#!/usr/bin/zsh -- # Program that delays mail files, to catch bulk-spam before it is send. # This script spools the antiSPAM-delay directory. # # Program released under the terms of the GNU GPL3. # This is free software. You are free to copy and redistribute. # No warranty. See http://www.gnu.org for license details. # (C) 2007 Jos Boersema # # Usage: prog MAIL_FILE [exim4in|headers|RECIPIENTS] # Manual: # Configure user-variables # -> mkdir a spool-directory for spam-delay, # same as in maildlay-input # -> point REAL_MAIL_SPOOL to the spool directory that should # receive the mail-file after the delay # -> make /etc/maildlay # -> list users that should have all their mails # send through without additional delay. # -> write ``zerodelay:username'' in it, once for each user # > cat /etc/maildlay # zero-delay:hans # zero-delay:grietje # (...) # -> Decide on a delay-speed: DELAY_SPEED # Test: point REAL_MAIL_SPOOL to a test directory, send in mail # files using maildlay-input, then run maildlay-spool to # see if delays are correctly reduced and send to the # test directory. # Operation: cron job # The interval at which this program is run determines # the delay per recipient. The job should probably only # begin again after it has ended. Typically the job # would run per 2 minutes, 5 minutes 15 minutes, etc. # # Example: with 5 minutes, a mail with 3 recipients is # held for 10 to 15 minutes prior to sending, if # delay-speed is "1". If delay-speed is "3" the delay # is 5 minutes or less. # If a user sends 1000 mails, a delay-speed of 10 means # means the mail goes out at 10 mails per 5 minutes # if the mails are individually stored. If it is one # mail with a lot of recipients, then that mail waits # until the end of 1000 mails / 10 mails-a-job * 5 # minutes a job = 500 minutes = 8 hours. # When the maildlay-report program runs every 2 hours # with a report-limit of 500 mails per user, the report # is send in at least 6 hours before all mails have been # send out. When there is one mail with a lot of # recipients, they are all not yet send out before reported. # (When the bulk is legitimate, the user can get stored # in /etc/maildlay as trusted.) ######################################################################## ####### USER VARIABLES ############ ######################################################################## # Set this to a directory that acts as a temporary bulk-spam delay buffer. #SPAM_DELAY_SPOOL="/var/spool/mail/antispamdelay" SPAM_DELAY_SPOOL="/tmp/antispamdelay" # Set this to the real mail spool, where the mails should go after # they went through the delay. #REAL_MAIL_SPOOL="/var/spool/exim4/input" REAL_MAIL_SPOOL="/tmp/input" # Set to with how many number-of-recipients, the mail moves through # to the point of moving out of the delay-spool per call of this prog. # Set to 1 means a mail with 8 recipients gets reduced 7, 6, 5, ... # Set to 2: 6, 4, 2 ... DELAY_SPEED="1" ######################################################################## ####### END ############ ######################################################################## cd ${SPAM_DELAY_SPOOL} #change directory #Do one spool action per user ... for USERGO in $( ls * | sed -e 's/_Bye__.*//;s/_[0-9]*__.*//;' | uniq ) do # priviledged users # Users that are trusted, for instance users that are known to send # legitimate bulk mail and users that need quick e-mail. if test -n "$( grep "zero-delay:${USERGO}" /etc/maildlay )" then for FILE in $( ls ${SPAM_DELAY_SPOOL}/${USERGO}_* ) do ORIGFILE=$( echo ${FILE} | sed -e 's/.*_[0-9]*__//;s/.*_Bye__//;' ) mv "${FILE}" "${REAL_MAIL_SPOOL}/${ORIGFILE}" done fi #Move each file recipient-number one step down, 0 = `Bye' # .. this loop is only taken once if at all .. for FILE in $( ls ${SPAM_DELAY_SPOOL}/${USERGO}_[0-9]*__* | head -1 ) do DELAYN=$( echo "${FILE}" | sed -e 's/__.*//;s/.*_//;' ) DELAYN=$(( ${DELAYN} - ${DELAY_SPEED} )) #can get below zero, -N ORIGFILE=$( echo ${FILE} | sed -e 's/.*_[0-9]*__//;' ) FROMUSER=$( echo ${FILE:t} | sed -e 's/_.*//' ) if test "0" = "${DELAYN}" then #reached 0 mv "${FILE}" "${REAL_MAIL_SPOOL}/${ORIGFILE}" elif test "-" = "${DELAYN[1]}" then #reached below zero mv "${FILE}" "${REAL_MAIL_SPOOL}/${ORIGFILE}" else #reduce delay-count mv "${FILE}" "${FROMUSER}_${DELAYN}__${ORIGFILE}" fi done done