--- name: "messagewall_profiles" section: "5" platform: "linux" package: "messagewall" version: "1.0.8-3" release: "Debian 3.1 (Sarge)" platforms: ["linux"] url: "https://new.carta.tech/messagewall_profiles" --- # messagewall\_profiles(5) messagewall user profile configuration ## NAME messagewall\_profiles - messagewall user profile configuration ## DESCRIPTION Any regular files in the directory defined as **profile\_dir** in **messagewall.conf (5)** are read as profiles that can be referenced from **default\_profile**, **relay\_profile** or the **special\_users** file. Each profile must contain at least one key/value pair. Regular variables are in the format::\ **variable\_name**="**value**"\ **variable\_name2**="**value2**" Scored variables are in the format:\ **variable\_name**="**score**,**value**"\ If the score is omitted, it defaults to 1. If the **value** contains a comma, **score** is required. Regular Variables:\ **reject**\ *Default: 0*\ Setting this variable to '1' indicates that any messages using this profile should be denied. This is used for testing and for preventing addresses under attack from clogging the backend MTA. **reject\_score**\ *Default: 1*\ This is the score at which MessageWall will reject the message. Any message acheiving a score below this will simply have warnings added to its headers indicating which tests it failed. **mime\_strip**\ *Example:*\ *mime\_strip=text/html*\ The value of a **mime\_strip** line is case-insensitively matched against MIME types of each part of the message. If a match is found, that MIME section is stripped from the message, and will not reach the recipient. There can be multiple **mime\_strip** lines. If, after processing all **mime\_strip** lines, there are no useful (non-multipart) sections of the message left, the message is refused. Stripping **text/html** sections from messages can be extremely effective against viruses that self-run attachments using bugs in Microsoft Outlook's & Outlook Express's HTML-handling code, as well as against HTML-only spam. **mime\_allow**\ *Example:*\ *mime\_allow=text/plain*\ **mime\_allow** is a stricter version of **mime\_strip**. It acts the same way except that only parts with MIME types specificially listed are allowed through. There can be multiple **mime\_allow** lines. Presence of a **mime\_allow** line nullifies any **mime\_strip** lines in the profile. Scored Variables:\ **to\_cc\_check**\ *Default: 0*\ Setting this variable to '1' causes MessageWall to check that the envelope destination address is in either the To: or CC: fields in the message header. This check stops a significant amount of UBE. However, it also breaks most legitimate mailing lists. Do not use this check in the **relay\_profile**, as there may be multiple destination addresses and it will provide inconsistent results. **from\_check**\ *Default: 0*\ Setting this variable to '1' causes MessageWall to check that the envelope source address is in the From: field of the message header. The realistic impact of using this check is unknown. **realname\_check**\ *Default: 0*\ Setting this variable to '1' causes MessageWall to check for the presence of a real name before the \<\> address section of the From: field of the message header. The realistic impact of using this check is unknown. **rdns\_required**\ *Default: 0*\ Setting this variable to '1' causes MessageWall to reject messages from IP address that lack reverse DNS. The realistic impact of using this check is unknown. **rmx\_required**\ *Default: 0*\ Setting this variable to '1' causes MessageWall to reject messages with return path domains without an MX or A record. This means that domains in the reverse path that would be undeliverable for return mail cause the message to be rejected. This should be safe to use in almost all cases. **header\_reject**\ *Example:*\ *header\_reject=1,Precedence:bulk*\ The value of a **header\_reject** line should contain a colon seperated string of Header:Key. The "Key" will be case-sensitively searched for in the value of the header. If a match is found, the message is refused. There can be multiple **header\_reject** lines. **header\_rejecti**\ *Example:*\ *header\_rejecti=1,X-Mailer:gold*\ The value of a **header\_rejecti** line should contain a colon seperated string of Header:Key. The "Key" will be case-insensitively searched for in the value of the header. If a match is found, the message is refused. There can be multiple **header\_reject** lines. **body\_reject**\ *Example:*\ *body\_reject=1,FREE*\ The value of a **body\_reject** line is case-sensitively searched for in the decoded body of each MIME part. If a match is found, the message is refused. There can be multiple **body\_reject** lines. **body\_rejecti**\ *Example:*\ *body\_rejecti=1,viagra*\ The value of a **body\_rejecti** line is case-insensitively searched for in the decoded body of each MIME part. If a match is found, the message is refused. There can be multiple **body\_rejecti** lines. **filename\_reject**\ *Example:*\ *filename\_reject=1,.pif*\ The value of a **filename\_reject** line is case-insensitively searched for in any filenames of attachments to the message. If a match is found, the message is refused. There can be multiple **filename\_reject** lines. **filename\_reject** is the most powerful MessageWall tool to stop virus propagation. **mime\_reject**\ *mime\_reject=1,application/x-wav*\ The value of a **mime\_reject** line is case-insensitively matched against content-types in all parts of the message. If a match is found, the message is refused. There can be multiple **mime\_reject** lines. **mime\_reject** is provided as a counterpart to **filename\_reject** for platforms that determine execution based on MIME type instead of filename extension. **dnsbl**\ *Examples:*\ *dnsbl=2,list.dsbl.org/127.0.0.2*\ *dnsbl=1,multihop.dsbl.org*\ *dnsbl=1,bl.spamcop.net*\ Each **dnsbl** line causes queries for connecting IP addresses to be sent to the list in question. If a connecting IP address is present on one of the lists (and the result IP matches the one provided, if any), the message is refused with a message pointing to http://openrbl.org/. To speed up transactions, requests for all lists from all profiles are sent on initial connection; later, when we determine what profile applies to the message, responses from the lists are checked, and waited for (up to **dnsbl\_timeout**) if necessary. The effectiveness of this feature is based strictly on which lists are used. **dnsbl\_domain**\ *Examples:*\ *dnsbl\_domain=1,dsn.rfc-ignorant.org/127.0.0.2*\ *dnsbl\_domain=2,postmaster.rfc-ignorant.org*\ *dnsbl\_domain=1,abuse.rfc-ignorant.org*\ Each **dnsbl\_domain** line causes queries for reverse path domains to be sent to the list in question. If a connecting IP address is present on one of the lists (and the result IP matches the one provided, if any), the message is refused. To speed up transactions, requests for all lists from all profiles are sent on MAIL FROM; later, when we determine what profile applies to the message, responses from the lists are checked, and waited for (up to **dnsbl\_domain\_timeout**) if necessary. The effectiveness of this feature is based on the lists being used, but is slightly less than IP-based blacklists, as it is more easily spoofable. **dnsdcc**\ *Examples:*\ *dnsdcc=1,aa.dcc.dsbl.org*\ *dnsdcc=1,ba.dcc.dsbl.org*\ Each **dnsdcc** line causes queries for each MIME part of a message to be sent to the specified checksum servers. The first two letters of the value specifies the checksum to be calculated. If a match is found, the message is refused. This system is very effective against common viruses and UBE, but also breaks legitimate mailing list messages. **virus\_scan**\ *Examples:*\ *virus\_scan=1,virus.profiles*\ Each **virus\_scan** line causes MessageWall to scan decoded attachments against the Open AntiVirus format pattern file specified. If a match is found, the message is refused. Virus pattern files are reloaded on *messagewallctl reload-virus*. ## EXAMPLES See the *profiles* directory in the distribution for sample profiles. ## AUTHOR Ian Gulliver \ ## SEE ALSO [**messagewall**(1)](/messagewall/1.md),\ [**messagewall.conf**(5)](/messagewall.conf/5.md)