www.spambouncer.org
Where to Put the SpamBouncer 10 Configuring the SpamBouncer * 11 Basic Configuration * 12 Risk-Averse or New Users * 13 Ready to Fight Back :) * 14 I HATE SPAM AND WANT IT GONE NOW! It contains one new feature that users should be aware of -- a filter to filter out emails that contain an attack targeted to a known vulnerability in Microsoft Windows computers running certain versions of Internet Explorer. In addition, this update contains recipes to catch new viruses, new spam sources, spam haven domains, spam phone numbers, and has a number of minor bug fixes. It also contains new spam sources, spam haven domains, spam phone numbers -- the usual housekeeping stuff. In addition to the above, the beta version contains preliminary support for the 27 ISIPP's new 28 IADB whitelist. I also removed the WHITELISTLOCAL feature until I have time to debug it thorougly, in April. The beta version contains a bug fix to the recipe that extracts IPs from the headers of email, which affected a number of other recipes. The beta version also contains a bug fix -- the ALWAYSBLOCK functionality was broken in yesterday's version because of a typo. It also contains bug fixes for the following: * Shell error when checking LEGITLISTS file. This is a bug that has been in the SpamBouncer since the LEGITLIST capability was added. The fix may also fix perennial problems on a few systems when checking the NOBOUNCE, GLOBALNOBOUNCE, MYEMAIL, and LOCALHOST files in a number of recipes. In the default setting for the SBHOST variable, I used a flag that many systems don't support and that caused an error message in the Procmail log. On a very few Sun systems running an older version of Solaris, it also could cause the system to go into a loop and use all avilable CPU cycles. The data files for a number of prolific spammers have also been updated with new IPs, IP ranges, and domains. In addition, this release contains a new function, the "Whitelist Local" function, that whitelists email sent from users that use an IP or host listed in your LOCALHOSTFILE file. Most users don't get spam from other, local users, although they get spam with local addresses forged into it. This function is not fooled by the forgeries -- it whitelists only email actually sent using a local server and that did not, at any point in its journey to you, leave the local system. I hope this makes retrieving and using the files easier for many of you. See the 35 SBDELIVERY entry for instructions on how to configure the SpamBouncer to deliver to MH folders. If your MH Mail rcvstore program is not in the default location, you may also need to set the 36 MHDELIVER variable to the proper value for your system. The following, in particular, has changed: * Rewritten header information extraction routines. The header information extraction routines were rewritten from the ground up. The SpamBouncer now extracts IPs and hosts from the message body and generates IPs for the hosts in the message bodies of spam. The new code checks extracted header and body information against internal lists of IP ranges and domains that belong to known, prolific spammers. The code used to test both DNS-based whitelists and DNS-based blocklists is brand new and considerably more robust. It catches considerably more spam than the old code did. You should be able to install and use this release without too much difficulty. This will prevent old files from becoming mixed in with the new program files. Uncompressing the archive will create new files and also a number of new subdirectories that contain data files and subroutines used by the SpamBouncer, auxiliary files that users might need (such as a sample Procmail configuration file), and documentation (such as there is). Because of this, actual spam usually piles up quite a score. I find that setting the SPAMLEVEL at 20 with this release prevents false positives without significantly increasing the amount of actual spam missed. There are currently so many viruses pounding email servers that I recommend deleting viruses outright -- unless you have a great deal of hard disk space that you don't need for better things. You probably won't want complete headers for long, but it's fun at first and a good idea when you're debugging. Users who browse the web and read email on non-Windows computers can safely turn this off, at least at present. If you are upgrading from a previous beta version, you can skip this step. Change the name of your current SpamBouncer directory to an old name, such as sb-old. If you use this beta version, in particular, I need bug reports! Meanwhile, feel free to browse the code if you're curious. Lots of new small fry and haven domains, a few bug fixes, etc. Spammers appear to be a bit desperate to spam lots while they still can. There are a number of updates to recipes for specific spammers, to the Small Fry and Haven Domains lists, and to other parts of the SpamBouncer. NOTE: You may have heard of the current spam run that contains forged Habeas SWE headers. Even those of you who enabled Habeas whitelisting won't have seen this spam unless you checked your BLOCKFOLDER or SPAMFOLDER, because the SpamBouncer whitelists only Habeas email that comes from IPs on the Habeas User's List (HUL), not email that contains the Habeas SWE headers but does not come from an IP on that list. You can safely leave Habeas whitelisting enabled during this spam run; The SpamBouncer is a set of procmail recipes, or instructions, which search the headers and text of your incoming email to see if it meets one or more of the following conditions: * Contains body text strings which match the SpamBouncer's profile of a particular virus, class of viruses, or dangerous content that might be a virus. The SpamBouncer sorts suspected spam into three categories -- email sent by a virus, email from known spam sources which is definitely spam, and email which is probably spam, but might also be legitimate. It then tags each email with appropriate headers for the spam classification, and responds according to the parameters you have set. Depending on how you set it up, it will: * Simply tag the suspected spam and return it to your main incoming mailbox, allowing you to set up Eudora, Pegasus Mail, or another POP mail program to retrieve and sort your mail. If you want to receive mail from a site I have listed as a spam site, you can add the entire site name to the NOBOUNCE file. The SpamBouncer will check the NOBOUNCE file before filtering your email and will skip any email from a person or site listed in the NOBOUNCE file. Please note that you can put entire domain names, not just email addresses, in NOBOUNCE. This will cause the SpamBouncer to skip all email from anyone at Concentric. The SpamBouncer itself must run on a Unix server which has the Procmail mail filtering program installed, so only users who have access to a Unix shell account with Procmail installed can use it. This means that AOL users, Earthlink users, Mindspring users, Netcom Netcruiser/Netcomplete users, Compuserve users, Prodigy users, and others who do not have a Unix shell account as part of their service will have to find some other means of filtering spam. It is possible, however, for people who use Eudora, Pegasus Mail, and other POP clients to use the SpamBouncer on their Unix shell accounts to filter their email, and then use their favorite POP mail client to retrieve their filtered mail from the server. If their POP client programs can filter mail by headers, they can filter and delete known spam and probable spam directly into appropriate folders via the SpamBouncer's headers. This means that anyone running any kind of computer, operating system, and software can use the SpamBouncer, provided they have and use a Unix shell account, and (if they want to use a POP mail program) have software capable of filtering their mail based on user-configurable headers. If you are totally confused by now, PLEASE find a friend who understands what this means before you try to install the SpamBouncer. While I have made this as user-friendly as I could, using the SpamBouncer requires a certain level of knowledge about computer...
|
http://csua.com/feed/