Bruno Lebayle - December 2000
European Synchrotron Radiation Facility - Grenoble, FRANCE

smap with anti-spam filters
==============================

A - Conventions
---------------
* smap is executed in /opt/mail
* configuration file (netperm-table) resides in /usr/local/etc
* executables (mkspamdb, smap, etc.) reside in /usr/local/etc
* smap is based on a modified V1.4, where the mechanism for synchronizing smap 
and smapd was made more reliable; useful V2.1 additions were included, such 
as fixes for size control and other stuff.

B - Description
---------------
Each of the following features can be added separately using the relevant 
compilation options in the smap.c source file.

1- Built-in home-made anti-relay ("FILTER" compilation option)

2- Unsollicited Commercial Emails coming from well-known "spammers" are 
filtered according to the NoSpam! database (more than 5000 entries) developed 
by Jason R. Rhoads (http://www.sabernet.net). 
The filter processes ("NOSPAM" compilation option):
    - the "From:" field (sender's name): either a full username or a domain name
    - the originating hostname i.e. the host establishing the SMTP connection 
intended to transport the email: either a full hostname, or a domain name, 
or an IP address 

3- MAPS/RBL database (Mail Abuse Prevention System - Realtime Blackhole List). 
The http://maps.vix.com/rbl site provides a tool checking whether a particular 
host belongs to the MAPS/RBL database. The spammer is identified based on the 
originating host only (also "NOSPAM" compilation option). 

4- Malformed "From:" address ("NOFAKE" compilation option):
    - empty "From:" field (either no character at all, or <>, or <@>), except 
for error reports as of RFC821 
    - user without domain name 
    - user with invalid domain name, i.e. not registered in DNS
    - fake user name (e.g. more than N figures) 
    - fake host name

5- Well-know strings in the email's contents ("SPAMBODY" compilation option): 
based on the work of http://www.cnx.com/stopspam.html. This implementation 
allows for turnarounds, i.e. key passes allowing to "unfilter" an email.

C - Files being included
------------------------
Makefile = smap/Makefile file, modifications relative to added source files
smap.c.changes = in smap/; patched with compilation options (see header)
nospam.c = in smap/; included within smap for NoSpam! control
mkspamdb.c = in smap/; mkspamdb updates the NoSpam! database

netperm-table = config file (smap directives only)

update-spam.sh = in /usr/local/etc/; calls mkspamdb
spamlist.pl = in /usr/local/etc/; current set of NoSpam! filters (email sources)

spamlist.cnx = last update of string filters, fetched at www.cnx.com
spambody.sh = formats spamlist.cnx into spamlist.body
spamlist.body = in /usr/local/etc/; current set of string filters
spamlist.body.accept = in /usr/local/etc/; current set of strings unfiltered 
	(one occurence of a listed string makes the email come through
	whatever its contents; this acts as a pass key, provided the pass is
	put at the early beginning of the email)
spamlist.body.addons = added versus the last update of string filters
spamlist.body.removed = removed versus ... (unwanted filters)

agespambody.cron = launched by cron (e.g. each month), it allows to remove
	those filters which did not trigger during the last N days; this
	avoids having too many string filters which overload the firewall's
	CPU; this script is based on log files (abstracts) stored for the last 
	N days,
	in this example, all dayly logs are stored in /somewhere
