We use Netscape Messaging Server 3.6 for our primary e-mail server. We make extensive use of the UBE filtering to filter out unwanted relay attempts, some viruses, spam and many other things. Out filter file is somewhere near 500 lines long, and trying to figure out why some stuff got caught is difficult. (Some things caught by the filters are rejected. But since rejecting to an invalid e-mail address results in more work for the postmaster, we drop much of it into a single account for analysis -- and usually much laughter. But I digress ...)
While working on another project using TCP Wrappers, I found the tcpdmatch application quite useful for testing the hosts.allow and hosts.deny files. For those unfamiliar, tcpdmatch allows you to feed in a particular service, such as in.ftpd, and a hostname or IP address and see if that IP would be permitted to access the service. For example:
might return this:
Pretty cool. That got me thinking about the possibility of creating such a testing app for the NMS filters. My thought would be to feed in the area of the header in question (such as To, From, Subject, sending IP, etc.) and the text of that field, and the app would look through the filters and tell you where, if anywhere, it matched. That way, we could look at an e-mail that's in our dumping account and figure out why it got there if it weren't already obvious. This would certainly help refine the filters where needed.
Does anyone know of a way to make this work? I was just starting to look through the original C code for tcpdmatch, but I'm not a C programmer, and I didn't want to mess around with too much before knowing if it were possible.
Thanks!!!!
While working on another project using TCP Wrappers, I found the tcpdmatch application quite useful for testing the hosts.allow and hosts.deny files. For those unfamiliar, tcpdmatch allows you to feed in a particular service, such as in.ftpd, and a hostname or IP address and see if that IP would be permitted to access the service. For example:
Code:
tcpdmatch -d in.ftpd 10.11.12.13might return this:
Code:
client: address 10.11.12.13
server: process in.ftpd
matched: /etc/hosts.deny line 1
access: deniedPretty cool. That got me thinking about the possibility of creating such a testing app for the NMS filters. My thought would be to feed in the area of the header in question (such as To, From, Subject, sending IP, etc.) and the text of that field, and the app would look through the filters and tell you where, if anywhere, it matched. That way, we could look at an e-mail that's in our dumping account and figure out why it got there if it weren't already obvious. This would certainly help refine the filters where needed.
Does anyone know of a way to make this work? I was just starting to look through the original C code for tcpdmatch, but I'm not a C programmer, and I didn't want to mess around with too much before knowing if it were possible.
Thanks!!!!