The Spam Bouncer
Version 1.3

Updated January 20, 2001

If you have a version before the current version number or more than a month older than this date, please update. If you are running in COMPLAIN mode, you should update weekly.

Please also read "What's New" for new version information. New users should run with SPAMREPLY and BLOCKREPLY set to SILENT for a week or so until they are sure the program is installed correctly and isn't catching legitimate email. Beta version users should check the Beta Version comments at the top of the Spam Bouncer program file when installing a new beta version.

Copyright (C) 1996-2001 by Catherine A. Hampton. If you abide by the Free Software Foundation's COPYING principles with this document and the spam software and forms, you're home free, but don't try to copyright it yourself or sell this information.

Contents

• What's New with the Spam Bouncer?
• What Does the Spam Bouncer Do?
• What Do I Need to Run the Spam Bouncer?
• Before You Begin....
• How to Install and Use the Spam Bouncer
• Installing Procmail on Your System
• Retrieving the Spam Bouncer Program Files
• The Spam Bouncer Files and What They're For
• Where to Put the Spam Bouncer
• Configuring the Spam Bouncer
• Special Instructions for Eudora and Other POP Mail Clients
• Upgrading the Spam Bouncer
• How to Troubleshoot and Report Trouble
• The SpamBouncer Updates Mailing List
• Acknowledgments

What's New with the Spam Bouncer?

Return to Table of Contents

What Does the Spam Bouncer Do?

The Spam Bouncer is a set of procmail recipes, or instructions, which search the headers and text of your incoming email to see if it meets one or more of the following conditions:

• Originates from an email address known to belong to a spammer.

• Originates from known spam source sites, domains or hosts -- internet sites which exist solely or primarily to spam or provide services to spammers.

• Originates from irresponsible, or rogue, Internet Service Providers (ISPs), who permit spamming from their sites and fail to take appropriate action against spammers.

• Was sent using a bulk email program whose only or primary purpose is to send large quantities of junk email.

• Contains headers which match the filter's profile of definite or probable spam.

• Contains body text strings which match the filter's profile of probable spam.

The Spam Bouncer sorts suspected spam into two categories -- mail from known spam sources which is definitely spam, and other mail which is probably spam, but might also be legitimate. It then tags this email with appropriate headers giving the spam classification, and responds according to the parameters you have set.

Depending on how you set it up, it will:

• Simply tag the suspected spam and return it to your main incoming mailbox, allowing you to set up Eudora, Pegasus Mail, or another POP mail program to retrieve and sort your mail.

• Tag the suspected spam, delete spam from known spam sources, and file suspected spam in a separate folder.

• Send a simulated MAILER-DAEMON daemon "bounce" to known spammers in hopes that they will think your email address is invalid and remove you from their spam lists.

• Complain to the "upstream providers" of known spammers or spam sites/domains, asking that they disconnect the internet service of the spammers.

• Notify senders of email tagged as probable spam that their email was intercepted, and give them a password to resend their email and bypass spam filtering if their email was legitimate. (Spammers almost never try to bypass filtering when warned this way -- in most cases, they don't even read replies to their mail.)

If you get mail from friends who have accounts at a site listed in the filter, you can put their names and email addresses in a text file and set the NOBOUNCE variable to point to it. If you want to receive mail from a site I have listed as a spam site, you can add the entire site name to the NOBOUNCE file. The Spam Bouncer will check this file before filtering your email and will skip any email from a person or site listed in the NOBOUNCE file.

Please note that you can put entire domain names, not just email addresses, in NOBOUNCE. For example, if you want to accept all email from concentric.net without checking for spam, just put concentric.net in your NOBOUNCE file, with no username@ section. This will cause the Spam Bouncer to skip all email from anyone at Concentric. (I do not recommend doing this except for small domains which you =KNOW= will not be sources of spam, though.)

What Do I Need to Run the Spam Bouncer?

The Spam Bouncer itself must run on a Unix server which has Procmail installed, so only users who have access to a Unix shell account with Procmail installed can use it. This means that AOL users, Mindspring Internet users, Netcom Netcruiser/Netcomplete users, Compuserve users, and others who do not have a Unix shell account as part of their service will have to find some other means of filtering spam. Sorry!

It is possible, however, for people who use Eudora, Pegasus Mail, and other POP clients to use the Spam Bouncer on their Unix shell accounts to filter their email, and then use their favorite POP mail client to retrieve their filtered mail from the server. If their POP client programs can filter mail by headers, they can filter and delete known spam and probable spam directly into appropriate folders via the Spam Bouncer's headers.

This means that anyone running any kind of computer, operating system, and software can use the Spam Bouncer, provided they have and use a Unix shell account, and (if they want to use a POP mail program) have software capable of filtering their mail based on user-configurable headers.

If you are totally confused by now, PLEASE find a friend who understands what this means before you try to install the Spam Bouncer. While I have made this as user-friendly as I could, using the Spam Bouncer requires a certain level of knowledge about computers and the internet. It is not for computer or internet novices.

Return to Table of Contents

Before You Begin...

Because someone who evidently likes the Spam Bouncer listed it for me in Yahoo and other search engines <wry grin>, I need to include the following disclaimers and warnings.

First, this is free software. No warranty is provided or implied -- users use the Spam Bouncer at their own risk.

I wrote the Spam Bouncer originally to filter my own mail, when spam started drowning out the real mail. I originally posted these filters to my web site so that users at my old ISP, Best Internet, and a few other experienced users could help me test them. I recommend that Procmail neophytes get help from an experienced Procmail user on their system to install the Spam Bouncer, and run it in default "Silent Mode" until they are more confident of their skills.

The Spam Bouncer was developed on a Pentium-based server running FreeBSD, and running Procmail 3.11pre7. That's a beta version of Procmail. The latest production version is 3.10. Many users have successfully run the Spam Bouncer with Procmail 3.10 on various systems, and I know of no failures of the program because of incompatibilities with Procmail 3.10.

In addition to the Pentium-based FreeBSD system where I developed the Spam Bouncer originally, I tested the earlier versions of it on SGI systems running Irix 5.3 and 6.2, and am currently using it on a Pentium-based system running Linux 2.0.33. I know of no problems running on these systems. A number of users have also run the problem under various flavors of SunOS, Solaris, HPUX, and other versions of Unix with no trouble.

I have not personally tested any version of the Spam Bouncer since 0.95a beta (two years out of date now) on Irix, or any version on any system or under any other flavor of Unix except FreeBSD and Linux, however, and it may not run properly even on systems running these types of Unix if the configuration is somehow different from what I've tested on.

So please be careful, and keep a close eye on your account for a few days after installing to be sure it works properly.

Return to Table of Contents

How to Install and Use the Spam Bouncer

Installing Procmail

To use these filters, you will need to have procmail installed on your system, and have set it up for your account. This does not mean you must read mail on your unix account -- if you have a shell account, these filters can be configured to filter mail and then deliver it to your POP mail box. If you don't know what kind of account you have, you probably shouldn't be using these filters until you learn something about Unix and shell accounts.

Since the way Procmail should be installed is different on different systems, if you do not already have Procmail installed, you will need to ask your system administrator or people on your local internet service provider for help. Those who have never used Procmail and want to get started with a simple Procmail setup can jump to Getting Started With Procmail, a tutorial with clear instructions about what information you will need to get from your system administrator to set up Procmail properly on your account, and a basic .procmailrc configuration file which should work well on most systems.

If you are an experienced Procmail user, please make sure that your .procmailrc file is configured to filter out your mailing lists before filtering for spam. The Spam Bouncer tries to identify list mail and skip it, but some mailing lists do not use standard list "Precedence:" headers or headers recognisable by Procmail as coming from a daemon or list program. So please be sure you filter out your lists first, especially if you are running with SPAMREPLY set to BOUNCE or COMPLAIN!

In any event, you should always run in SILENT mode for a few days, until you are sure you have your mailing lists filtered out properly and that the filter is working properly on your account.

If you did not use procmail.rc from Getting Started With Procmail, here's a recipe to filter out list mail and other mail from automatic mailer programs, or mailer daemons, as they are usually called on Unix machines. Put it in your .procmailrc file before the INCLUDERC statement that calls the Spam Bouncer.

# Filter out Mailing List Mail
:0:
* ^TO(listmom-talk@skylist.com|\
      orthodoxy@lists.best.com|\
      procmail@Informatik.RWTH-Aachen.DE)
$BULKFOLDER

You should substitute all mailing list addresses for mailing lists you receive for the list I gave -- you and I don't read mail from the same lists, at least as far as I know! :)

Return to Table of Contents

Retrieving the Spam Bouncer Program Files

After you have installed Procmail for your system, you can install the Spam Bouncer. You will need to download the Spam Bouncer program files to your Unix account first. You can do this one of two ways -- by downloading them from the links below to your personal computer, or by ftp'ing them. The advantage to ftp is that it ensures that the file format will be right. Often, when you retrieve a text file using a WWW browser and then save it to your hard disk, the browser reformats the file. This type of reformatting can break Procmail configuration files like the Spam Bouncer.

Lynx users should note that lynx reformats text files when downloading them via a normal link access command, which will break the Spam Bouncer and most other Procmail scripts. If you're a lynx user, please remember to use the "D" command to download the Spam Bouncer files instead of just accessing the link, or (even better) ftp the files from the links in the FTP column instead of trying to retrieve them from the http:// links in the WWW/HTTP column.

Now, if you saved the Spam Bouncer files on your local PC, you will need to ftp or upload them to your unix shell account. They should be put in their own directory.

To unarchive the ZIP format archive, type "unzip spambnc.zip" and press <Enter>. (Your Unix machine may respond with an "unzip: command not found" error message. If it does, you may not have the Unix program unzip, and should retrieve the tar.Z archive.) To unarchive the tar.Z file, type "uncompress spambnc.tar.Z", press <Enter>, and then type "tar -xvf spambnc.tar" and press <Enter> to extract the individual files.

Return to Table of Contents

The Spam Bouncer Files and What They're For

The first three files in the Spam Bouncer distribution, sb.rc, sb-old.rc and sb-new.rc, contain alternate versions of the actual Procmail scripts for the Spam Bouncer. The first version is the current production version of the Spam Bouncer, the second is the previous production release of the Spam Bouncer, and the third is the current somewhat stable beta version. Inexperienced users or users who don't want problems should not use the beta version, and all beta version users need to follow any warnings/instructions listed among the comments at the top of the Beta Version script file.

The "freemail" file contains a sample text file which you may install and then set your FREEMAIL variable to point to. You do not need to install this file unless you want to customize the list of free email sites -- the Spam Bouncer will use its own internal list if it can't find the text file.

The "legitlists" file contains a text file with the names of legitimate email lists (the opt-in variety), which you may modify to make sure your mailing lists aren't getting trapped by the Spam Bouncer. Just put each mailing list address on a separate line, just as you would with the NOBOUNCE file.

The other three files contain standardized autoresponder messages for the program. You may customize these to your taste. I do recommend that you leave the references to sb@ariel.vip.best.com in any edited version of the file spam, though, so that people know how to contact me if their mail is getting bounced because of a problem with the filter itself, or how it is installed. That way, I can contact you (hopefully), and prevent further damage.

If you customize the autoresponder messages, you probably want to keep them reasonably polite. There's no point flaming some poor innocent bystander because you're p*ssed at Connectup, Emaildirect.net, or some spamming fool with a throwaway account. :)

Return to Table of Contents

Where to Put the Spam Bouncer

The best way to use the Spam Bouncer is to save the files in a location to which everyone on your system has read access. If you aren't sure how to do this, ask you system administrator or an experienced user on your system. If you install the filter this way, a user can create a symbolic link to the shared Spam Bouncer directory in his home directory. This means you or one person can keep the filter up to date for everyone, sparing a lot of people a lot of extra work.

If a particular user wants to modify the filter, he can simply create a private directory, copy the necessary files to it, and make whatever changes he wants. If he does the last, of course, he is responsible for updating his copy of the filter manually.

Return to Table of Contents

Configuring the Spam Bouncer

After setting up the Spam Bouncer directory, you should set or modify the following variables in your .procmailrc file:

     DEFAULT={NO DEFAULT}
     FORMAIL={NO DEFAULT}
     SBDIR={NO DEFAULT}
     ADMINFOLDER=${DEFAULT}
     ALTFROM=${LOGNAME}@${HOST}
     BLOCKFOLDER=${DEFAULT}
     BLOCKREPLY=SILENT
     BULKFOLDER=${DEFAULT}
     BYPASSWD=syzygy
     CHINESE=no
     DATE=date
     DEBUG=no
     DULCHECK=no
     FREEMAIL=INTERNAL
     GARBLEDCHARSET=yes
     GLOBALNOBOUNCE=NONE
     GREP=fgrep
     KOREAN=no
     LEAN=yes
     LEGITLISTS=NONE
     MYEMAIL=$HOME/.myemail
     NOBOUNCE=${HOME}/.nobounce
     NOLOOP=${ALTFROM}
     NSLOOKUP=nslookup
     ORBSCHECK=no
     PATTERNMATCHING=SILENT
     RBLCHECK=yes
     RM=rm
     RSSCHECK=no
     RM=rm
     SENDMAIL=/usr/sbin/sendmail
     SPAMREPLY=SILENT
     SPAMFOLDER=${DEFAULT}
     TEST=test
     THISISP=${HOST}
     TURKISH=no

The variables are shown with the default values which the Spam Bouncer will assign if they are not already set in your .procmailrc file. These defaults will prevent problems, but also will cause the Spam Bouncer not to do very much. So you want to set the correct variables for your system and account.

Please note that those variables in red have no defaults and MUST BE SET or the Spam Bouncer will simply pass all your mail on to you unfiltered!

Here's what each variable is for:

DEFAULT

The email inbox to which your system delivers mail by default, or (if you use your shell account to read mail) to which you want your mail delivered by default. If you normally read mail using a POP mail program, like Eudora, Internet Explorer, Netscape, or Pegasus mail, ask your system administrator for the name and location of your POP mailbox, and set DEFAULT to that path and file name.

FORMAIL

The full path to your system's copy of formail. If this is not set properly, the Spam Bouncer is unable to sort and tag your email, and so will simply pass it on unfiltered to you.

SBDIR

The directory where your Spam Bouncer program and auxiliary files are located.

ADMINFOLDER

ADMINFOLDER is for mail from mailer daemons (usually bounced mail -- mail that could not be delivered), and for mail from administrative addresses like root, admin, sysadmin, and abuse. Shell readers will want to set this to an appropriate folder separate from their DEFAULT folder. (I use admin.incoming.) POP mail readers may set this to DEFAULT, and use their POP program's filters to sort it out after downloading.

ALTFROM

ALTFROM should be set a different email address than your usual email, but a valid address, and preferably one which DOES NOT forward to your normal email account. This is used to avoid giving spammers at some particularly egregious sites your usual email address, and to bypass blocks that some spammers and spam friendly sites will put to prevent your sending them mail if you complain often enough and effectively enough. Change this address frequently to defeat these filters.

BLOCKFOLDER

Where to store message tagged as questionable by the filter. I recommend not deleting these, but putting them in a folder of their own. I use block.incoming. POP mail users whose client programs have the ability to filter mail into separate folders (like Eudora and Pegasus mail) can set this to DEFAULT, and let their mail filters sort it into an appropriate folder on their home systems. Users of MAILDIR may set BLOCKFOLDER to a directory rather than a filename, and users with exotic ideas about spam management <grin> may forward this email to a different address using normal sendmail syntax.

BLOCKREPLY

How to handle mail which the filter tags as probable spam, but which may contain some real email as well. Valid values are SILENT, which simply files the mail in the BLOCKFOLDER, and NOTIFY, which sends a notice and copy of his email back to the sender with instructions on how to bypass the Spam Bouncer if his email is not spam.

BULKFOLDER

How to handle bulk mail which the filter does not tag as probable spam -- bulk email which is probably legitimate. The default value is DEFAULT. If you read mail on your shell account, change this to a separate folder from your normal incoming folder, especially if you get a lot of email or are on many mailing lists, and you'll be able to find your personal mail much more easily. :)

BYPASSWD

A password which, when included on the Subject: line of an email, causes the Spam Bouncer to pass the mail immediately into your incoming mail box without further filtering. It allows people who happen to have accounts at ISPs which are blocked in the Spam Bouncer, or whose email is being trapped by an error in the Spam Bouncer, to contact you and arrange to have the problem fixed or get into your nobounce list. Change this if spammers start using it, but it is very unlikely tht they will. (It never has happened to me in the three years since I started developing the Spam Bouncer.)

CHINESE

Set CHINESE=yes if you receive email in Chinese. Otherwise leave it set to no (the default), and the Spam Bouncer will send any email in this language to the BLOCKFOLDER.

DATE

The local Unix date program. This is set to "date" by default, since date is usually in a directory which is in your default system path. (The system path is a list of directories your Unix shell searches when you tell it to run a program and don't tell it specifically where to look.)

If your Spam Bouncer's staledating routine is working and it is turning its autocomplaints off when you haven't upgraded recently, there is no need to set this -- the default is usually correct. If staledating is not working, set this variable to point to your system's date program and that should fix the problem.

DEBUG

Set DEBUG=yes if instructed, to generate a log file so that I can figure out what's going wrong on your system. :> When I refine this variable, it might be useful to advanced Procmail users, but for now do not use it unless I instruct you to.

DULCHECK

If set to "yes", tells the Spam Bouncer to check the Mail Abuse Prevention System (MAPS) Dial-Up List (DUL), which lists IP addresses that are part of ISP dial-up pools, and block email sent directly to your system from these IP addresses. That will block a considerable amount of spam. It also risks blocking legitimate email, though, especially if you correspond with users who own Unix systems and run their own mail servers. You can work around this by putting the email addresses of any such users in your NOBOUNCE file.

This variable is set to "no" by default.

FREEMAIL

Tells the Spam Bouncer where to find your freemail file, a text file of domains offering free email accounts commonly used or forged by spammers. The domains should be listed singly, with one appearing on each text line, and with no blank lines in the file. Be sure you do not create an empty FREEMAIL file, either.

In addition to the name of this text file, this variable has two other valid settings. If FREEMAIL is set to INTERNAL, that will cause the Spam Bouncer to filter its default set of free email sites, as documented on this WWW page. If FREEMAIL is set to NONE, the Spam Bouncer will skip this filter entirely and not block any free email sites. Setting FREEMAIL to NONE will not exempt mail from these sites from other spam filtering, though -- it will simply mean that such mail is not automatically diverted to your BLOCKFOLDER.

GARBLEDCHARSET

Controls the GARBLEDCHARSET filter, which tests for email with non-Latin character sets, and missing, wrong or corrupted MIME headers which should accompany any such character sets. This filter has been refined considerably, but may still occasionally catch email in heavily-modified Latin character sets (such as Baltic or some Eastern European languages), and will tend to catch email with non-Latin character sets, such as Russian, Greek, Arabic, Hebrew, etc.

The default for this variable is yes, which enables this filter. Users who expect to receive email in a non-Latin character set, or who find it is catching too much legitimate email, can set this variable to no to disable the filter.

GLOBALNOBOUNCE

Points to a system-wide nobounce file, if your system administrator has provided one or if you are the system administrator and want to provide one. Please note that this is in addition to each user's individual NOBOUNCE file, and does not replace it. If you do not set this variable, it is automatically set to NONE, so you need to set it only if you have a system nobounce file.

See NOBOUNCE for a more complete description of how this file works.

GREP

A variant of Unix grep, a set of programs which searches files on Unix systems for specified strings of characters. This is set by default to "fgrep", a fast version of grep which is usually found in a normal system programs directory on Unix machines. Most versions of fgrep work properly with the Spam Bouncer.

If NOBOUNCE and LEGITLISTS are working on your system, there is no need to set this variable. If NOBOUNCE is not working, set this variable to point to one of your system's grep programs other than fgrep. Usually egrep will work, or agrep if that does not.

JAPANESE

Set JAPANESE=yes if you receive email in Japanese. Otherwise leave it set to no (the default), and the Spam Bouncer will send any email in this language to the BLOCKFOLDER.

KOREAN

Set KOREAN=yes if you receive email in Korean. Otherwise leave it set to no (the default), and the Spam Bouncer will send any email in this language to the BLOCKFOLDER.

LEAN

This variable turns off Pattern Matching on the body text only of messages over a certain size, and is set to yes by default. This is to prevent the Spam Bouncer from hogging system resources on your server while filtering extremely large messages. The Spam Bouncer is a large filter and can hog resources on an ISP or shared system if this limit is not in place.

Set LEAN=no only if you receive large quantities of spam with attached files, and then only if you run your own server or know that the server on which your email is filtered has sufficient resources to run the Spam Bouncer on the full text of all incoming email.

LEGITLISTS

Tells the Spam Bouncer about legitimate mailing lists which the Spam Bouncer should not filter, but should deliver to the BULKFOLDER. Your LEGITLISTS file (whatever you name it and wherever you put it) should contain one email list address per line of text, and nothing else, like this:

     chitchat@borg.besties.com
     dylan-fanatics@lists.musicman.net

If you do not set this variable, it is automatically set to ${HOME}/legitlists. If the file does not exist, the Spam Bouncer just skips this recipe.

MYEMAIL

Points to a text file similar to the NOBOUNCE file, containing a list of email addresses which belong to you. This helps the Spam Bouncer with a number of internal routines, and will be implemented in future spam tests, as well. The default is ${HOME}/.myemail. If you do not set this variable to a different value, and if there is no .myemail file in your ${HOME} directory, the Spam Bouncer will assume that ${LOGIN}@${HOST} is your email address.

NOBOUNCE

Tells the Spam Bouncer where to find your NOBOUNCE file, a text file of email addresses and domains whose email you want the Spam Bouncer to skip filtering and deliver directly to you. Set this to point to the directory and filename where you keep that file. I name mine ".nobounce" and keep it in my home directory, and this is where the Spam Bouncer looks if you don't set this variable.

Your NOBOUNCE file (whatever you name it and wherever you put it) should contain one email address per line of text, and nothing else, like this:

     goodguy@spamsite.com
     niceguy@roguesite.net

Please note that these names and addresses should be in plain text -- don't use Procmail regular expressions or wildcards, and don't try to escape the "." (periods) using a "\" (backslash). This will just confuse the Spam Bouncer and cause your NOBOUNCE file not to work. :)

You can also include entire domain names (the portion of the email address to the right of the @ sign) if you want the Spam Bouncer to accept all email from anyone at those domains without checking. I do not recommend doing this, however, except for small domains which you know will not either send spam or be forged into spam by spammers. Since spammers often forge false email addresses in the From: and Reply-To: lines of their messages, you need to be careful or you will make it too easy for them.

In particular, do not put your own domain in your NOBOUNCE file, since a number of spammers use mailmerge spam programs to forge their victims' own email addresses or a phony email address at their victims' domains into their spams, specifically in order to evade filters like the Spam Bouncer.

I recommend that you put the names of friends with email accounts at the following list of free email sites in your NOBOUNCE file as soon as possible:

• angelfire.com
• bigfoot.com
• geocities.com
• hempseed.com
• mailcity.com
• rocketmail.com
• usa.net
• yahoo.com

All of these sites have reasonably solid anti-spam policies, but since they give away free email accounts, it is difficult for them to stop spammers from getting one account after another. I've found that blocking mail from these sites cuts down considerably on spam. You may, of course, set your FREEMAIL variable to NONE if you don't want to block email from unknown users at these sites automatically.

NOLOOP

Sets the "X-Loop:" header. I recommend leaving the default setting, which uses your ALTFROM address as the "X-Loop:".

NSLOOKUP

Tells the Spam Bouncer the path and filename of your system's nslookup program. You need to set this only if nslookup is not in your path (the list of directories which your system will search for a program) or if you have an alias set up for nslookup on your account. If you aren't having trouble getting RBLCHECK and DULCHECK to work on your system, you can leave this alone.

ORBSCHECK

If set to "yes", tells the Spam Bouncer to check the ORBS Relay blacklist, which lists IP addresses associated with mail servers which are open relays, or allow anyone from any part of the Internet to send email to any other part of the Internet. A relay listed in the ORBS blacklist has not necessarily been used to send spam; it merely can be used to do so. The ORBS blacklist is generally considered aggressive, and can result in blocking a considerable amount of legitimate email as well as spam if you correspond with people at sites which host an open relay.

This variable is set to no by default. To enable ORBS relay testing, set it to yes.

PATTERNMATCHING

How to handle mail which the generic pattern matching filter tags as probable spam, but which may be legitimate email. Valid values are NONE, which skips pattern matching entirely; SILENT, which simply files the mail in the BLOCKFOLDER; and NOTIFY, which sends a notice to the sender that his email was blocked, and explains how to bypass spam filtering if his email was legitimate.

I recommend that users set this value to SILENT. Pattern matching occasionally filters out legitimate email -- there is no way to prevent this entirely. Since more and more spammers are using throwaway accounts, though, and forging their headers so heavily that it is difficult to spot spam through header analysis alone, setting PATTERNMATCHING to NONE will reduce the effectiveness of the Spam Bouncer considerably.

The default setting for this variable is NONE, however, because I want to be sure that if you're using it, you have actually read these instructions and know that you are using it. So, if you want to enable it, you must set PATTERNMATCHING to SILENT in your .procmailrc.

RBLCHECK

If set to "yes", tells the Spam Bouncer to check the Mail Abuse Prevention System (MAPS) Realtime Blackhole List (RBL), which lists IP addresses associated with domains which have spammed repeatedly, and which have failed to clean up their acts despite the RBL team's efforts and assistance. Sites listed on the RBL are highly likely to be the sources of spam, and will rarely be sources of email you want to receive. Most users will want to use the RBL.

This variable is set to yes by default. To disable it, set the variable to no.

RM

Tells the Spam Bouncer the path and filename of your system's rm program -- the program which deletes files. You need to set this only if rm is not in your path (the list of directories which your system will search for a program) or if you have an alias set up for rm on your account. If you aren't having trouble with the Spam Bouncer leaving temporary files on your system, you can leave this alone.

RSSCHECK

If set to "yes", tells the Spam Bouncer to check the MAPS RSS Open Relay blacklist, which lists IP addresses associated with mail servers which are open relays, and through which spam has been sent at least once. A relay listed in the RSS blacklist has is not just an open relay; it is an open relay known to spammers which has been used to spam. The RSS blacklist is generally considered less aggressive than the ORBS blacklist, although they both list open relays. As such, it should block less legitimate email than ORBS will, but will also miss spam sent through relays which have not been abused previously.

This variable is set to no by default. To enable RSS relay testing, set it to yes.

SENDMAIL

The full path to your system's copy of sendmail. The default value is /usr/sbin/sendmail, which will work on some systems, but not all. On almost all systems which use sendmail, however, this variable is set correctly as a global default by the system administrators. It does not hurt to check and be sure, though. If SENDMAIL is not set correctly, the Spam Bouncer will be unable to send any autoreplies.

SPAMFOLDER

Where to store messages tagged as spam by the filter. If you want to just delete spam, set SPAMFOLDER to /dev/null. If you want to put the stuff in a backup folder, set SPAMFOLDER to a filename, perhaps spam.incoming. POP mail users whose client programs have the ability to filter mail into separate folders (like Eudora and Pegasus mail) can also set this to DEFAULT, and let their mail filters sort it into the trash folder or a special spam folder, if they want to engage in some spam tracking. :) Users of MAILDIR may set BLOCKFOLDER to a directory rather than a filename, or you may forward this email to a different address using normal sendmail syntax.

New users should set this to a folder, not to /dev/null, until you're sure everything is working properly.

SPAMREPLY

How to handle mail which the filter tags as definitely spam, and which should contain no valid mail whatsoever. Valid values are SILENT, which simply files the mail in the SPAMFOLDER; BOUNCE, which sends a simulated MAILER-DAEMON bounce message to the spammer in hopes that he will think your address is no good and remove it from his list; COMPLAIN, which sends a complaint and copy of the spam to the spammer's postmaster for spammers which the Spam Bouncer knows about and has this information, and in most cases also the upstream ISPs; and BOTH, which (not surprisingly) both sends a bounce and complains.

New users should set this to SILENT until they're sure everything is working properly.

TEST

A variant of Unix test program, a small program which looks for a file or directory and reports whether it exists or not. This is set to "test" by default, since this program is normally found on the system path.

If NOBOUNCE and LEGITLISTS are working on your system, there is no need to set this variable. If NOBOUNCE is not working, set this variable to point directly to your system's test program.

THISISP

Tells the Spam Bouncer the domain name of your domain or ISP. This can be useful when you have a private domain which is different from the domain your mail server uses, as many people using an ISP will. This is set to ${HOST} by default; if your private domain is different from your ISP, set this variable to your private domain.

TURKISH

Set TURKISH=yes if you receive email in Turkish. Otherwise leave it set to no (the default), and the Spam Bouncer will send any email in this language to the BLOCKFOLDER.

After setting the variables in your .procmailrc, add this line to your .procmailrc file at the point where you want to filter your mail for spam:

     INCLUDERC=${SBDIR}/sb.rc

This line should appear after recipes for mail you don't want to filter for spam and before recipes for mail you do want to filter for spam. Users of procmail.rc will have the correct lines in the correct location already, and will just need to uncomment whichever one they want to use.

Return to Table of Contents

Special Instructions for Eudora and Other POP Mail Clients

Users who get their mail using Eudora, Pegasus Mail, or another POP mail client which can filter mail by headers will need to set up their filters to look for the following headings:

X-SBClass: Admin

This header indicates mail sent to the ADMINFOLDER. You should create a folder for Admin mail on your client program, and then set your client program's filter to look for this header and filter mail which has it into the Admin folder.

X-SBClass: Blocked

This header indicates mail flagged as probable spam, but not certainly so. Create a folder for Blocked mail and set your client program's filters to put mail with this header into the Blocked Mail folder.

X-SBClass: Bulk

This header indicates mail flagged as bulk mail which is probably legitimate, such as that from known opt-in mailing lists or sent using known legitimate mailing list software, and which passed spam filtering. I recommend creating a separate folder for such mail, though, since that will make it easier to spot personal email, which is usually more important and should get priority.

X-SBClass: OK

This header indicates personal email which passed the spam checks. Set your client program's filters to put this mail in the normal incoming folder.

X-SBClass: Spam

This header indicates mail flagged as definitely spam. Most POP users will simply set the SpamBouncer to delete this mail outright. If you have set the SpamBouncer to deliver it to your POP mail account, though (perhaps because you want to learn more about spam), it will arrive with this header. Create a folder for Spam and set your POP client's program filters to put mail with this header in the Spam folder.

Return to Table of Contents

Upgrading the Spam Bouncer

Upgrading is easy. You just check the "What's New" notice to see if there are any new variables you should set or features you should be aware of, and then ftp the new version (or grab it with your WWW browser) and copy it over the old version. If you prefer, you can subscribe to the SpamBouncer Updates mailing list to get automatic notifications of updates via email. The mailing list is described in the next section.

That's all there is to it.

The Spam Bouncer should be upgraded regularly -- weekly if you are using it with SPAMREPLY set to COMPLAIN and monthly otherwise. Spammers move around a lot. Prolific spammers tend to get disconnected quite a bit, even by spam-friendly providers, because they cause their providers so much trouble. This means that the complaint addresses in the Spam Bouncer's complaint lists must be updated constantly or complaints will go to the wrong place.

Providers get annoyed when they get complaints about a problem they've already fixed, or at least done everything they can to fix. Once they've kicked a spammer off their system, there is very little else they can do, and sending complaints to them just wastes their time and resources.

I do my part by updating the addresses, but that helps only if you do yours by keeping your copy of the Spam Bouncer up to date.

So, if you can't upgrade frequently or don't want to bother updating all the time, please set SPAMREPLY and BLOCKREPLY to SILENT. That way you'll still get the benefits of the filter, but you won't risk causing trouble for an ISP that has already kicked its spammers off.

In addition, today's rogue ISP may be tomorrow's good guys. An example of that is erols.com, which a few years ago was the source of a huge amount of spam and which today is one of the leaders in the fight against it. (Erols also has one of the most entertaining "abuse@" people in the business -- Afterburner.) I regularly review the sites on the blocked list and retire those who have adopted and enforced solid no-spamming policies. That reduces the size of the filter and the resources it takes while keeping it as efficient as possible.

So, please keep up to date! :)

Return to Table of Contents

How to Troubleshoot and Report Trouble

If you are having trouble with the Spam Bouncer, first please make sure you:

• Installed it according to the instructions, and particularly set your Procmail variables according to instructions.
• Have the Unix file permissions for your copy of the Spam Bouncer set properly. As long as the file owner has read, write and execute privileges, and has execute privileges to the directory in which it is located, all should be well.
• Are running Procmail 3.10 or later.
• Included at least one email address in your nobounce file, if you have a nobounce file, and do not have any blank lines in your nobounce file.

The Spam Bouncer is set up to avoid replying to bounced messages and autoreplies to its own bounces, but some spammers set their adminstrative accounts to autoreply to spam complaints and misconfigure their autoresponders to remove the "X-Loop" header, which should NEVER be removed by any autoreply script. In general, it is not a good idea to autoreply to mail from administrative accounts at all, so the Spam Bouncer is set up to filter it out first.

Please report spam which the Spam Bouncer does not catch to <spamtrap@spambouncer.org> so that I can modify the Spam Bouncer to catch it. Many spammers have gotten wise to me -- I'm on their remove lists even if they won't put you or others there. <wry grin> So I depend on my users to keep me up-to-date on what kind of spam is out there.

Report any problems to the author at spamtrap@spambouncer.org, and she'll get to work on fixing them ASAP.

Return to Table of Contents

The SpamBouncer Updates Mailing List

Updates to the SpamBouncer are announced via the SpamBouncer Updates mailing list, in addition to this Web page. The list is a low-volume announcements-only list that gets less than one email per week. I keep it this way so that people who hate getting spammed :) can subscribe without being overwhelmed with email. (If you want to discuss spam and how to fight it, I recommend the SPAM-L mailing list, described in the following section.)

The SpamBouncer Updates list runs on a Majordomo list server, a widely used mailing list management program. If you are unfamiliar with Majordomo, the instructions below should explain how to subscribe to and unsubscribe from the SpamBouncer Updates list. For more information on Majordomo and how to use it, refer to Majordomo Mailing List User Commands at the University of Rochester. For more information on Majordomo itself and how it works, refer to the Majordomo FAQ.

I must approve all subscriptions to the mailing list, so I suggest you send me email letting me know who you are and why you are subscribing before you subscribe to the list. :) (Where possible, I would prefer to keep spammers off of it.)

Subscribing

1. Send email to updates-request@lists.spambouncer.org, with any subject line you like (the list server will ignore it), and the following text in the message body:

subscribe <your email address>
end

This will tell the Majordomo list server that you want to subscribe to the SpamBouncer Updates mailing list.

The list server will then send you two messages: a notice to the email address from which your subscription was sent and a confirmation message to the email address that you asked to have subscribed to the list. The notice explains that the subscription must be confirmed from the address that was subscribed to the list. The confirmation message asks you to copy a line of text from it, paste that line of text in a new email, and send the email back to the list server. The message will read like this:

Someone (possibly you) has requested that your email address be added to or deleted from the mailing list "spambouncer-updates@aziz.devnull.net".

If you really want this action to be taken, please send the following commands (exactly as shown) back to "Majordomo@aziz.devnull.net":

auth 3de6896e subscribe spambouncer-updates someone@example.com

If you do not want this action to be taken, simply ignore this message and the request will be disregarded.

The text you need to copy is the line beginning with auth. The jumble of letters and numbers after auth is called a token, and will be different for each person. Because it is different for each person, if you send back the exact token, the mailing list knows you really asked to subscribe. That prevents others from subscribing you to the mailing list without your permission.

2. Copy the line of text beginning with auth and containing the token from the message the Majordomo list server sends to you into a new email, and send the new email back to updates-request@lists.spambouncer.org.

! CAUTION!

Do NOT copy the line of text from the example shown above -- it is just an example and will not work for you. You must copy the line of text from the confirmation email sent to you. DO NOT email the confirmation back to majordomo@aziz.devnull.net -- this is a different list and this will not work. Send your confirmation message to updates-request@lists.spambouncer.org only. (I am getting this fixed.)

If you followed these instructions correctly, the Majordomo list server will send you two more messages. The first is a short, machine-generated message showing that your subscribe command worked. The second is a message welcoming you to the SpamBouncer Upgrades list.

Unsubscribing

Send email to updates-request@lists.spambouncer.org, with any subject line you like (the list server will ignore it), and the following text in the message body:

unsubscribe <your email address>
end

This will tell the Majordomo list server that you want to unsubscribe from the SpamBouncer Updates mailing list. Majordomo will send you a message confirming that you have unsubscribed from the list. If you no longer have access to your old address, send me email and I will unsubscribe your old address manually.

Switching your Subscription to a Different Email Address

To switch your subscription to a new email address, you must unsubscribe your old address and subscribe the new one, following the instructions above.

Return to Table of Contents

Acknowledgments

First, I would like to thank Stephen van den Berg, the creator of procmail, for his wonderful tool. It is truly the friend of those who hate email spam and want it out of their lives. (It is also the friend of anyone who gets a lot of email.)

I would also like to thank the readers of the Procmail Mailing List for answering lots of often elementary questions, especially at the beginning, as I learned the program. I highly recommend the list for people who use the Spam Bouncer. You can subscribe at procmail-request@Informatik.RWTH-Aachen.DE.

Finally, I'd like to thank one of the best sets of users anyone ever had -- you guys do a superb job keeping me up to date on what spammers are doing. I couldn't do it without you, seriously.

These filters are the result of several years of work and learning about Procmail. I hope the results will be as useful to others as they have been to me.

Return to Table of Contents

---

SpamBouncer Home Page | Getting Started with Procmail | My Home Page

©1996-2001 by Catherine A. Hampton <ariel@tempest.boxmail.com>. All rights reserved.