|
Running Joe's j-chkmail
|
Table of Contents
j-chkmail comes with three binaries :
-
j-chkmail - the main filter daemon
-
j-printstats - a command to print internal counter values
-
j-scanfile - a command line scanner (j-chkmail built-in scanner). You
can use it to scan text mail files.
Please check these commands man pages to get more information about options
and return codes.
Main j-chkmail control tasks can be done by the j-chkmail init script which
is installed by default at /etc/init.d directory.
This script has the usual behavior of scripts placed inside this
directory. So it has answers to the following options :
/etc/init.d/jchkmail start - start j-chkmail
/etc/init.d/jchkmail stop - stop j-chkmail
/etc/init.d/jchkmail restart - stop and start j-chkmail
/etc/init.d/jchkmail reload - reload j-chkmail configuration files
/etc/init.d/jchkmail dumpstats - dump internal counters
/etc/init.d/jchkmail clearstats - reset internal counters
restart, reload, dumpstats and clearstats are
options added to help sending signals to j-chkmail daemon.
You shall take a look at configuration files and modify them to meet your
needs before launch j-chkmail the first time. You should read and
understand what you do before activating some features as you may lost
messages if your filter isn't correctly configured.
In fact, there is one real "configuration file" (j-chkmail.cf), where
you'll define global filter behavior enable filtering options, and other
"data files" where you'll define data needed by some options.
-
j-chkmail.cf - This is the main
configuration file defining j-chkmail runtime behavior.
Complete description of configuration options are found here.
-
/etc/mail/j-nets- In this file you should declare
known IP networks. Networks are divided in three classes :
-
DOMAIN - IP networks inside your domain
-
LOCAL - local IP networks at your site
-
FRIEND - IP networks to whom you may give some privileges.
Syntax :
# KIND NETWORK NETMASK
# Everything after a "#" is considered as comments
LOCAL 127.0.0.1 255.255.255.255
#
DOMAIN 199.199.199.0 255.255.255.0
LOCAL 192.168.0.0 255.255.0.0
FRIEND 212.198.2.0 255.255.255.0
You shall note the first line defining the mail server itself.
Other than your networks, you may need to declare some known list
servers as being one of your friends.
-
/etc/mail/j-local-users - This file
contains a list of local e-mail address (one each line) without domain
part. If you enable CHECK_LOCAL_USERS option in the
configuration file, messages coming from an unknown IP network and and
sent to this users will be rejected.
-
/etc/mail/j-regex - This file contains a list of
regular expressions to check against message body.
-
/etc/mail/j-host-access -
This file defines some access rules related to gateways access.
Currently, this file contains IP addresses to whom we may grant
exceptions to connection filtering rules, e.g. mail gateways with bad
DNS resolution.
-
/etc/mail/j-user-access - Currently, this
file isn't used.
-
/etc/mail/j-error-msg - This file contains
warning replacement messages. Actually, you can define two replacement
messages delimited by tags as :
# Comments
<XFILE>
Replacement XFILE Message
</XFILE>
<POLICY>
Replacement POLICY Message (User defined external scanner)
</POLICY>
<VIRUS>
Replacement VIRUS Message
</VIRUS>
The following variables may be inserted in the replacement message.
They will be replaced by their values.
-
__SUBJECT__ - the subject of the message
-
__WHY__ - why the message was intercepted
-
__VIRUS__ - the name of the virus (if applicable)
-
__TO__ - the first recipient
-
__FROM__ - message sender
-
__ATTACHMENT__ - the list of attached files
j-chkmail answers to signals HUP, USR1 and USR2. Note that signals shall be
sent to the father process. It's his job to decide if a signal shall be
sent to a child or if it's best to communicate to his children by other
means.
-
HUP - When you send a SIGHUP signal to the father, it
reloads configuration files and send new configuration data to
children. If you send a SIGHUP to children, they will die and be
launched again.
-
USR1 - When you send a SIGUSR1 to j-chkmail, it will
dump internal counters.
-
USR2 - If you send a SIGUSR2 to j-chkmail, it resets
internal counters.
/etc/init.d/jchkmail script has options to send signals to the daemon.
-
information logged by the syslog daemon
-
j-printstats command, which prints state of j-chkmail
internal counters
-
internal counter dumps at /var/jchkmail/j-stats file. This file
is intended to be used by monitoring tools such as that one described
in the next paragraph.
-
rrd-jchkmail - a set of scripts based on
rrdtool
used to generate a web page and display graphics of j-chkmail activity.
You can also get a summary of command line options if you launch j-chkmail
j-printstats or j-scanfile with the -h option (or you can check man pages)
:
martins@calloway:~> /usr/sbin/j-chkmail -h
Usage : j-chkmail options
Joe's j-chkmail v1.3
Compiled at Sep 30 2002 12:15:42
-p : socket
inet:2000@localhost
local:/var/sock
-i : 2000 (AF_INET)
-u : /var/sock (AF_UNIX)
-d : inet domain
-h : help
-c : configuration file
-l : log level
-v : version / runtime configuration
-vv : version / compile time configuration
-t tablename, where tablename choosen between :
host_access | user_access | users | networks | classw | regex
Joe's j-chkmail v1.3 - Copyright Ecole des Mines de Paris - (C) 2002
martins@calloway:~>
martins@calloway:~ /usr/bin/j-printstats -h
Usage : j-printstats options
j-printstats -a | -p | -g
-p : print running process j-chkmail counters
-g : print j-chkmail counters from last reset
-a : print both counters
j-printstats -t[td]
-t : throttle data (summary)
-tt : throttle data (detail)
-d : resolve IP addresses
j-printstats -r[rdc]
-r : dns resolve data (summary)
-rr : dns resolve data (detail)
-d : resolve IP addresses
-c : data presented in cumulative mode (default : histogram)
Joe's j-chkmail v1.3 - Copyright Ecole des Mines de Paris - (C) 2002
Compiled at Sep 30 2002 12:15:41
martins@calloway:~>
martins@calloway:~> /usr/bin/j-scanfile -h
Usage : j-scanfile [-h] [-c] [-v] file file file...
Joe's j-chkmail v1.3
Compiled at Sep 30 2002 12:15:39
-h : help
-c : configuration file
-v : verbose
Joe's j-chkmail v1.3 - Copyright Ecole des Mines de Paris - (C) 2002
martins@calloway:~>
Jose Marcio Martins da
Cruz
j-chkmail - © Ecole des Mines de Paris - Centre de Calcul
Last
modified Fri Oct 04 11:05:59 MEST 2002