# This is another sample configuration file for Sentinel that is sitting on
# an external mail relay. It also shows how can you use "hosts" chapter to
# separate incoming external SMTP traffic from an internal one. Let's say we
# don't care what we have from internal smtp connections, i.e. we are not
# going to filter them. Lets just filter incoming external traffic. You can
# use this sample as is with some minor changes for such rules as "haddr1" and
# actions spam/virus/dialup

[global]
tmp:/var/tmp
# Don't forget sentinel.log must be writeable for user:group below.
log:/var/log/sentinel.log
# Uncomment the string below if you are running Sentinel with option "-v[1-3]"
#debug:/var/log/sentinel.debug
user:smmsp
group:smmsp
max_nofiles:512
max_soconn:30

[hosts]
# Just accept everything from internal hosts without filtering
haddr1:haddr1:accept:/^(192\.168\.|172\.16\.|10\.)/
# The dialup users must send messages through the relays of their ISP
haddr2:haddr2:quarantine(dialup):/\.dialup\./i
# All another hosts should be looked up in ORDB database.
# The rule "haddr3" says: add extra header "X-RBL" only and only if we found this
# host in ORDB list and we didn't prefix "Subject" line before (it might be reply).
# You might consider "haddr4" rule if you want to reject "open relays".
haddr3:haddr3,subj1:ordb(addhdrordb):/(\d+)\.(\d+)\.(\d+)\.(\d+)/
# This rule says: reject connections for all "open relays"
#haddr4:haddr4:ordb(rejectordb):/(\d+)\.(\d+)\.(\d+)\.(\d+)/

[headers]
# the list of some mailers that are using by spamers
X-Mailer:	xmlr1:xmlr1:discard:/WorldMerge|Extractor Pro|Floodgate Pro|Emailer Platinum.*Internet Marketing|BritecastMailer|CurrentMailer|StormPost/i

# subject is very effective way to filter a lot of junk
Subject:	# the rule "subj1" is about to prefix a subject line if the sender's relay is
		# in ORDB database and if we didn't prefix it before (negative option "n").
		# "ordb" event will be triggered by the rule "haddr3" if the relay is in ORDB list.
		subj1:subj1,ordb:rblpfx:/^RBL:/in
		# the rules subj2 - subj9 are just for to filter some porno/adv junk
		subj2:subj2:quarantine(spam):/adult|porn|puss(y|ies)|(^|\s)ass($|\s)|fuck|sex|bitch|lesbian|viagra|penis|gay|love life|breast enhance/i
		subj3:subj3:quarantine(spam):/^adv[\s:]|\*adv\*|(save|more) (money|\$\$\$)|save up to|(stop|quit) smoking|(lose|gain) (weight|[\d.]{1,5}(lbs| pounds))|weight (loss|gain)|hair (growth|loss)|reverse aging/i
		subj4:subj4:quarantine(spam):/mortgage (loan|rate|payment|interest)|(refinance your|second|no cost) mortgage|(home|equity) loan|real estate/i
		subj5:subj5:quarantine(spam):/congratulation.*(you won|your prize arrive)|you won \$\d+|(earn|serious|need extra) (cash|money)|(we pay|help with) your bill|win a car|need a (new car|credit card).*\?/i
		subj6:subj6:quarantine(spam):/are you in de[pb]t|have tax problem|free!|no obligation!|(do you want|send you) a free|online game|print for free.*!/i
		subj7:subj7:quarantine(spam):/\s{3,}\[\w{3,}\]$/i
		subj8:subj8:quarantine(spam):/Get .*(for just \$\d+|Your FREE Credit|\$\d+ cash)!|Up to \d+% Off .* Today!|0% .*APR.*!|\d+% off .*sale|Platinum .*Card/i
		subj9:subj9:quarantine(spam):/(marketing .*database|Digital TV) .*free|Your Credit has been Approved\s?!|Free (Shipping\s?!|Long Distance|Samsung Phone|Baseball Cap)/i

# "From" could be effective as well if you have some statistic/complaints from users
# Just discard all this junk without any notofications
From:	from1:from1:discard:/we\.dont\.like\.him@home.com|offers@|offer@|information@|lose[_.]?weight@|credit[_.]?security@|sex.*mail@|home.*equity/i
	# everybody knows aol/juno/yahoo/hotmail don't allow accounts that begin with the numbers in the name
	from2:from2:discard:/(<\d+|^\d+).*@(aol|msn|juno|yahoo|hotmail)/i
	from2:from2:discard:/(girls|amuro)\.(com|net)|jobseekernews\.(com|net)|jobfly\.com|supportgate\.com/i

# Only spammers are ignoring "To" header
To:	to1:to1:discard:/undisclosed.recipients|friend@|@public\.com/i

# envelope "from" might be useful to define white lists
EnvelopeFrom:	efrom1:efrom1:accept:/securecomputing\.com|webwasher\.com/i

# Just reject all messages with unsafe attachments according to Microsoft
# http://support.microsoft.com/support/kb/articles/Q262/6/17.ASP
[attachments]
att01:att01:virus:/\.ade$/i
att02:att02:virus:/\.adp$/i
att03:att03:virus:/\.bas$/i
att04:att04:virus:/\.bat$/i
att05:att05:virus:/\.chm$/i
att06:att06:virus:/\.cmd$/i
att07:att07:virus:/\.com$/i
att08:att08:virus:/\.cpl$/i
att09:att09:virus:/\.crt$/i
att10:att10:virus:/\.exe$/i
att11:att11:virus:/\.hlp$/i
att12:att12:virus:/\.hta$/i
att13:att13:virus:/\.inf$/i
att14:att14:virus:/\.ins$/i
att15:att15:virus:/\.isp$/i
att16:att16:virus:/\.js$/i
att17:att17:virus:/\.jse$/i
att18:att18:virus:/\.lnk$/i
att19:att19:virus:/\.mdb$/i
att20:att20:virus:/\.mde$/i
att21:att21:virus:/\.msc$/i
att22:att22:virus:/\.msi$/i
att23:att23:virus:/\.msp$/i
att24:att24:virus:/\.mst$/i
att25:att25:virus:/\.pcd$/i
att26:att26:virus:/\.pif$/i
att27:att27:virus:/\.reg$/i
att28:att28:virus:/\.scr$/i
att29:att29:virus:/\.sct$/i
att30:att30:virus:/\.shs$/i
att31:att31:virus:/\.shb$/i
att32:att32:virus:/\.url$/i
att33:att33:virus:/\.vb$/i
att34:att34:virus:/\.vbe$/i
att35:att35:virus:/\.vbs$/i
att36:att36:virus:/\.wsc$/i
att37:att37:virus:/\.wsf$/i
att38:att38:virus:/\.wsh$/i
att39:att39:virus:/\.\{[-A-Z0-9]+\}$/i
att40:att40:virus:/\.$/

[mime types]
mime1:mime1:virus:/^application/x-javascript$/i

[body]
# All these rules are really working, at least for me :)
body1:body1:quarantine(spam):/puss(y|ies)|lesbian|viagra|penis|(asian|naked).{1,20}girl|erotic.{1,10}stor(y|ies)|girl.{1,30}naked/i
body2:body2:quarantine(spam):/Bill.{0,10}1618.{0,10}TITLE.{0,10}III|this is not a spam email/i
body3:body3:quarantine(spam):/100% GUARANTEED|MILLION DOLLAR|INCREASE SALES/
body4:body4:quarantine(spam):/online business opportunities/i
body5:body5:quarantine(spam):/e-*mail marketing/i
body6:body6:quarantine(spam):/Trace anyone by social security number/i
body7:body7:quarantine(spam):/International Executive Guild/i
body8:body8:quarantine(spam):/LASER PRINTER SUPPLIES/i
body9:body9:quarantine(spam):/NO MONTHLY FEE|NO SETUP FEE/i
body10:body10:quarantine(spam):/YOU MUST BE AT LEAST 18 TO ENTER/i
body11:body11:quarantine(spam):/money back guarantee/i
body12:body12:quarantine(spam):/(enhance|increase) (the|your) (pleasure|sex)|(lift|firm) your breast/i
body13:body13:quarantine(spam):/Get your FREE.{0,30}Phone!/i
body14:body14:quarantine(spam):/(bulker|the banned|addresses on) CD/i
body15:body15:quarantine(spam):/This a.?d is produced and sent out by/i
body16:body16:quarantine(spam):/Unsolicited Commercial Electronic Mail Act/i
body17:body17:quarantine(spam):/Replying to this email will not unsubscribe you/i
body18:body18:quarantine(spam):/CLICK HERE TO (BE REMOVED FROM THIS MAILING|ORDER)|Please place ['"]?remove['"]? in the subject line/i
body19:body19:quarantine(spam):/congratulation.{1,30}you won|you won \$[0-9]+|(we pay|help with) your bill/i
body20:body20:quarantine(spam):/This message is a commercial advertisement/i
body21:body21:quarantine(spam):/Dear Friend[:,]/
body22:body22:quarantine(spam):/You have received this email because you are subscribed/i
body23:body23:quarantine(spam):/Just call and we'll deliver/i

[actions]
spam:reject:The message was categorized as SPAM due to unacceptable content. Please contact postmaster@mycompany.com in case any business related issues.
virus:reject:The attachment "$file" of the message was categorized as unsafe. Please contact postmaster@mycompany.com in case any business related issues.
dialup:reject:Dialup users suppose to send messages through their ISP SMTP servers. Please contact postmaster@mycompany.com in case any business related issues.
ordb(rejectordb):rbl:${4}.${3}.${2}.${1}.relays.ordb.org.
ordb(addhdrordb):rbl:${4}.${3}.${2}.${1}.relays.ordb.org.
rejectordb:reject:Rejected according to ORDB Realtime Blackhole List for IP address ${1}.${2}.${3}.${4} (see http://ordb.org/lookup/?host=${1}.${2}.${3}.${4}). Please contact postmaster@mycompany.com in case any business related issues.
addhdrordb:addhdr:X-RBL: dubious source ${1}.${2}.${3}.${4} according to ORDB Realtime Blackhole List (see http://ordb.org/lookup/?host=${1}.${2}.${3}.${4})
rblpfx:chghdr:RBL: ${0}
quarantine:quarantine:/var/spool/quarantine/sentinel/%Y%m%d
quarantine(spam):quarantine:/var/spool/quarantine/sentinel/%Y%m%d
quarantine(dialup):quarantine:/var/spool/quarantine/sentinel/%Y%m%d
discard:discard
accept:accept
null:null