @@
             domains     = +public_domains
 </file>
+===== Recipient: manual redirect by the sender =====
+The idea is to send an automatic reply, using "mail" command in a filter, to inform that an email is blocked and that the user must use an other email address.  This can be used to change a user email which receive to much spam or to protect a public email address.
+In a filter:
+<file>
+### reply for someone@msharewiz.net
+if $original_local_part is "someone" then
+    seen mail from drop@sharewiz.net subject "Re: $h_subject" file .someone_reponse.txt
+    finish
+endif
+</file>
 ===== Recipient: emails addresses to catch spams =====
@@ Line 210: / Line 228: @@
     accept
 </file>
+===== Greylist =====
+Greylisting use the fact that most of the time spammers softwares do not take account tempory errors to retry later.  It's very effective.  You can use a daemon like [[http://packages.debian.org/unstable/mail/greylistd|greylistd]].
+When exim send a "temporary error":
+  * Not if the host is in a white list of "good" hosts.
+  * Not if there is no sender: it is a bounce message.
+  * Not if the HELO argument is well configured and the host name seams owned by the sender.
+  * if the greylist daemon want to.
+The two lines with **set acl_m9** are used to send the request to the daemon and get the result.  The **"/24"** is here because some big MTA can be spread over multiple hosts.
+<file>
+######################################################################
+#                    MAIN CONFIGURATION SETTINGS                     #
+######################################################################
+# Mandatory to use  "verify = helo"
+helo_try_verify_hosts = !+own_hosts
+ . . .
+######################################################################
+#                          ACL CONFIGURATION                         #
+######################################################################
+# ACL "subroutine" used by acl_check_rcpt below. Used to detect
+# hosts which have not their own registered domain-name (probably spammer).
+# Return ok if the HELO argument correspond to the connected HOST and
+# if the argument does not contain an IP in decimal or hexa.
+# I have created this ACL subroutine because we can't do a list of "or"
+# in ACL (it's a list of "and"), so I use a negation of "and":
+# no (no A and no B) = A or B.
+acl_clean_helo:
+    accept
+            verify     = helo
+            condition  = ${if match{$sender_helo_name}{\N(\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3})|([0-9a-f]{8})|([0-9A-F]{8})\N}{false}{true}}
+acl_check_rcpt:
+ . . .
+     # Greylisting, if the HELO argument seems bad or
+     # a dialin name (with IP included in the name). Some hosts from big
+     # providers are in a white list to avoid testing. When there is no
+     # sender then it is a bounce message, so no greylist.
+     defer
+            message = Please try later.
+            !hosts      = /etc/exim4/filters/host_white.list
+            !senders    = :
+            !acl        = acl_clean_helo
+            log_message = greylisted.
+            set acl_m9  = ${mask:$sender_host_address/24} $sender_address $local_part@$domain
+            set acl_m9  = ${readsocket{/var/run/greylistd/socket}{$acl_m9}{5s}{}{}}
+            condition   = ${if eq {$acl_m9}{grey}{true}{false}}
+</file>
+===== Anti-virus: Windows executable in attachment =====
+It's a very basic anti-virus: every emails with a windows executable as attachment is rejected.
+<file>
+acl_check_data:
+ . . .
+    deny    message = This message contains an attachment of a type which we do not accept (.$found_extension)
+            demime = bat:btm:cmd:com:cpl:dll:exe:lnk:msi:pif:prf:reg:scr:vbs:url
+</file>
+===== anti-virus: clamav =====
+<file>
+######################################################################
+#                    MAIN CONFIGURATION SETTINGS                     #
+######################################################################
+av_scanner = clamd:/var/run/clamd.ctl
+ . . .
+######################################################################
+#                          ACL CONFIGURATION                         #
+######################################################################
+acl_check_data:
+ . . .
+    deny    message = This message contains a virus or other harmful content ($malware_name)
+            demime = *
+            malware = *
+</file>
+anti-spam external detector: spamassassin
+We add a "X-SA-Score:" in the header of all emails, a "X-SA-Report:" for all email with spam score >0, we consider it a spam if score >5 (adding "X-SA-Status: Yes" and we don't accept the email if score >7.
+Because of the "accept" we must put this acl block at the end of the acl_check_data.
+<file>
+######################################################################
+#                    MAIN CONFIGURATION SETTINGS                     #
+######################################################################
+spamd_address = 127.0.0.1 783
+ . . .
+######################################################################
+#                          ACL CONFIGURATION                         #
+######################################################################
+acl_check_data:
+ . . .
+    ## spamassassin, spams are never big and spamassassin can die on big emails, so we
+    ## limit its use under 500k.
+    accept  condition = ${if >={$message_size}{500k}{yes}{no}}
+    warn    message = X-SA-Score: $spam_score
+            spam = nobody:true
+    warn    message = X-SA-Report: $spam_report
+            spam = nobody:true
+            condition = ${if >{$spam_score_int}{0}{true}{false}}
+    warn    message = X-SA-Status: Yes
+            spam = nobody:true
+            condition = ${if >{$spam_score_int}{50}{true}{false}}
+    deny    message = This message scored $spam_score spam points.
+            spam = nobody:true
+            condition = ${if >{$spam_score_int}{70}{true}{false}}
+</file>
+In your "~/.forward" you can redirect spams (5< score ≤7) in a special inbox:
+<file bash ~/.forward>
+#   Exim filter   <<== do not edit or remove this line!
+if $h_X-SA-Status: matches "^Yes" then
+     save $home/.Mailboxes/incoming/spam
+     finish
+endif
+</file>
+===== Checking source of email associated with your domain in whois =====
+If you have an email published in a whois database (spammers scan these databases) but want emails just from your registrar, you can add this in your "~/.forward" filter:
+<file bash ~/.forward>
+#   Exim filter   <<== do not edit or remove this line!
+if $original_local_part is "sharewiz-tr-myregistrar"
+  then
+  if $sender_address_domain is "myregistrar.net" then
+    deliver john
+  else
+    save $home/.Mailboxes/incoming/spam
+    finish
+  endif
+endif
+</file>