AntiSpam

Ruleset check_mail

This ruleset will read three Berkeley DB-files.

• spamusers
  defines addresses like spammer@realnice.org
• spamdomains
  defines domains like realnasty.com
• spamrelays
  defines sending domains like spamming-isp.org

In my myhost.mc file I have put these statements:

LOCAL_CONFIG
#
Kspamdomains hash /local/lib/mail/spamdomains
Kspamusers hash /local/lib/mail/spamusers
Kspamrelays hash /local/lib/mail/spamrelays

LOCAL_RULE_0
Scheck_mail

# First lookup user in spamusers.db
R<$*>                   $: $(spamusers $1 $)            <spammer@domain> 
R<$*.>                  $: $(spamusers $1 $)            <spammer@domain.>
R$*.                    $: $(spamusers $1 $)            spammer@domain.
R$*                     $: $(spamusers $1 $)            spammer@domain
RSPAM                   $#error $: 451 Dont want your spam

# check for valid domain name (incompatible with DeliveryMode=defer)
R$*                     $: 


All tables define one address or domain on each line, to generate the
DB-maps I run this extract of my Makefile, generating all the
db's out of the cute IDA xaliases!

DBEXT=          db
SPAMPARSE=      bin/spamparse
SPAM_U=         spamusers
SPAM_D=         spamdomains
SPAM_R=         spamrelays

all: files
files:  $(SPAM_U).$(DBEXT) $(SPAM_D).$(DBEXT) $(SPAM_R).$(DBEXT)

$(SPAM_U).$(DBEXT): $(SPAM_U)
        $(SPAMPARSE) $(SPAM_U)

$(SPAM_R).$(DBEXT): $(SPAM_R)
        $(SPAMPARSE) $(SPAM_R)

$(SPAM_D).$(DBEXT): $(SPAM_D)
        $(SPAMPARSE) $(SPAM_D)




The Makefile calls this little perlscript, spamparse
(of course both perl and
sendmail should have been compiled with -ldb).

#!/share/bin/perl
umask 022;
exit unless -f $ARGV[0];
$MAP=$ARGV[0];
use DB_File;
use Fcntl;
tie (%S,DB_File,"$MAP.DB",O_RDWR|O_CREAT,0644) or die;
open(F,"$MAP");
while(<F>) {
   next if /^#/;
   chop;
   $S{$_}="SPAM";
}
close F;
untie %S;
rename "$MAP.DB","$MAP.db";
exit(0);




If you dont have resources to tie up the spamming machines, you could
change errorcode 451 to 551 in the lines beginning with «RSPAM».
Actually we dont accept mail from mailaddresses with 
only numbers on the LHS anymore...



You might also have a look at my PP hacks




Fight Spam on the Internet