# This configuration file may be easy adapted for your environment.
# Please be careful with "rcvd1" event. Use this event only if your
# sentinel milter is on a second level of mail relays, i.e. behind
# of firewall. If you are going to run sentinel in a front, i.e. with
# sendmail that is talking with outside world directly, you might want
# to delete all "rcvd1" references. You can use "hosts" chapter in order
# to distinguish inbound/outbound traffic.
[global]
tmp:/var/tmp
log:/var/log/sentinel.log
debug:/var/log/sentinel.debug
user:smmsp
group:smmsp
max_nofiles:512
max_soconn:30

[headers]
X-PMG-Userid:	pmg:pmg,rcvd1:discard:/.*/i

X-Mailer:	xmlr1:xmlr1,rcvd1:discard:/WorldMerge|Extractor Pro|Floodgate Pro|Emailer Platinum.*Internet Marketing|BritecastMailer|CurrentMailer/i

Subject:	subj1:subj1,rcvd1:discard:/adult|porn|puss(y|ies)| ass |sex|fuck|lesbian|viagra|penis/i
		subj2:subj2,rcvd1:discard:/^adv(:| )|(save|more) money|save up to|stop smoking|lose weight|weight loss|hair growth|reverse aging/i
		subj3:subj3,rcvd1:discard:/mortgage (loan|rate|payment|interest)|(refinance your|second|no cost) mortgage|(home|equity) loan/i
		subj4:subj4,rcvd1:discard:/congratulation.*you won|you won \$[0-9]+|(earn|serious) cash|(we pay|help with) your bill/i
		subj5:subj5,rcvd1:discard:/are you in dept|have tax problem|free!|no obligation!/i
		subj6:subj6,rcvd1:discard:/.* {9,}\[[A-Za-z0-9]{3,}\]$/i
		subj7:subj7,ordb:rblpfx:/^RBL:/in

From:	from1:from1:discard:/somebody@home.com/i
	from2:from2:null:/@mycompany\.com/in
	from3:from3:discard:/^[0-9]+@(aol|msn|juno)\.com/i
	from4:from4:discard:/girls|amuro\.net|jobseekernews\.com|jobseekernews\.net|jobfly\.com|supportgate\.com/i

To:	to1:to1,rcvd1:discard:/undisclosed\.recipients|friend@|@public\.com/i

Received:	rcvd1:rcvd1,subj7:ordb(addhdrordb):/^from .*\(.*\[([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)\].*\).*by mx0[12]+\.mycompany\.com/i
		rcvd2:rcvd2,from2:access:/^from .*\((.*\.nas[0-9]+\..*\.qwest\.net) \[.*\]\).*by mx0[12]+\.mycompany\.com/i
		rcvd3:rcvd3,from2:access:/^from .*\(([0-9]+-[0-9]+-[0-9]+-[0-9]+\.customer\..*\.currentmail\.com) \[.*\]\).*by mx0[12]+\.mycompany\.com/i
		rcvd4:rcvd4,from2:access:/^from .*\(([0-9]+-[0-9]+-[0-9]+-[0-9]+\.hinet-ip\.hinet\.net) \[.*\]\).*by mx0[12]+\.mycompany\.com/i
		rcvd5:rcvd5:discard:/^from .*\[192\.25\.139\.1\].*by/i
		rcvd6:rcvd6:discard:/^from .*(aweber\.com|xasource\.com|listserv\.versus\.com)/i

EnvelopeRcpt:	rcpt1:rcpt1:accept:/(autoparser|postmaster|abuse)@mycompany\.com/i

[attachments]
att01:att01,rcvd1:virus:/\.ade$/i
att02:att02,rcvd1:virus:/\.adp$/i
att03:att03,rcvd1:virus:/\.bas$/i
att04:att04,rcvd1:virus:/\.bat$/i
att05:att05,rcvd1:virus:/\.chm$/i
att06:att06,rcvd1:virus:/\.cmd$/i
att07:att07,rcvd1:virus:/\.com$/i
att08:att08,rcvd1:virus:/\.cpl$/i
att09:att09,rcvd1:virus:/\.crt$/i
att10:att10,rcvd1:virus:/\.exe$/i
att11:att11,rcvd1:virus:/\.hlp$/i
att12:att12,rcvd1:virus:/\.hta$/i
att13:att13,rcvd1:virus:/\.inf$/i
att14:att14,rcvd1:virus:/\.ins$/i
att15:att15,rcvd1:virus:/\.isp$/i
att16:att16,rcvd1:virus:/\.js$/i
att17:att17,rcvd1:virus:/\.jse$/i
att18:att18,rcvd1:virus:/\.lnk$/i
att19:att19,rcvd1:virus:/\.mdb$/i
att20:att20,rcvd1:virus:/\.mde$/i
att21:att21,rcvd1:virus:/\.msc$/i
att22:att22,rcvd1:virus:/\.msi$/i
att23:att23,rcvd1:virus:/\.msp$/i
att24:att24,rcvd1:virus:/\.mst$/i
att25:att25,rcvd1:virus:/\.pcd$/i
att26:att26:virus:/\.pif$/i
att27:att27,rcvd1:virus:/\.reg$/i
att28:att28:virus:/\.scr$/i
att29:att29,rcvd1:virus:/\.sct$/i
att30:att30,rcvd1:virus:/\.shs$/i
att31:att31,rcvd1:virus:/\.shb$/i
att32:att32,rcvd1:virus:/\.url$/i
att33:att33:virus:/\.vb$/i
att34:att34:virus:/\.vbe$/i
att35:att35:virus:/\.vbs$/i
att36:att36,rcvd1:virus:/\.wsc$/i
att37:att37,rcvd1:virus:/\.wsf$/i
att38:att38,rcvd1:virus:/\.wsh$/i

[mime types]
mime1:mime1:virus:/^application/x-javascript$/i

[body]
body1:body1,rcvd1:quarantine:/<script|<object|<iframe|<input name=submit type=submit value=" *Submit By E-Mail *">/i
body2:body2,rcvd1:quarantine:/pornography|(porno|adult) (show|site|video|club)|puss(y|ies)|lesbian|viagra|penis|love life|sex (show|life)|(asian|naked).{1,20}girl|erotic.{1,10}stor(y|ies)|girl.{1,30}naked/i
body3:body3,rcvd1:quarantine:/Bill.{0,10}1618.{0,10}TITLE.{0,10}III|this is not a spam email/i
body4:body4,rcvd1:quarantine:/100% GUARANTEED|MILLION DOLLAR| SINGLE |INCREASE SALES/
body5:body5,rcvd1:quarantine:/online business opportunities/i
body6:body6,rcvd1:quarantine:/e-*mail marketing/i
body7:body7,rcvd1:quarantine:/Trace anyone by social security number/i
body8:body8,rcvd1:quarantine:/International Executive Guild/i
body9:body9,rcvd1:quarantine:/LASER PRINTER SUPPLIES/i
body10:body10,rcvd1:quarantine:/NO MONTHLY FEE/i
body11:body11,rcvd1:quarantine:/NO SETUP FEE/i
body12:body12,rcvd1:quarantine:/YOU MUST BE AT LEAST 18 TO ENTER/i
body13:body13,rcvd1:quarantine:/money back guarantee/i
body14:body14,rcvd1:quarantine:/(enhance|increase) (the|your) (pleasure|sex)|(lift|firm) your breast/i
body15:body15,rcvd1:quarantine:/Get your FREE.{0,30}Phone!/i
body16:body16,rcvd1:quarantine:/(bulker|the banned|addresses on) CD/i
body17:body17,rcvd1:quarantine:/This a.?d is produced and sent out by/i
body18:body18,rcvd1:quarantine:/Unsolicited Commercial Electronic Mail Act/i
body19:body19,rcvd1:quarantine:/Replying to this email will not unsubscribe you/i
body20:body20,rcvd1:quarantine:/CLICK HERE TO (BE REMOVED FROM THIS MAILING|ORDER)/i
body21:body21,rcvd1:quarantine:/congratulation.{1,30}you won|you won \$[0-9]+|(we pay|help with) your bill/i
body22:body22,rcvd1:quarantine:/This message is a commercial advertisement/i
body23:body23,rcvd1:quarantine:/Dear Friend[:,]/
body24:body24,rcvd1:quarantine:/You have received this email because you are subscribed/i

[actions]
spam:reject:The message was classified as SPAM.
access:reject:Your relay ${1} is in our BlackHole List. Please contact postmaster@mycompany.com for any business related issues.
virus:reject:The attachment "$file" of the message was classified as unsafe.
ordb(rejectordb):rbl:${4}.${3}.${2}.${1}.relays.ordb.org.
ordb(addhdrordb):rbl:${4}.${3}.${2}.${1}.relays.ordb.org.
rejectordb:reject:Rejected according to ORDB Realtime Blackhole List for IP address ${1}.${2}.${3}.${4} (see http://ordb.org/lookup/?host=${1}.${2}.${3}.${4}). Please contact postmaster@mycompany.com in case any business related issues.
addhdrordb:addhdr:X-RBL: dubious source ${1}.${2}.${3}.${4} according to ORDB Realtime Blackhole List (see http://ordb.org/lookup/?host=${1}.${2}.${3}.${4})
rblpfx:chghdr:RBL: ${0}
analyze:addrcpt:dl-spam@mycompany.com
discard:discard
quarantine:quarantine:/var/spool/quarantine
accept:accept
null:null