OR Filter 3.2 Manual. Draft. Copyright 2003, Martijn Jongen. All Rights Reserved Version : Ref. nr. : MhJ/ By : M.

Transcription

1 ! Copyright 2003, Martijn Jongen. All Rights Reserved Ref. nr. : MhJ/ By : M. Jongen

2 DOCUMENT COVER SHEET Project: Document: Reference number: Manual MhJ/ Version Date Description Author Approval Name Initials Concept M. Jongen Concept M. Jongen NO WARRANTIES OF ANY NATURE ARE EXTENDED BY THE DOCUMENT. Any product and related material disclosed herein are only furnished pursuant and subject to the terms and conditions of a duly executed license or agreement to purchase or lease equipment. The only warranties made, if any, with respect to the products described in this document are set forth in such license or agreement. Martijnjongen.com cannot accept any financial or other responsibility that may be the result of your use of the information in this document or software material, including direct, indirect, special or consequential damages. The information contained herein is subject to change without notice. Revisions may be issued to advise of such changes and/or additions. Ref-nr.: MhJ/ Page 2 of

3 Contents: 1. Introduction License Installation guide Supported operating systems In which situations will ORFilter work? Installation Configuration General Config Debuglevel SMTP Virtual Instance Username, password and company DNS Blacklist IP Blacklist IP Whitelist Spam Handling Rejection message Keyword filter Consonant check ORFilter on a relay server Uninstall Manual uninstall Ref-nr.: MhJ/ Page 3 of

4 1. Introduction At first, thank you for downloading and using ORFilter. When we all use spam filters, hopeful spammers find out there is no gain in sending spam, and stop doing it (very unlikely) This document is written as the user manual of ORFilter version 3.2 If you have any questions, suggestions or other comments, please post them into the forum at The homepage of ORFilter is License ORFilter does not require a license, its freeware. Donations however are appreciated! ORFilter took many many hours! If you use the product for more as 30 days, please make a donation. See for more details how to make a donation. Ref-nr.: MhJ/ Page 4 of

5 2. Installation guide 2.1 Supported operating systems Windows 2000 native SMTP or Exchange Server Windows 2003 native SMTP or Exchange Server Windows XP native SMTP server Other SMTP servers (as Exchange 5.5 or Linux based mail servers) by using an ORFilter relay server see chapter In which situations will ORFilter work? The IP / DNS based functionality of ORFilter will only work if ORFilter is installed on the first mail server in chain, which means that it must be the mail server that directly communicates with the internet, and is responsible for receiving mail. ORFilter is of no use when your mail is first intercepted by, for example, your ISP. In that case, the remote IP will always be the one from your ISP s mail server. 3.1 Installation Warning: If you ve used ORFilter in the past, but it s not installed anymore go to the registry and delete the HKEY_LOCAL_MACHINE\Software\martijnjongen\ORFilter key before starting the configuration application. If not, ORConfigurator will try to locate the previous used config files. If those files are not there anymore, the configuration program will fail. Thank you Slowrider to report this issue. Installation is a bit misleading term, ORFilter doesn t need to be installed, only registered with the SMTP server. This is how to do it: Download the ZIP file to your system. Extract all files to a directory of your choice. I suggest you use C:\ORFilter Start the ORConfigurator.exe program Make sure the SMTP Virtual server is correct for you (By default it is 1, see how to determine) Click File Enable ORFilter There will be a few popups Ref-nr.: MhJ/ Page 5 of

6 At this point ORFilter is registered. Before you do some basic configuration however, ORFilter will do very little. Ref-nr.: MhJ/ Page 6 of

7 4. Configuration ORFilter has several methods to recognize spam, each of these methods can be configured separately. The ORConfigurator application is the way to do this. This chapter will describe each tab in the application. Unlike the older version, changing the configuration doesn t require you to restart IISAdmin. As long as you use the configuration application, ORFilter knows about it and automatically reloads all configuration data (files and registry data) Configuration is stored in two places; registry and.conf files. 4.1 General Config There are a few options that are important; Debuglevel The debug level says something about the amount of information that is logged to the application event log (Windows Event Log Start Run Eventvwr). Debuglevel Description Event ID 0 Nothing is logged 1 Mail that is marked as spam is logged Mail that is not marked as spam is logged Each is logged as information as it arrives in ORFilter Even if a mail is not marked as spam, the mail s subject is changed to NL:<original subject>. NL is Not Listed so that you can see that ORFilter has processed the message No event in event log Ref-nr.: MhJ/ Page 7 of

8 4.1.2 SMTP Virtual Instance The SMTP virtual instance is the SMTP instance ORFilter binds to. By default this is 1. Only when you ve added SMTP virtual servers to your system, this is a different number. To know which virtual server you re running on, go to the SMTP virtual server properties and look at the path that logfiles are written to. See Figure 1 how to recognize the instance number. In this case it s 1 (also the default for the Default SMTP Virtual Server) Figure 1 Determine SMTP instance number Username, password and company Do I really have to write about this? Yes? Ok. Without filling in your name and you can t enable ORFilter. Ref-nr.: MhJ/ Page 8 of

9 4.2 DNS Blacklist Figure 2 DNS Blacklist tab The DNS Blacklist, here is it where ORFilter was started about. In the early days (before Exchange 2003) Microsoft ignored the existence of the RBL s. An up-to-date list of available servers and their status can be found at How DNS based RBL works is explained at You can add and remove as much servers as you want. Placing the # sign in front of the server name disables that entry. You can completely disable/enable DNS blacklists by selecting the Enabled checkbox. 4.3 IP Blacklist Figure 3 IP Blacklist tab When enabled, ORFilter will reject all messages originating from the listed IP addresses. Ref-nr.: MhJ/ Page 9 of

10 4.4 IP Whitelist Figure 4 IP Whitelist tab When enabled, ORFilter will accept all messages originating from the listed IP addresses. 4.5 Spam Handling Figure 5 Spam Handling tab The spam handling tabs let you configure what ORFilter should do with a mail that is considered to be spam (based on the various methods that ORFilter uses for this). ORFilter will always change the subject (except when you leave the Change the subject to field empty) with a prefix, so that if the mail is delivered to the intended recipient, the mail client can make his own selection. The What to do with the message itself has four options; 1. Do nothing, send the mail to the intended recipient, only change the subject 2. Deliver to dedicated mailbox for review. Enable this if you want a dedicated person to handle all spam. Hint: make a mail-enabled public folder, and send the spam to this folder. Ref-nr.: MhJ/ Page 10 of

11 To use this option, you must enter a valid address using SMTP notation sign) 3. Move to badmail folder. This moves the message to the SMTP bad mail folder. When you choose this option, you re responsible to clean up this folder once and a while! 4. Delete message. The message is completely deleted. Be careful with this option, there is no way to retrieve the mail once it is deleted. All spam filters, including ORFilter, make mistakes so that non-spam mail will be treated as spam! 4.6 Rejection message Figure 6 Rejection Message tab When enabled, ORFilter will notify the sender of the spam-mail that her/his message is blocked. This is important because sometimes legitimate mail is considered as spam. You can enter your own message and use three variables, <%subject%>,<%to%> and <%reason%>. Subject is the subject of the original message, To is the original recipient, and reason is the reason why the mail is rejected. Be sure to also enter an address, if you don t do this, the sender of the rejection message will be the original recipient. Most of the times real spam uses a fake address which results in a non-delivery message! Best is to use a dedicated mail address. Ref-nr.: MhJ/ Page 11 of

12 4.7 Keyword filter Figure 7 Keyword filter When enabled, ORFilter can check for forbidden keywords. Enter one word or combination per line. Adding many words (>1000) will have negative effect on performance since each message has to be checked for all words. 4.8 Consonant check Figure 8 Consonant Check Tab A consonant check is a new way of recognizing spam! There is no other product that has this capability (as far as I know). I should register patent on this. It s difficult to explain how it works, but basically it checks for uniqueness strings in messages. Spammers will add strings of random characters to to make the s unique. Consonant Ref-nr.: MhJ/ Page 12 of

13 Check will use just this to recognize spam, so doing the opposite of what the spammer want to achieve. As this check is new, please be careful. Don t delete messages unless you know your settings are effective. Also, I don t know how this works with foreign languages. With Dutch (my native) or English it works fine, as it probably will work fine for most west-european languages. To configure: The higher the number of Maximum consonants in row is, the harder it is to recognize spam. The higher the number of Ignore how many vowels is, the easier it is to recognize spam, but also the chance that non-spam mail is considered to be spam. There will always be combinations of consonants that are allowed, like vcd, and Add those combinations to the list. Ref-nr.: MhJ/ Page 13 of

14 5. ORFilter on a relay server There are a few good reasons to have ORFilter running on a relay server; You re server is running an older version of Exchange, or even a completely different SMTP mail server You re Exchange server is in your internal network, and you want an extra layer of security by placing a relay server in your DMZ... there can be many reasons to have a dedicated mail relay server See the figure below for how to do a basic setup of an internal relay server. There are a lot more configurations thinkable; this is just a simple variant. Figure 9 ORFilter on a dedicated server 5.1 Configure a Windows 2000 relay server To configure the ORFilter server so that it will relay mail for your domain to your internal server, follow the steps as described below. The screen dumps are based on Windows 2000 Professional, but the steps for other Windows versions 1 are more or less the same. 1 ORFilter will work on Windows 2000, Windows XP and Windows Server 2003 Ref-nr.: MhJ/ Page 14 of

15 Go to the SMTP Virtual Server using Computer Management and add a Domain Choose for a Remote domain Open the Properties of the newly created domain Ref-nr.: MhJ/ Page 15 of

16 Select Allow incoming mail to be relayed to this domain Select Forward all mail to smart host and fill in the internal IP address of your Exchange Server Now install ORFilter on your relay server and you re done! 6. Uninstall Uninstall is easy; Start the ORConfigurator application. Click File Disable ORFilter Manual delete all the files in your ORFilter folder 6.1 Manual uninstall If for some reason uninstall doesn t work (or you don t trust it and want to do it yourself), you can uninstall ORFilter manual. Open a command window Ref-nr.: MhJ/ Page 16 of

17 Go to your ORFilter folder Check if ORFilter is still registered by typing: cscript smtpreg.vbs /enum Remove ORFilter registration by typing: cscript smtpreg.vbs /remove 1 OnArrival ORFilter Unregister the ORFilter.dll by typing regsvr32 u orfilter.dll Remove your ORFolder Remove all registry entries listed under HKEY_LOCAL_MACHINE\Software\martijnjongen That s all. Ref-nr.: MhJ/ Page 17 of