CTOLOC - C^{heck To: address milter}

│

`[<]`CToloc Milter - a milter to check valid addresses for one or more domains

CToloc Milter - a milter to check valid addresses for one or more domains
Installation
SystemV init
Logging
Run
    MTA config
    Usage
Testing
Host Guilt and Penalties
Customization
Configuration
    Domains table file
    Users table files
Source
IPv6
License

`[<]`

CToloc Milter - a milter to check valid addresses for one or more domains

This milter uses a bunch of text tables with list of "username" parts (one table per configured domain to check) to validate the "To:" header of incoming mail messages.

The milter also penalizes any host that accumulate too many "user unknown"s, temporary refusing mail from its IP number.

Milters are daemons that complement Sendmail and Postfix MTAs to filter mail. Documentation about milters can be found in the old milter.org website. This site has been shut down, but it is still accesible at the internet archive: http://web.archive.org/web/20121025103629/https://www.milter.org/developers

Installation

Tested on Linux Debian.

  
  make
  make install
  make init

Install copies executable file to /usr/local/sbin
Init installs systemd service files and enable it (tested on Debian Jessie)

Note that there is a dependency on the libmilter library (see below).

SystemV init

If you are using a systemV init instead of systemd, you can copy ctoloc-milter.init to /etc/init.d/ or equivalent.

Logging

Logging is done via LOCAL2 facility. P.e.:

  
  /etc/syslog.conf
    local2.debug            -/var/log/ctoloc-milter.log

Run

Example run line:

     /usr/local/sbin/ctoloc-milter -p inet:ppppp@nnn.nnn.nnn.nnn -l

If you have done "make init", you can also start/stop using systemd, and the milter will be run at system startup.

   systemctl start ctoloc-milter
   systemctl stop ctoloc-milter

MTA config

Note that you must configure your sendmail/postfix to use the milter at IP nnn.nnn.nnn.nnn (the ip where the filter is running), on port ppppp (any free port).

Example sendmail config (.mc file):

   INPUT_MAIL_FILTER(`filterCToloc',`S=inet:ppppp@nnn.nnn.nnn.nnn, T=S:10s;R:10s;E:5m')
   define(`confINPUT_MAIL_FILTERS',`...,filterCToloc,...')dnl

Usage

Running "/usr/local/sbin/ctoloc-milter -h" gives you the usage info:

Usage: ctoloc-milter [-f] [-t timeout] [-l] -p socket-addr
        -d      Debug
        -p      Socket Address for Sendmail connection
        -t      Timeout
        -v      Show domains and tables loaded and exits
        -l      Log to syslog (else nothing)

Testing

The milter can be set to run in test mode by changing variable "pruebas" in the source to:

   bool pruebas=TRUE;

In this mode the milter always return SMFIS_CONTINUE (does nothing) and penalizes even the hosts in the white list.

You can check the log to see what is happening. Log messages are:

- START
- STOPING
- CONN [NN] my.host.my.domain - tags a connect. NN is the number of "user unknown"s it has accumulated so far (guilt).
- CONN [NN] %s PUNISHED - tags connect from a punished host (temp error)
- RCPT ... LOCAL user OK - tags a recognized local address
- RCPT ... EXT - tags a ignored external address
- RCPT ... LOCAL user UNKNOWN guilt NNN - tags an attemp to send to an unknown local user.

Host Guilt and Penalties

This milter also penalizes any host that accumulate too many "user unknown"s.

After VENIAL (default 5) consecutive "user unknown"s from an IP, the milter returns an temp error. After TPERDON seconds (default 15 min) any penalty is forgotten if no new "user unknown"s has been attemted.

Customization

Some things needs to be customized directly in the source:

VENIAL, allowed consecutive "user unknown"s whithout penalty.

     #define VENIAL 5

TPERDON, time to forgot penalty if not recurrent "user unknown" is received.

     #define TPERDON 15*60

TCHECK, penalty rescan frequency.

     #define TCHECK 30*60

Unknown user message, on the line:

     smfi_setreply(ctx,"550","5.1.1","... User unknown at UV");

Host in white list hosts, that is, hosts that can try to send to any amount of unknown users without penalty. Customize (full) domain and message on the lines (two domains are shown in this example):

     if ( TailCompare(hostname,".uv.es") ){ 
       message="LOCAL user UNKNOWN host UVHOST";
       if (pruebas) Castigar(hostname);
       }
     else if ( TailCompare(hostname,".rediris.es") ){ 
       message="LOCAL user UNKNOWN host REDIRISHOST";
       if (pruebas) Castigar(hostname);
       }

fierr output/error file

     #define fierr "/var/tmp/ctoloc-milter.err"

fitabdom domain table

     #define fitabdom  "/root/CORREO/TABLAS/OPER/tolocDOMGRU"

fitab user tables prefix

     #define fitab  "/root/CORREO/TABLAS/OPER/toloc"

Configuration

After any change of these tables the milter must be restarted.

Domains table file

The format of the domain table file is a set of lines, one for each tested domain. Each line has a domain, a blank space and a one-letter tag:

alumni.my.domain A
alumni.other.my.domain A
staff.my.domain S
morestaff.my.domain S
ext.my.domain E

Users table files

Each tag of the domain table corresponds to a user file table. From the above exaple you must define the following user tables:

/root/CORREO/TABLAS/OPER/tolocA
/root/CORREO/TABLAS/OPER/tolocS
/root/CORREO/TABLAS/OPER/tolocE

Each user table is a simple list of users, one per line:

user2
smith
louis

If the above table is "tolocA", thats means user2@alumni.my.domain or user2@alumni.other.my.domain are allowed addresses.

Source

You can find here the source of the milter, the makefile, the systemd service file and the systemV init file (old one without dependency info).

To compile this milter you will need the libmilter library and its development files. The corresponding Debian packages are libmilter-dev and libmilter1.0.1 in Jessie.