Sendmail now contains a content management API (Milter) that allows third party programs to access mail messages as they are being processed by the Mail Transfer Agent (MTA). This API allows them to examine and modify message content and meta-information.
Possible uses for third-party filters include unsolicited commercial e-mail rejection and virus filtering. In general, Milter seeks to address site-wide filtering concerns in a scalable way. Milter - Mail filtering, provides an interface for third-party software to validate and modify messages as they pass through the mail transport system. The MTA configuration file specifies which filters are to be applied, and in what order.
Filters run as separate processes. This provides for three benefits:
1. The filters do not need to run with root permissions
2. Failures in one filter will not affect the MTA or other filters.
3. The filter can potentially have higher performance
Filters are specified with a key letter 'X' for external.
For example:
Xfilter1, S=local:/var/run/f1.sock, F=R
Xfilter2, S=inet6:999@localhost, F=T, T=C:10m;S:1s;R:1s;E:5m
Xfilter3, S=inet:3333@some.other.host
specifies three filters. Filters can be specified in your .mc file using the following:
INPUT_MAIL_FILTER(`filter1', `S=local:/var/run/f1.sock, F=R')
INPUT_MAIL_FILTER(`filter2', `S=inet6:999@localhost, F=T,
T=C:10m;S:1s;R:1s;E:5m')
INPUT_MAIL_FILTER(`filter3', `S=inet:3333@some.other.host')
You could also use:
MAIL_FILTER(`filter1', `S=local:/var/run/f1.sock, F=R')
MAIL_FILTER(`filter2', `S=inet6:999@localhost, F=T, T=C:10m;S:1s;R:1s;E:5m')
MAIL_FILTER(`filter3', `S=inet:3333@some.other.host')
INPUT_MAIL_FILTER and MAIL_FILTER have three arguments, these are:
F - Controlling flag
S - Description of the socket to use
T - Timeouts
Sockets can be of the form:
S=inet: port @ host
S=inet6: port @ host
S=local: path
The first socket is for IPv4. The second socket is for IPv6. The third socket is for describing a named socket on the filesystem at the given path.
The first filter mentioned above attaches to a Unix-domain socket in the /var/run directory; the second uses an IPv6 socket on port 999 of localhost, and the third uses an IPv4 socket on port 3333 of some.other.host. The current flags (F=) are:
R - Reject connection if filter unavailable
T - Temporary fail connection if filter unavailable
If neither F=R nor F=T is specified, and the filter has an error, the message is passed through Sendmail as if the failing filters were not present.
Finally, you can override the default timeouts used by Sendmail when talking to the filters by using the T= argument. There are four fields inside of the T= argument:
C - Timeout for connecting to a filter (if 0(zero), use the system's connect() timeout)
E - Overall timeout between sending end-of-message to filter and waiting for the final acknowledgment
R - Timeout for reading a reply from the filter
S - Timeout for sending information from the MTA to a filter
Note the separator between each value is a ';' as a ',' already separates arguments and therefore cannot separate timeouts. The default values are:
T=C:5m;S:10s;R:10s;E:5m
where 's' is seconds and 'm' is minutes.
Which filters to invoke and their sequencing is handled by the InputMailFilters option. If InputMailFilters is not defined no filters will be used.
O InputMailFilters=filter1, filter2, filter3
This is set automatically according to the order of the INPUT_MAIL_FILTER commands in your .mc file. Alternatively, you can reset its value by setting confINPUT_MAIL_FILTERS in your .mc file. This option causes the three filters to be called in the same order they were specified.
A filter can be defined without adding it to the input filter list by using MAIL_FILTER() instead of INPUT_MAIL_FILTER() in your .mc file.
Once you have compiled a filter, modified your .mc file and restarted the sendmail process, you will want to test that the filter performs as intended.
The sample filter takes one argument -p, which indicates the local port on which to create a listening socket for the filter. Maintaining consistency with the suggested options for sendmail.cf, this would be the UNIX domain socket located in /var/run/f1.sock.
% ./sample -p local:/var/run/f1.sock
If the sample filter returns immediately to a command line, there was either an error with your command or a problem creating the specified socket. Further logging can be captured through the syslogd daemon. Using the 'netstat -a' command can ensure that your filter process is listening on the appropriate local socket.
Email messages must be injected via SMTP to be filtered. There are two simple means of doing this; either using the 'sendmail -bs' command, or by telnetting to port 25 of the machine configured for milter. Once connected via one of these options, the session can be continued through the use of standard SMTP commands.
% sendmail -bs 220 test.sendmail.com ESMTP Sendmail 8.11.0/8.11.0; Tue, 10 Nov 1970 13:05:23 -0500 (EST) HELO localhost 250 test.sendmail.com Hello testy@localhost, pleased to meet you MAIL From:<testy> 250 2.1.0 <testy>... Sender ok RCPT To:<root> 250 2.1.5 <root>... Recipient ok DATA 354 Enter mail, end with "." on a line by itself From: testy@test.sendmail.com To: root@test.sendmail.com Subject: testing sample filter
Sample body . 250 2.0.0 dB73Zxi25236 Message accepted for delivery QUIT 221 2.0.0 test.sendmail.com closing connection
In the above example, the lines beginning with numbers are output by the mail server, and those without are your input. If everything is working properly, you will find a file in /tmp by the name of msg.XXXXXXXX (where the Xs represent any combination of letters and numbers). This file should contain the message body and headers from the test email entered above.
If the sample filter did not log your test email, there are a number of methods to narrow down the source of the problem. Check your system logs written by syslogd and see if there are any pertinent lines. You may need to reconfigure syslogd to capture all relevant data. Additionally, the logging level of sendmail can be raised with the LogLevel option. See the sendmail manual page for more information.
Next Section: Features - 26 of 32