Tim's Sendmail REGEX Patches

. This patch is for sendmail 8.12.* and will allow for regular expression checks of the body of all messages. It is based on the existing MAP_REGEX work. They will apply to sendmail up to at least 8.12.9.

You must not use a version of sendmail prior to 8.12.9 without security patches.

Warning! Use of this may result in users not being able to report spam to your abuse@ email address!

Add the following line:
Krv2 regex -aVirus-Detect2 ^TVqQAAMAAAAEAAA
To protect aginst the W32.Klez and Bug Bear (or bbugbear) virus as well as some based on it. It also will filter most mime encoded executables that many viruses use to exploit windows.

If your running 8.11 then check out the 8.11.1 version.

1. Get a copy of sendmail 8.12.9 (or newer) from sendmail.org
2. Get a copy of the patch:
   • 8.12.9.
   • 8.12.3.
   • 8.12.2.
   • 8.12.0 Beta 16.
     note: any of the above patches will work with any 8.12
   • 8.11.1.
     
3. Patch the source
   patch < regex_patch
4. Fix up (create?) devtools/Site/site.config.m4
   add APPENDDEF(`confMAPDEF', `-DMAP_REGEX') (this may not be needed but wont hurt to add)
   add APPENDDEF(`confENVDEF', `-DREGEX_BODY')
5. run sh ./Build
   
6. update your cf/cf/config.mc by adding a LOCAL_CONFIG section like this:

   LOCAL_CONFIG
   #
   #  Regular expression to reject:
   #
   Kbodyregex regex -aMATCH ^(spam|SPAM)
   

7. Make config.cf with
   make config.cf
8. Test new config:
   

   ../../obj*/sendmail/sendmail -v -bs -C ./config.cf
   mail from: me@here.com
   rcpt to: root
   data
   spam message to test filter
   .
   

9. Change the regex to a real list of spam. rebuild and test again
   

   LOCAL_CONFIG
   #
   #  Regular expression to reject:
   #
   # spam rejects
   Krs1 regex -aNoSpam (Millions of Email)
   Krs2 regex -a123.NoSpam (new auto today)
   Krs3 regex -aNoSpam (800-618-1495)
   # virus rejects
   Krv1 regex -aVirus-Detect1 (I send you this file in order to have your advice)
   Krv2 regex -aVirus-Detect2 ^TVqQAAMAAAAEAAA
   # collect all regex in one place
   Kbodyregex sequence rs1 rs2 rs3 rv1 rv2
   

   We can only add 12 regex patterns to a sequence map but we can add 12 sequence maps to each sequence map like this:

   Krs1 regex -aNoSpam (Millions of Email)
   Krs2 regex -aNoSpam (new auto today)
   Krs3 regex -aNoSpam (800-618-1495)
   ...
   Kss1 sequence rs1 rs2 rs3 rv1 [...]
   Kss2 sequence [upto 12 more...]
   Kbodyregex sequence ss1 ss2
   

My complete list is here.In the past few days each rule has filted this many messages:

• 1 NoSpam 2 (new auto today)
• 1 NoSpam 7 (105th U.S. Congress)
• 5 NoSpam 6 (Under Bill s.1618)
• 13 NoSpam 15 (13 NoSpam 17 ([a-zA-Z] [a-zA-Z] [a-zA-Z] [a-zA-Z] [a-zA-Z] [a-zA-Z])
• 36 NoSpam 16 (46 NoSpam 13 (opted-in)
• 434 NoSpam 12 ([vV/][iI1][aA][gG][rR][aA])
• 461 NoSpam 14 (remove.htm)
• 594 NoSpam 8 ([tT]o [bB]e [Rr][eE][mM][oO][vV][eE][dD])

If sendmail won't filter on the patterns, make sure you built it properly with the -DREGEX_BODY. The easy way is to remove the obj.* build directory and rerun ./Build

Changes since last version:

• You can now put a return string in the regex.
• the system now returns error code 421 and used to return 551.
  421 tells the other end to retry later, 551 says go away forever. Since you can add your own return codes this is not a problem. I did this because my server can take more abuse than many and it may help fill up the disk on a hacked server somewhere which might shut it down. It also lets you fix some problems incase your rules are too agressive. Sane email servers will try to resend the mail.
• It now uses sm_io functions in place of stdio.

Stuff I would like to add:

• Turn it into a Milter filter and do it right.
• Ability to ignore bodys for some users (like abuse and postmaster)
• Ability to hang connection. No use playing fair with spamers. (err.c is the place for this)
• The regex should go in a file. One per line
• The sendmail regex mapping needs to allow a file list.