MailStripper - spam filter for Linux, FreeBSD and Solaris filter spam

MailStripper - Features

  • Administrator configurable keywords list
    MailStripper's main search core uses an enhanced keyword scan, entirely configurable by the site administrator. Negative biases can be used to denote non-spam keywords. Keywords may be included as a plain string or as regular expressions.

  • Maintained keywords list
    As an alternative to maintaining your own keyword list, the config tools can download a remotely maintained keyword list (by default, the one we use at Eridani) from the website at the push of a button. You may even download a keyword list then tailor it to your own needs. This is a subscription service, with a non-subscription version that is updated periodically.

  • Automated updates
    Synchronise your server with a central point of control. MailStripper uses cron to manage the scheduling.

  • Spam Bin as SMTP mailbox
    The spam bin can be a local mbox-format mail file. Alternatively, a local email address permits the spam bin to be held on a different machine.
    The Virus bin can also be an email address if you need it.

  • Per-user and/or per-domain spam bins
    Individual spam bins per user, or per hosted domain. For example /var/spool/spam/<domain>/<username>. This facility can also work in conjunction with the Spam Bin as SMTP mailbox feature.

  • Subject line tagging of spam
    Instead of using a spam bin, all (non-blacklisted) emails are sent on to the intended recipient, but those which would have been quarantined get a subject line tag instead. Some email clients can use this to operate a user's own local spam bin.
    As of MailStripper 1.3.0 this may be configured on a per-recipient basis.

  • No bounces generated by MailStripper
    Most spam and virus mail headers are forged. The apparent sender address is most likely not the offender. Therefore, spam and viruses are quarantined and not bounced, effectively being blackholed. (Blacklisted sites get a User Unknown error at the SMTP layer.)

  • Sender whitelist
    The sender's email message is checked for viruses (if configured) but not scanned as potential spam. Unless found to contain a virus, the message is delivered unfiltered.

  • Sender blacklist
    An SMTP User Unknown error code is sent to the blacklisted sender on identification of the recipient.

  • Source IP blacklist
    An SMTP User Unknown error code is sent to the sender at the blacklisted IP/netblock, on identification of the recipient.

  • DNS blacklist (DNSBL) support
    In addition to building up your own IP blacklist, this enables use of third party blacklists elsewhere on the Internet.

  • Spammer IP Honeypot
    If given a list of "honeypot" email addresses (those which have no right to be receiving email, maybe inherited from a previous owner of your domain) any IP address seen to be emailing them will be automatically added to the IP blacklist. It is also possible to mark certain IP addresses as authorised relays so they won't be blacklisted even if spam comes through them - but they will be subject to the other checks.

  • Recipient Whitelist
    Overrides any blacklists, and disables spam scanning for the named recipient. Ideal for role accounts such as abuse and postmaster.

  • Mail server daemon independence
    MailStripper works at the SMTP level, and can be on a different machine to your MTA. It connects to your mail server over another SMTP connection.

  • Switchable ESMTP support
    Some mail servers have issues with proprietary ESMTP extensions. ESMTP support may be disabled entirely if running ESMTP causes problems.

  • Intelligent anti-spam evasion countermeasures
    MailStripper recognises and counteracts attempts at evading detection as spam.

  • Rate limiter
    This will prevent your mail server from being overloaded by spam. This is a configurable option - faster servers can allow more concurrent scan processes.
    This has been significantly improved in version 1.4.1.

  • Anti-virus capability (optional)
    Scans all mail for virus infection, and quarantines all infected email. ClamAV, Frisk Software's F-Prot and NAI's McAfee uvscan are directly supported, and a new AVWRAP interface allows the use of antivirus scanners that are not directly supported by MailStripper. Our example AVWRAP script blocks Win32 executables and is supplied with MailStripper.

  • Does not require cutting-edge versions of libraries or MTA
    MailStripper is supplied as statically linked binaries (apart from glibc on Linux), so they contain all the extra library routines they require. By working on the SMTP layer, MailStripper is totally independent of your MTA platform, let alone MTA version.

  • Multi-process architecture
    This ensures that should a hitherto unknown malformed email message crash MailStripper, only that scanning process dies - it does not remove your system's ability to receive email.

  • No usage expiry (except evaluation licences)
    Paid licences do not expire - there is no need to re-register every year (as is becoming common with many software packages). This does not apply to the blocklist subscription service but is not required to run MailStripper.

  • No mailbox limit
    MailStripper will protect as many mailboxes as your mailserver can hold.

  • No additional licence charges for multi-processor machines.
    Commercial Licences are per machine, not per CPU. Personal licences are per household.

  • Features an easy-to-use configuration GUI, xmstripconf
    As with other X apps it can use a remote display, so you don't need to run an X desktop on your mail server.

  • Text-mode menu-driven config tool, mstripconf
    If you're on an X-less machine or a remote session, use this to configure MailStripper instead.

  • Handle ESMTP "SIZE" whether or not the mail server supports it
    Enforce a message size limit with this feature, rejecting anything that is too big.

  • Plug-in support
    A very exciting new addition to the MailStripper feature set, this facility allows MailStripper to be expanded almost without limit.
    This also allows for third parties to offer bolt-on services to enhance MailStripper with their own technologies. System administrators can also create their own filters based on local policies.

    MailStripper supplies two plug-ins as standard - Local Blocklist and SURBL (see below).

  • Local Blocklist support
    An often-requested feature, this has previously been a very risky change to the software core due to the changes that would be required (which is why it hasn't appeared yet).
    With the plug-in facility, this can now be implemented reliably and entirely without risking the rest of the system. The local blocklist will remain untouched when the main blocklist is updated using the automatic update facility.

  • Spam URL Blacklist support
    This is implemented as a plug-in that implements the interface described at Unlike standard DNS blacklists, this reports on the URLs contained within the body of the message.

MailStripper supports ClamAV, Frisk Software's F-Prot and NAI's McAfee uvscan products for virus-scanning mail.

If you do not have either ClamAV, F-Prot or uvscan installed ensure the "Use Anti-Virus package" option is set to None or use AVWRAP to use an unsupported antivirus package. Our example script uses this interface to block all Win32 executables.

ClamAV is a free, open-source virus scanner, and is free to use for any commercial or non-commercial installation.

F-Prot is available free of charge for personal use only for Linux, FreeBSD, Solaris (SPARC) and Solaris (x86). Commercial use requires licensing, more information can be found here. In all cases the edition to use with MailStripper is the Workstation version. It cannot work with the Windows version of F-Prot.

Network Associate's McAfee uvscan (command line scanner) product may be downloaded from here for Linux, FreeBSD and Solaris on a trial basis - look for the Command Line Scanner.