summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin H. Johnson <robbat2@gentoo.org>2015-08-08 13:49:04 -0700
committerRobin H. Johnson <robbat2@gentoo.org>2015-08-08 17:38:18 -0700
commit56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch)
tree3f91093cdb475e565ae857f1c5a7fd339e2d781e /mail-filter/anomy-sanitizer/files
downloadgentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.bz2
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.zip
proj/gentoo: Initial commit
This commit represents a new era for Gentoo: Storing the gentoo-x86 tree in Git, as converted from CVS. This commit is the start of the NEW history. Any historical data is intended to be grafted onto this point. Creation process: 1. Take final CVS checkout snapshot 2. Remove ALL ChangeLog* files 3. Transform all Manifests to thin 4. Remove empty Manifests 5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$ 5.1. Do not touch files with -kb/-ko keyword flags. Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'mail-filter/anomy-sanitizer/files')
-rw-r--r--mail-filter/anomy-sanitizer/files/anomy.conf207
-rw-r--r--mail-filter/anomy-sanitizer/files/sample2_mailfilter.sh83
-rw-r--r--mail-filter/anomy-sanitizer/files/sample_mailfiler.sh76
3 files changed, 366 insertions, 0 deletions
diff --git a/mail-filter/anomy-sanitizer/files/anomy.conf b/mail-filter/anomy-sanitizer/files/anomy.conf
new file mode 100644
index 000000000000..f7c45cd973d2
--- /dev/null
+++ b/mail-filter/anomy-sanitizer/files/anomy.conf
@@ -0,0 +1,207 @@
+# Example configuration file for Anomy Sanitizer
+#
+# Thiemo Kellner, thiemo@thiam.ch, 2003-05-29
+# Based on http://advosys.ca/papers/postfix-filtering.html,
+# Advosys Consulting Inc., Ottawa
+#
+# Works with Anomy Sanitizer revision 1.60
+
+
+ # Warn user about unscanned parts, etc.
+ feat_verbose = 1
+
+ # Inline logs: 0 = Off, 1 = Maybe, 2 = Force
+ feat_log_inline = 1
+
+ # Print log to standard error: 0 = Off, 1 = On
+ feat_log_stderr = 1
+
+ # Don't use XML format for logs.
+ feat_log_xml = 0
+
+ # Omit trace info from logs.
+ feat_log_trace = 0
+
+ # Don't add any scratch space to part headers.
+ feat_log_after = 0
+
+ # Enable filename-based policy decisions.
+ feat_files = 1
+
+ # Force all parts (except text/plain and
+ # text/html parts) to have file names: 0 = Off, 1 = On
+ feat_force_name = 1
+
+ # Replace all boundary strings with our own
+ # NOTE: Always breaks PGP/MIME messages!
+ feat_boundaries = 0
+
+ # Protect against buffer overflows and null values.
+ feat_lengths = 1
+
+ # Defang incoming shell scripts.
+ feat_scripts = 1
+
+ # Defang active HTML content.
+ feat_html = 1
+
+ # Web-bugs are allowed.
+ feat_webbugs = 0
+
+ # Don't scan PGP signed message parts: 0 = Don't scan (???)
+ feat_trust_pgp = 0
+ msg_pgp_warning = WARNING: Unsanitized content follows.\n
+
+ # Sanitize inline uuencoded files.
+ feat_uuencoded = 1
+
+ # Sanitize forwarded messages
+ feat_forwards = 1
+
+ # Set to 0 if going productive (This isn't a test-case configuration.)
+ feat_testing = 1
+
+ # Fix invalid MIME, if possible.
+ feat_fixmime = 1
+
+ # Don't be excessively paranoid about MIME headers etc.
+ feat_paranoid = 0
+
+ # Advertisement to insert in each mail header:
+ header_info = X-Sanitizer: Anomy Sanitizer mail filter
+ header_url = 0
+ header_rev = 0
+
+
+ #
+ # Scoring
+ #
+
+ # Any message requring this many modifications
+ # will cause the sanitizer to return a non-zero
+ # exit code after processing the entire message.
+ # To disable set to 0.
+ score_bad = 100
+ #score_panic = 0
+
+ msg_file_drop = \n*****\n
+ msg_file_drop += NOTE: An attachment named %FILENAME was deleted from
+ msg_file_drop += this message because it contained a (windows) executable
+ msg_file_drop += or other potentially dangerous file type.
+ msg_file_drop += If you really need this attachment, have it re-sent
+ msg_file_drop += encapsulated, e.g. in a zip or tgz archive or contact your
+ msg_file_drop += mail system administrator.
+
+ #
+ # You may need to increase the following if you have a very
+ # complex configuration split between multiple files.
+ #
+ # Thiemo Kellner, thiemo@thiam.ch, 2003-05-31
+ # max_conf_recursions does not work with 1.60
+ #max_conf_recursions = 5 # The default is 5.
+ #
+ # Create temporary or saved files using this template.
+ # An attachment named "dude.txt" might be saved as
+ #
+ # /var/quarantine/att-dude-txt.A9Y
+ #
+ # Note: The directory must exist and be writable by
+ # the user running the sanitizer.
+ # (supposedly: $F -> file name, $$$ -> three arbitrary characters)
+ file_name_tpl = /var/spool/sanitizer/att-$F.$$$
+
+ # We have three policies, in addition to the default which is
+ # to defang file names.
+ #
+ file_list_rules = 3
+ file_default_policy = defang
+ file_default_filename = unnamed.file
+
+ # Delete obviously executable attachments. This list is
+ # incomplete! This is a perl regular expression, see "man
+ # perlre" for info. The (?i) prefix makes the regexp case
+ # insensitive.
+ #
+ file_list_1 = (?i)(winmail.dat)|
+ file_list_1 += (\.(exe|com|vb[se]|dll|ocx|cmd|bat|pif|lnk|hlp|ms[ip]|reg|sct
+ file_list_1 += |inf|asd|cab|sh[sb]|scr|cpl|chm|ws[fhc]|hta|vcd|vcf|eml|nws))$
+ file_list_1_policy = drop
+ file_list_1_scanner = 0
+
+ # Scan WinWord and Excel attachments with built-in macro scanner.
+ # We consider anything exceeding the score of 25 to be dangerous,
+ # and save it in the quarantine.
+ #
+ file_list_2 = (?i)\.(doc|dot|xls|xlw)$
+ file_list_2_policy = accept:accept:save:save
+ file_list_2_scanner = 0:1:2:builtin/macro 25# Do not log to STDERR:
+
+ # Allow file types considered "safe" (DO NOT JUST TRUST THIS LIST!)
+ file_list_3 = (?i)\.(
+ # Plain ASCII formats:
+ file_list_3 += txt|rtf|csv|dxf|htm|[sp]?html?|xml|xslt?|dtd|css|sgml
+ # PostScript (like) formats:
+ file_list_3 += |pdf|e?ps
+ # Word processor and document formats:
+ file_list_3 += |doc|dot|kwd|stw
+ # Spreadsheets:
+ file_list_3 += |xls|xlw|xlt|wk[1-4]|stc|ksp|gnumeric
+ # Presentation applications:
+ file_list_3 += |ppt|pps|pot|kpr|chrt
+ # Type setting formats:
+ file_list_3 += |dvi|texi?|tfm|txi|texinfo
+ # Flow charting:
+ file_list_3 += |flw
+ # Bitmap graphic files (maybe some are actually vector graphic formats):
+ file_list_3 += |jpe?g|gif|png|tiff?|bmp|psd|pcx|xcf|pat|pix|pnm|sgi|snp|ras|tga
+ file_list_3 += |xwd|xpm|dib|rle|cal|cas|pat|bmf|cel|cex|cgm|ico|img|jfi|jif|raw
+ file_list_3 += |crw|sun
+ # Vector graphics and diagramming:
+ file_list_3 += |vsd|drw|cdr|swf|pct|pict|kpm|kon
+ # Multimedia:
+ file_list_3 += |mp[23]|avi|mpe?g|mov|ram?|midi?|ogg|aiff?|au|snd|wav
+ # Archives:
+ file_list_3 += |zip|g?z|rar|tgz|t?bz2|tar|sit|sea|arc
+ # Package formats:
+ file_list_3 += |rpm|deb
+ # Others:
+ file_list_3 += |kfo
+ # Source code:
+ file_list_3 += |[ch](pp|\+\+)?|s|inc|asm|patch|java|php\d?|jsp|bas|ebuild)
+ file_list_3_policy = accept
+ file_list_3_scanner = 0
+
+ # Any file type not listed above gets renamed to prevent
+ # the mail client from auto-executing it.
+
+ #
+ # More sample file lists
+ #
+ # Scan mp3 files for Evil Viruses, using the imaginary mp3virscan
+ # utility. Always define FOUR potential policies, which depend on the
+ # exit code returned by the scanner. Which code means what is
+ # defined in the scanner line, which must contain THREE entries.
+ # The fourth policy is used for "anything else".
+ #
+ # "accept" if the file is clean (exit status 0 or 1)
+ # "mangle" if the file was dirty, but is now clean (2 or 4)
+ # "drop" if the file is still dirty (66)
+ # "save" if the mp3virscan utility returns some other exit code
+ # or an error occurs.
+ #
+ #file_list_4 = (?i)\.(mp3|mp2|mpg)$
+ #file_list_4_policy = accept:mangle:drop:save
+ #file_list_4_scanner = 0,1:2,4:66:/path/to/mp3virscan -opt -f %FILENAME
+
+ # Archives and scriptable stuff - virus scan these.
+ # NOTE: There must be THREE groups of exit codes and FOUR policies,
+ # - the first three match the code groups, the fourth is default.
+ #
+ #file_list_5_scanner = 0:5:3,4:/usr/local/bin/avp.sh %FILENAME
+ #file_list_5_policy = accept:accept:save:save
+ #file_list_5 = (?i)\.(xls|d(at|oc)|p(pt|l)|rtf|[sp]?html?
+ #file_list_5 += |class|upd|wp\d?|m?db
+ #file_list_5 += |z(ip|oo)|ar[cj]|lha|[tr]ar|rpm|deb|slp|tgz
+ #file_list_5 += )(\.g?z|\.bz\d?)*$
+
+
diff --git a/mail-filter/anomy-sanitizer/files/sample2_mailfilter.sh b/mail-filter/anomy-sanitizer/files/sample2_mailfilter.sh
new file mode 100644
index 000000000000..3448d0ac0ea2
--- /dev/null
+++ b/mail-filter/anomy-sanitizer/files/sample2_mailfilter.sh
@@ -0,0 +1,83 @@
+#!/bin/sh
+#
+# spamassassin
+#
+# Simple filter to plug SpamAssassin only
+# into the Postfix MTA, using the spamc / spamd
+# daemon version of SpamAssassin.
+#
+# (Should result in higher performance on busy servers)
+#
+# NOTE: spamd must be running before using this script!
+#
+# For use with:
+# Postfix 20010228 or later
+# SpamAssassin 2.42 or later
+#
+############
+# #
+# UNTESTED #
+# #
+############
+
+
+# VARIABLES
+# ---------
+
+# File locations
+# (CHANGE AS REQUIRED TO MATCH YOUR SET-UP)
+INSPECT_DIR="/var/spool/sanitizer"
+#INSPECT_DIR="/var/spool/filter"
+SENDMAIL="/usr/lib/sendmail -i"
+ANOMY="/usr/share/anomy-sanitizer"
+ANOMY_BIN="${ANOMY}/bin/sanitizer.pl"
+ANOMY_CONF="/usr/share/anomy-sanitizer/anomy.conf"
+#ANOMY_LOG="/dev/null"
+ANOMY_LOG="/tmp/sanitizer.log"
+SPAMASSASSIN="/usr/bin/spamassassin"
+#SPAMASSASSIN_LOG="/dev/null"
+SPAMASSASSIN_LOG="/tmp/spamassassin.log"
+CAT="/bin/cat"
+
+# Messages
+UNABLE_TO_CD_INSPECTDIR="Impossible to change to ${INSPECT_DIR}"
+MSG_CONTENT_REJECTED="Message content rejected"
+
+# Exit codes from <sysexits.h>
+EX_TEMPFAIL=75
+EX_UNAVAILABLE=69
+
+# Users that execute different filters
+SPAMC_USER="sanitizer"
+
+export ANOMY
+
+
+# MAIN
+# ----
+
+cd ${INSPECT_DIR} || { echo ${UNABLE_TO_CD_INSPECTDIR} ; exit ${EX_TEMPFAIL}; }
+
+# Clean up when done or when aborting.
+trap "rm -f out.$$" 0 1 2 3 15
+
+# sanitizer only
+#${CAT} \
+# | ${ANOMY_BIN} ${ANOMY_CONF} 2>>${ANOMY_LOG} > out.$$ || \
+# { echo ${MSG_CONTENT_REJECTED}; exit ${EX_UNAVAILABLE}; }
+
+# sanitizer and SpamAssassin
+${CAT} \
+ | ${SPAMC} -f -u ${SPAMC_USER} 2>${SPAMASSASSIN_LOG} \
+ | ${ANOMY_BIN} ${ANOMY_CONF} 2>>${ANOMY_LOG} > out.$$ || \
+ { echo ${MSG_CONTENT_REJECTED}; exit ${EX_UNAVAILABLE}; }
+
+# SpamAssassin only
+#${CAT} \
+# | ${SPAMC} -f -u ${SPAMC_USER} 2>${SPAMASSASSIN_LOG} > out.$$ || \
+# { echo ${MSG_CONTENT_REJECTED}; exit ${EX_UNAVAILABLE}; }
+
+$SENDMAIL "$@" < out.$$
+
+exit 0
+
diff --git a/mail-filter/anomy-sanitizer/files/sample_mailfiler.sh b/mail-filter/anomy-sanitizer/files/sample_mailfiler.sh
new file mode 100644
index 000000000000..a258f4890ded
--- /dev/null
+++ b/mail-filter/anomy-sanitizer/files/sample_mailfiler.sh
@@ -0,0 +1,76 @@
+#!/bin/sh
+#
+# spamc.sh
+#
+# Simple filter to plug SpamAssassin only
+# into the Postfix MTA, using the spamc / spamd
+# daemon version of SpamAssassin.
+#
+# (Should result in higher performance on busy servers)
+#
+# NOTE: spamd must be running before using this script!
+#
+# For use with:
+# Postfix 20010228 or later
+# SpamAssassin 2.42 or later
+#
+
+
+# VARIABLES
+# ---------
+
+# File locations
+# (CHANGE AS REQUIRED TO MATCH YOUR SET-UP)
+INSPECT_DIR="/var/spool/sanitizer"
+#INSPECT_DIR="/var/spool/filter"
+SENDMAIL="/usr/lib/sendmail -i"
+ANOMY="/usr/share/anomy-sanitizer"
+ANOMY_BIN="${ANOMY}/bin/sanitizer.pl"
+ANOMY_CONF="/usr/share/anomy-sanitizer/anomy.conf"
+#ANOMY_LOG="/dev/null"
+ANOMY_LOG="/tmp/sanitizer.log"
+SPAMC="/usr/bin/spamc"
+#SPAMC_LOG="/dev/null"
+SPAMC_LOG="/tmp/spamc.log"
+CAT="/bin/cat"
+
+# Messages
+UNABLE_TO_CD_INSPECTDIR="Impossible to change to ${INSPECT_DIR}"
+MSG_CONTENT_REJECTED="Message content rejected"
+
+# Exit codes from <sysexits.h>
+EX_TEMPFAIL=75
+EX_UNAVAILABLE=69
+
+# Users that execute different filters
+SPAMC_USER="sanitizer"
+
+export ANOMY
+
+
+# MAIN
+# ----
+
+cd ${INSPECT_DIR} || { echo ${UNABLE_TO_CD_INSPECTDIR} ; exit ${EX_TEMPFAIL}; }
+
+# sanitizer only
+#${CAT} \
+# | ${ANOMY_BIN} ${ANOMY_CONF} 2>>${ANOMY_LOG} \
+# | ${SENDMAIL} "$@" || \
+# { echo ${MSG_CONTENT_REJECTED}; exit ${EX_UNAVAILABLE}; }
+
+# sanitizer and SpamAssassin
+${CAT} \
+ | ${SPAMC} -f -u ${SPAMC_USER} 2>${SPAMC_LOG} \
+ | ${ANOMY_BIN} ${ANOMY_CONF} 2>>${ANOMY_LOG} \
+ | ${SENDMAIL} "$@" || \
+ { echo ${MSG_CONTENT_REJECTED}; exit ${EX_UNAVAILABLE}; }
+
+# SpamAssassin only
+#${CAT} \
+# | ${SPAMC} -f -u ${SPAMC_USER} 2>${SPAMC_LOG} \
+# | ${SENDMAIL} "$@" || \
+# { echo ${MSG_CONTENT_REJECTED}; exit ${EX_UNAVAILABLE}; }
+
+exit 0
+