Configuration Index - MailScanner v5.3.x

 Do you want to add the Envelope-From: header?
 This is very useful for tracking where spam came from as it
 contains the envelope sender address.
 This can also be the filename of a ruleset.

 Do you want to add the Envelope-To: header?
 This can be useful for tracking spam destinations, but should be
 used with care due to possible privacy concerns with the use of
 Bcc: headers by users.
 Note also that this information can be added conditionally by using
 the "_TO_" word in a "header" action for Spam Actions, High Scoring
 Spam Actions, Non-Spam Actions and SpamAssassin Rule Actions.
 This can also be the filename of a ruleset.

 Do you want to add the plain text contents of Microsoft Word documents?
 This feature uses the 'antiword' program available from
 http://www.winfield.demon.nl/
 For those of you running on Linux, you can get RPMs and SRPMs from
 http://www.volny.cz/zellerin/rpmmenu.html
 It is switched off by default, as it causes a slight performance hit.
 This can also be the filename of a ruleset.

 Do you want to add a watermark to each email message?
 Setting this enables delivery error messages to be identified as yours
 so you want to see them. Delivery error messages without valid watermarks
 are treated as spam (or whatever you set below), as you probably don't
 want to see them. Spammers can send vast quantities of spam claiming to
 come from you so that you get all the delivery errors (known as a "joe-job"
 attack).
 This can also be the filename of a ruleset.

 Anything on the next line that appears in brackets at the end of a line
 of output from Sophos will cause the error/infection to be ignored.
 Use of this option is dangerous, and should only be used if you are having
 trouble with lots of corrupt PDF files, for example.
 If you need to specify more than 1 string to find in the error message,
 then put each string in quotes and separate them with a comma.
 For example:
Allowed Sophos Error Messages = "corrupt", "format not supported", "File was encrypted", "The main body of virus data is out of date", "Password protected file"

 Do you want to allow messages whose body is stored somewhere else on the
 internet, which is downloaded separately by the user's email package?
 There is no way to guarantee that the file fetched by the user's email
 package is free from viruses, as MailScanner never sees it.
 This feature is dangerous as it can allow viruses to be fetched from
 other Internet sites by a user's email package. The user would just
 think it was a normal email attachment and would have been scanned by
 MailScanner.
 It is only currently supported by Netscape 6 anyway, and the only people
 who use it are the IETF. So I would strongly advise leaving this switched off.
 This can also be the filename of a ruleset.

 Allow any attachment MIME types matching any of the patterns listed here.
 If this setting is empty, it is ignored and no matches are made.
 This can also be the filename of a ruleset.

 Allow any attachment filenames matching any of the patterns listed here.
 If this setting is empty, it is ignored and no matches are made.
 This can also be the filename of a ruleset.

 Allow any attachment filetypes matching any of the patterns listed here.
 If this setting is empty, it is ignored and no matches are made.
 This can also be the filename of a ruleset.

 Do you want to allow <Form> tags in email messages? This is a bad idea
 as these are used as scams to pursuade people to part with credit card
 information and other personal data.
 Value: yes     => Allow these tags to be in the message
        no      => Ban messages containing these tags
        disarm  => Allow these tags, but stop these tags from working
                   Note: Disarming can be defeated, it is not 100% safe!
 This can also be the filename of a ruleset.

 Do you want to allow <IFrame> tags in email messages? This is not a good
 idea as it allows various Microsoft Outlook security vulnerabilities to
 remain unprotected, but if you have a load of mailing lists sending them,
 then you will want to allow them to keep your users happy.
 Value: yes     => Allow these tags to be in the message
        no      => Ban messages containing these tags
        disarm  => Allow these tags, but stop these tags from working
 This can also be the filename of a ruleset, so you can allow them from
 known mailing lists but ban them from everywhere else.

 This option can be used to stop any duplication of en email signature
 appearing in the HTML of an email message. It looks for the "alt"
 attribute in the <img> tag specifying the image to be inserted in the
 HTML signature. If you want to use this option without inserting an image
 into the signature, simply specify an <img> tag without a "src" attribute.

 If the "alt" tag appears, and contains the word "MailScanner" and the
 word "Signature" and the %org-name% you specified at the top of this file,
 then the message is considered to already be signed. If this option is
 also set to "no", then it will not be signed again. Multiple image
 signatures at the bottom of a message can make the message very large and
 ugly once it has been replied to a couple of times.
 This can also be the filename of a ruleset.

 Do you want to allow <Object Codebase=...> or <Object Data=...> tags
 in email messages?
 This is a bad idea as it leaves you unprotected against various
 Microsoft-specific security vulnerabilities. But if your users demand
 it, you can do it.
 Value: yes     => Allow these tags to be in the message
        no      => Ban messages containing these tags
        disarm  => Allow these tags, but stop these tags from working
 This can also be the filename of a ruleset, so you can allow them just
 for specific users or domains.

 Do you want to allow partial messages, which only contain a fraction of
 the attachments, not the whole thing? There is absolutely no way to
 scan these "partial messages" properly for viruses, as MailScanner never
 sees all of the attachment at the same time. Enabling this option can
 allow viruses through. You have been warned.
 This can also be the filename of a ruleset so you can, for example, allow
 them in outgoing mail but not in incoming mail.

 Should archives which contain any password-protected files be allowed?
 Leaving this set to "no" is a good way of protecting against all the
 protected zip files used by viruses at the moment.
 This can also be the filename of a ruleset.

 Do you want to allow <Script> tags in email messages? This is a bad idea
 as these are used to exploit vulnerabilities in email applications and
 web browsers.
 Value: yes     => Allow these tags to be in the message
        no      => Ban messages containing these tags
        disarm  => Allow these tags, but stop these tags from working
                   Note: Disarming can be defeated, it is not 100% safe!
 This can also be the filename of a ruleset.

 Do you want to allow <Img> tags with very small images in email messages?
 This is a bad idea as these are used as 'web bugs' to find out if a message
 has been read. It is not dangerous, it is just used to make you give away
 information.
 Value: yes     => Allow these tags to be in the message
        disarm  => Allow these tags, but stop these tags from working
                   Note: Disarming can be defeated, it is not 100% safe!
 Note: You cannot block messages containing web bugs as their detection
       is very vulnerable to false alarms.
 This can also be the filename of a ruleset.

 While detecting "Phishing" attacks, do you also want to point out links
 to numeric IP addresses. Genuine links to totally numeric IP addresses
 are very rare, so this option is set to "yes" by default. If a numeric
 IP address is found in a link, the same phishing warning message is used
 as in the Find Phishing Fraud option above.
 This can also be the filename of a ruleset.

 Do you want to always include the Spam Report in the SpamCheck
 header, even if the message wasn't spam?
 This can also be the filename of a ruleset.

 This option is intended for people who want to log more information
 about messages than what is put in syslog. It is intended to be used
 with a Custom Function which has the side-effect of logging information,
 perhaps to an SQL database, or any other processing you want to do
 after each message is processed.
 Its value is completely ignored, it is purely there to have side
 effects.
 If you want to use it, read CustomConfig.pm.

 This option is intended for people who want to log per-batch information.
 This is evaluated after the "Always Looked Up Last" configuration option
 for each message in the batch. This is looked up once for the entire batch.
 Its value is completely ignored, it is purely there to have side effects.
 If you want to use it, read CustomConfig.pm.

 Location and full command of the "antiword" program
 Using a ruleset here, you could have different output styles for
 different people.
 This can also be the filename of a ruleset.

 The maximum length of time the "antiword" command is allowed to run for 1
 Word document (in seconds)

 Space-separated list of any combination of
 1. email addresses to which mail should be forwarded,
 2. directory names where you want mail to be stored,
 3. file names (they must already exist unless "Missing Mail Archive Is =
    directory" is set below) which mail will be appended
    in "mbox" format suitable for importing into most mail systems.

 Any of the items above can contain 3 magic strings, which are subsituted
 as follows:
 _DATE_       will be replaced with the current date in yyyymmdd format.
              This will make archive-rolling and maintenance much easier,
              as you can guarantee that yesterday's mail archive will not
              be in active use today.
 _HOUR_       will be replaced with the number of the current hour, with
              a leading zero if necessary to make it 2 digits.
 _TOUSER_     will be replaced with the left-hand side of the email
              address of each of the recipients in turn.
 _TODOMAIN_   will be replaced with the right-hand side of the email
              address of each of the recipients in turn.
 _FROMUSER_   will be replaced with the left-hand side of the email
              address of the sender.
 _FROMDOMAIN_ will be replaced with the right-hand side of the email
              address of the sender.

 If you give this option a ruleset, you can control exactly whose mail
 is archived or forwarded. If you do this, beware of the legal implications
 as this could be deemed to be illegal interception unless the police have
 asked you to do this.

 Note: This setting still works even if "Scan Messages" is no.

Archive Mail = /var/spool/MailScanner/archive

 What sort of attachments are considered to be archives?
 You may well consider, for example, zip and rar files to be archives, but
 maybe TNEF files to not be archives as they are really just another way
 of supplying attachments that is only used by Microsoft Exchange and Outlook.
 This is a space-separated list of the types which are treated as archives.
 Valid keywords within this are:
       zip  -- Zip files and Microsoft Office 2007 documents
       rar  -- Rar archives
       uu   -- UU-encoded files
       ole  -- Microsoft ".doc" and ".xls" and ".ppt" files
       tnef -- "winmail.dat" files created by Microsoft Exchange or Outlook

 Normally, you would only want to attach the image to messages with an
 HTML part, as plain text messages clearly cannot display an image.
 However, if you find some other use for this feature, you may want to
 attach an image to a message which is just text.
 See "Attach Image To Signature" for notes on how to use this.
 This can also be the filename of a ruleset.

 If you are using HTML signatures, you can embed an image in the signature.
 For the filename(s) of the image, see the settings "Signature Image
 Filename" and "Signature Image <img> Filename".
 In your HTML, you must refer to the image with an HTML tag that looks like:
     <img alt="MailScanner Signature" src="cid:signature.jpg">
 where "signature.jpg" is the name of the image set in the
 "Signature Image <img> Filename" setting above. If used correctly, Mail-
 Scanner will notice if the image is already present and not add it again.
 
 This can also be the filename of a ruleset.

 What character set do you want to use for the attachment that
 replaces viruses (VirusWarning.txt)?
 The default is ISO-8859-1 as even Americans have to talk to the
 rest of the world occasionally :-)
 This can also be the filename of a ruleset.

 Attachments whose filenames end in these strings will not be zipped.
 This can also be the filename of a ruleset.

 If the original total size of all the attachments to be compressed is
 less than this number of bytes, they will not be zipped at all.
 This can also be the filename of a ruleset.

 If the attachments are to be compressed into a single zip file,
 this is the filename of the zip file.
 This can also be the filename of a ruleset.

 When a virus or attachment is replaced by a plain-text warning,
 and that warning is an attachment, this is the filename of the
 new attachment.
 This can also be the filename of a ruleset.

 Do you want to automatically do a syntax check of the configuration files
 when MailScanner is started up? It will still start up, regardless, but it
 will print plenty of errors and warnings if anything important is wrong in
 your setup, instead of just logging it to your system's mail logs. It does
 slightly slow down the startup of MailScanner, of course, but that is only
 done once and so it does not really matter.
 This makes it easier for novice users.
 This cannot be a ruleset, only a simple value.

 Should encrypted messages be blocked?
 This is useful if you are wary about your users sending encrypted
 messages to your competition.
 This can be a ruleset so you can block encrypted message to certain domains.

 Should unencrypted messages be blocked?
 This could be used to ensure all your users send messages outside your
 company encrypted to avoid snooping of mail to your business partners.
 This can be a ruleset so you can just check mail to certain users/domains.

 When you bounce a spam message back to the sender, do you want to
 encapsulate it in another message, rather like the "attachment" option
 when delivering spam to the original recipient?
 NOTE: If you enable this option, be sure to whitelist your local server
       ie. 127.0.0.1 as otherwise the spam bounce message will be detected
       as spam again, which will cause another spam bounce and so on
       until your mail queues fill up and your server crashes!
 This can also be the filename of a ruleset.

 Many naive spammers send out the same message to lots of people.
 These messages are very likely to have roughly the same SpamAssassin score.
 For extra speed, cache the SpamAssassin results for the messages
 being processed so that you only call SpamAssassin once for all of the
 messages.
 If you set this to "no" then the entire SpamAssassin Cache Database File
 is not used, along with its requirement for SQLite.
 This can also be the filename of a ruleset.

 Normally, you can still get the filenames out of a password-protected
 archive, despite the encryption. So by default filename checks are still
 done on these files. However, some people want to suppress this checking
 as they allow a few people to receive password-protected archives that
 contain things such as .exe's as part of their business needs. This option
 can be used to suppress filename checks inside password-protected archives.
 This can also be the filename of a ruleset.

 If the message sender is on any of the Spam Lists, do you still want
 to do the SpamAssassin checks? Setting this to "no" will reduce the load
 on your server, but will stop the High Scoring Spam Actions from ever
 happening.
 This can also be the filename of a ruleset.

 Enable this feature if you have more then one Mailscanner installation
 (or you have a trust relationship with another Mailscanner user). An
 example would be a secondary MX with MailScanner installed which relays
 to the primary MX for delivery. For this to work you need to use the
 same value for "Watermark Header", and have the same "Watermark Secret".

 This could be achieved by using a ruleset.

 This feature skips Spam Checks if the Watermark is trusted. The trust
 only works between servers so will not apply to replies to emails.

 If the Watermark has expired or is invalid then the message is processed
 as normal.
 This can also be the filename of a ruleset.

 Do you want to check watermarks?
 This can also be the filename of a ruleset.

 There are now sets of signatures available from places such as
 www.sanesecurity.co.uk which use ClamAV to detect spam. Some of these
 signatures rely on being passed the whole message as one file. By setting
 this option to "yes", each entire message is written out to the scanning
 area, thus enabling these signatures to work reliably.
 It has a slight speed impact but is worth it for the extra spam-spotting
 ability.

 This option cannot be the filename of a ruleset, it must be "yes" or "no".

 ClamAVModule only: set limits when scanning for viruses.

 The maximum recursion level of archives,
 The maximum number of files per batch,
 The maximum file of each file,
 The maximum compression ratio of archive.
 These settings *cannot* be the filename of a ruleset, only a simple number.

 Clamd only: configuration options for using the clamd daemon.
 1. The port to use when communicating with clamd via TCP connection
 2. The Socket, or IP to use for communicating with the clamd Daemon.
    You enter either the full path to the UNIX socket file or the IP
    address the daemon is listening on.
 3. The ClamD Lock file should be created by clamd init script in most
    cases. If it is not then the entry should be blank.
 4. If MailScanner is running on a system with more then 1 CPU core (or
    more than 1 CPU) then you can set "Clamd Use Threads" to "yes" to
    speed up the scanning, otherwise there is no advantage and it should
    be set to "no".

 None of these options can be the filenames of rulesets, they must be just
 simple values.

 Set the "Mail Header" to these values for clean/infected/disinfected messages.
 This can also be the filename of a ruleset.

 If an attachment triggered a content check, but there was nothing
 else wrong with the message, do you want to modify the subject line?
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      yes   = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line.
 This makes filtering in Outlook very easy.
 This can also be the filename of a ruleset.

 This is the text to add to the start of the subject if the
 "Content Modify Subject" option is set.
 You might want to change this so your users can see at a glance
 whether it just was just the content that MailScanner rejected.
 This can also be the filename of a ruleset.

 This option interacts with the "Allow ... Tags" options above like this:

 Allow...Tags    Convert Danger...    Action Taken on HTML Message
 ============    =================    ============================
    no              no                Blocked
    no              yes               Blocked
    disarm          no                Specified HTML tags disarmed
    disarm          yes               Specified HTML tags disarmed
    yes             no                Nothing, allowed to pass
    yes             yes               All HTML tags stripped

 If an "Allow ... Tags = yes" is triggered by a message, and this
 "Convert Dangerous HTML To Text" is set to "yes", then the HTML
 message will be converted to plain text.  This makes the HTML
 harmless, while still allowing your users to see the text content
 of the messages.  Note that all graphical content will be removed.

 This can also be the filename of a ruleset, so you can make this apply
 only to specific users or domains.

 Do you want to convert all HTML messages into plain text?
 This is very useful for users who are children or are easily offended
 by nasty things like pornographic spam.
 This can also be the filename of a ruleset, so you can switch this
 feature on and off for particular users or domains.

 This file lists all the countries that use 2nd-level and 3rd-level
 domain names to classify distinct types of website within their country.
 This cannot be the name of a ruleset, it is just a simple setting.

 Where to put the code for your "Custom Functions". No code in this
 directory should be over-written by the installation or upgrade process.
 All files starting with "." or ending with ".rpmnew" will be ignored,
 all other files will be compiled and may be used with Custom Functions.

 How long should the custom spam scanner take to run? If it takes more
 seconds than this, then it should be considered to have crashed and
 should be killed. This stops denial-of-service attacks.

 The total number of Custom Spam Scanner attempts during which "Max
 Custom Spam Scanner Timeouts" will cause the Custom Spam Scanner to
 be marked as "unavailable". See the previous comment for more information.
 The default values of 10 and 20 mean that 10 timeouts in any sequence of
 20 attempts will trigger the behaviour described above, until the next
 periodic restart (see "Restart Every").

 Do you want to scan the messages for potentially dangerous content?
 Setting this to "no" will disable all the content-based checks except
 Virus Scanning, Allow Partial Messages and Allow External Message Bodies.
 This can also be the filename of a ruleset.

 If you wish to read settings from a database or any other DBI-compatible
 data source, then this value should be set to the DBI data source name.

 This value is required for all of the database functions to work; if it
 is not supplied or is invalid, then all of the database functions will be
 disabled.  See the Perl DBI documentation for all available options.

 Example: DB DSN = DBI:DriverName:database=DataBaseName;host=Hostname;port=Port

 Optional password to use to connect to the data source defined by DB DSN.

 Optional username to use to connect to the data source defined by DB DSN.

 Set Debug to "yes" to stop it running as a daemon and just process
 one batch of messages and then exit.

 Do you want to debug SpamAssassin from within MailScanner?

 In the "Filename Rules" and "Filetype Rules" rule files, you can
 say that you want particular attachment names or types to be "disarmed"
 by being renamed. See the sample files for examples of this.

 The "rename" rules in filetype.rules.conf rename attachments that match
 the rule according to this setting, where the string "__FILENAME__" will
 be replaced with the attachment's original filename.

 In filename.rules.conf, it is a little more complex. They can work just
 like the filetype rules.conf version explained in the previous paragraph,
 or else the "rename" instruction can also supply the replacement text.
 For example, a rule starting
 rename to .txt	\.reg$	.....
 will match all attachment filenames ending in ".reg" and replace the
 ".reg" with ".txt".

 The "rename" rules change the filename of the attachment as described
 above, so that either
 (a) the user cannot simply double-click on the attachment, but must save
     it then rename it back to its original name; only then can they
     double-click on the file.
 OR
 (b) the action taken when the user double-clicks on the file will be
     changed. In the "reg"/"txt" example above, the file will be opened
     for editing rather than immediately merged into the user's Windows
     Registry, which could have had disastrous consequences.

 This provides a simple safeguard so that users have to consciously
 think about what they are doing, and do not accidentally take actions
 they would probably regret. In some situations this is better than
 just denying the file completely, as the user can still see the attachment
 they were sent.

 This can also be the filename of a ruleset.

 Setting this to yes means that spam found in the blacklist is treated
 as "High Scoring Spam" in the "Spam Actions" section below. Setting it
 to no means that it will be treated as "normal" spam.
 This can also be the filename of a ruleset.

 Set where to find the message text sent to users when one of their
 attachments has been deleted from a message.
 These can also be the filenames of rulesets.

 Do you want to deliver messages once they have been cleaned of any
 viruses?
 By making this a ruleset, you can re-create the "Deliver From Local"
 facility of previous versions.

 Should I attempt to disinfect infected attachments and then deliver
 the clean ones. "Disinfection" involves removing viruses from files
 (such as removing macro viruses from documents). "Cleaning" is the
 replacement of infected attachments with "VirusWarning.txt" text
 attachments.
 Less than 1% of viruses in the wild can be successfully disinfected,
 as macro viruses are now a rare occurrence. So the default has been
 changed to "no" as it gives a significant performance improvement.

 This can also be the filename of a ruleset.

 When attempting delivery of outgoing messages, should we do it in the
 background or wait for it to complete? The danger of doing it in the
 background is that the machine load goes ever upwards while all the
 slow sendmail processes run to completion. However, running it in the
 foreground may cause the mail server to run too slowly.

 Some versions of Microsoft Outlook generate unparsable Rich Text
 format attachments. Do we want to deliver these bad attachments anyway?
 Setting this to yes introduces the slight risk of a virus getting through,
 but if you have a lot of troubled Outlook users you might need to do this.
 We are working on a replacement for the TNEF decoder.
 This can also be the filename of a ruleset.

 Attempt immediate delivery of messages, or just place them in the outgoing
 queue for the MTA to deliver when it wants to?
      batch -- attempt delivery of messages, in batches of up to 20 at once.
      queue -- just place them in the queue and let the MTA find them.
 This can also be the filename of a ruleset. For example, you could use a
 ruleset here so that messages coming to you are immediately delivered,
 while messages going to any other site are just placed in the queue in
 case the remote delivery is very slow.

 Deny any attachment MIME types matching any of the patterns listed here.
 If this setting is empty, it is ignored and no matches are made.
 This can also be the filename of a ruleset.

 Deny any attachment filenames matching any of the patterns listed here.
 If this setting is empty, it is ignored and no matches are made.
 This can also be the filename of a ruleset.

 Deny any attachment filetypes matching any of the patterns listed here.
 If this setting is empty, it is ignored and no matches are made.
 This can also be the filename of a ruleset.

 Do you want the full spam report, or just a simple "spam / not spam" report?

 If HTML tags in the message were "disarmed" by using the HTML "Allow"
 options above with the "disarm" settings, do you want to modify the
 subject line?
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      yes   = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line.
 This can also be the filename of a ruleset.

 This is the text to add to the start of the subject if the
 "Disarmed Modify Subject" option is set.
 This can also be the filename of a ruleset.

 Set where to find the message text sent to users explaining about the
 attached disinfected documents.
 This can also be the filename of a ruleset.

 If any of these headers exist, then the message is actually a reply and
 so we may not want to sign it with an HTML signature. Plain text sig-
 natures will still apply, but HTML signatures, which may include an image,
 will not.
 By default, this feature is disabled by specifying no header names.
 This should be a space or comma-separated list of header names.
 This can also be the filename of a ruleset.

 You can use this ruleset to enable the "bounce" Spam Action.
 You must *only* enable this for mail from sites with which you have
 agreed to bounce possible spam. Use it on low-scoring spam only (<10)
 and only to your regular customers for use in the rare case that a
 message is mis-tagged as spam when it shouldn't have been.
 Beware that many sites will automatically delete the bounce messages
 created by using this option unless you have agreed this with them in
 advance.
 If you enable this, be prepared to handle the irate responses from
 people to whom you are essentially sending more spam!

 This is the name of the Envelope From header
 controlled by the option above.
 This can also be the filename of a ruleset.

 This is the name of the Envelope To header
 controlled by the option above.
 This can also be the filename of a ruleset.

 Expand TNEF attachments using an external program (or a Perl module)?
 This should be "yes" unless the scanner you are using (Sophos, McAfee) has
 the facility built-in. However, if you set it to "no", then the filenames
 within the TNEF attachment will not be checked against the filename rules.

 Where the "file" command is installed.
 This is used for checking the content type of files, regardless of their
 filename.
 To disable Filetype checking, set this value to blank.

 If an attachment triggered a filename check, but there was nothing
 else wrong with the message, do you want to modify the subject line?
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      yes   = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line.
 This makes filtering in Outlook very easy.
 This can also be the filename of a ruleset.

 
 Set where to find the attachment filename ruleset.
 The structure of this file is explained elsewhere, but it is used to
 accept or reject file attachments based on their name, regardless of
 whether they are infected or not.

 This can also point to a ruleset, but the ruleset filename must end in
 ".rules" so that MailScanner can determine if the filename given is
 a ruleset or not!

 This is the text to add to the start of the subject if the
 "Filename Modify Subject" option is set.
 You might want to change this so your users can see at a glance
 whether it just was just the filename that MailScanner rejected.
 This can also be the filename of a ruleset.

 The maximum length of time the "file" command is allowed to run for 1
 batch of messages (in seconds).

 Set where to find the attachment filetype ruleset.
 The structure of this file is explained elsewhere, but it is used to
 accept or reject file attachments based on their content as determined
 by the "file" command, regardless of whether they are infected or not.

 This can also point to a ruleset, but the ruleset filename must end in
 ".rules" so that MailScanner can determine if the filename given is
 a ruleset or not!

 To disable this feature, set this to just "Filetype Rules =" or set
 the location of the file command to a blank string.

 Find zip archives by filename or by file contents?
 Finding them by content is a far more reliable way of finding them, but
 it does mean that you cannot tell your users to avoid zip file checking
 by renaming the file from ".zip" to "_zip" and tricks like that.
 Only set this to no (i.e. check by filename only) if you don't want to
 reliably check the contents of zip files. Note this does not affect
 virus checking, but it will affect all the other checks done on the contents
 of the zip file.
 This can also be the filename of a ruleset.

 Do you want to check for "Phishing" attacks?
 These are attacks that look like a genuine email message from your bank,
 which contain a link to click on to take you to the web site where you
 will be asked to type in personal information such as your account number
 or credit card details.
 Except it is not the real bank's web site at all, it is a very good copy
 of it run by thieves who want to steal your personal information or
 credit card details.
 These can be spotted because the real address of the link in the message
 is not the same as the text that appears to be the link.
 Note: This does cause extra load, particularly on systems receiving lots
       of spam such as secondary MX hosts.
 This can also be the filename of a ruleset.

 A few viruses store their infected data in UU-encoded files, to try to
 catch out virus scanners. This rarely succeeds at all.
 Setting this option to yes means that you can apply filename and filetype
 checks to the contents of UU-encoded files. This may occasionally be
 useful, in which case you should set to yes.
 This can also be the filename of a ruleset.

 Do the spam checks first, or the MCP checks first?
 This cannot be the filename of a ruleset, only a fixed value.

 Options specific to F-Protd-6 Anti-Virus
 ----------------------------------------

 This is the port number used by the local fpscand daemon. 10200 is the
 default value used by the F-Prot 6 installation program, and so should
 be correct.
 This option cannot be the filename of a ruleset, it must be a number.

 Where the "gunzip" command is installed.
 This is used for expanding .gz files.
 To disable gzipped file checking, set this value to blank
 and the timeout to 0.

 The maximum length of time the "gunzip" command is allowed to run to expand
 1 attachment file (in seconds).

 Hide the directory path from all virus scanner reports sent to users.
 The extra directory paths give away information about your setup, and
 tend to just confuse users.
 This can also be the filename of a ruleset.

 Hide the directory path from all the system administrator notices.
 The extra directory paths give away information about your setup, and
 tend to just confuse users but are still useful for local sys admins.
 This can also be the filename of a ruleset.

 If a phishing fraud is detected, do you want to highlight the tag with
 a message stating that the link may be to a fraudulent web site.
 This can also be the filename of a ruleeset.

 This is just like the "Spam Actions" option above, except that it applies
 when the score from SpamAssassin is higher than the "High SpamAssassin Score"
 value.
    deliver                 - deliver the message as normal
    delete                  - delete the message
    store                   - store the message in the (spam) quarantine
    store-nonmcp            - store the message in the non-MCP quarantine
    store-mcp               - store the message in the MCP quarantine
    store-nonspam           - store the message in the non-spam quarantine
    store-spam              - store the message in the spam quarantine
    store-<directory-path>  - store the message in the <directory-path>
    forward user@domain.com - forward a copy of the message to user@domain.com
                              See the note below about the keywords that
                              can be used.
    striphtml               - convert all in-line HTML content to plain text.
                              You need to specify "deliver" as well for the
                              message to reach the original recipient.
    attachment              - Convert the original message into an attachment
                              of the message. This means the user has to take
                              an extra step to open the spam, and stops "web
                              bugs" very effectively.
    notify                  - Send the recipients a short notification that
                              spam addressed to them was not delivered. They
                              can then take action to request retrieval of
                              the original message if they think it was not
                              spam.
    header "name: value"    - Add the header
                                name: value
                              to the message. name must not contain any spaces.
                              The "value" may contain the magic keyword "_TO_"
                              anywhere in it. _TO_ will be replaced by a
                              comma-separated list of the original recipients
                              of the message. This is very useful if you just
                              forward the message to a new address and don't
                              use the "deliver" action, as otherwise the list
                              of the original recipients may be lost.
    custom(parameter)       - Call the CustomAction function in /usr/lib/Mail-
                              Scanner/MailScanner/CustomFunctions/CustomAction
                              .pm with the 'parameter' passed in. This can be
                              used to implement any custom action you require.

 "forward" keywords
 ==================
 In an email address specified in the "forward" action, several keywords can
 be used which will be substituted with various properties of the message:
 _FROMUSER_   The left-hand side of the address of the sender.
 _FROMDOMAIN_ The right-hand side of the address of the sender.
 _TOUSER_     The left-hand side of each of the recipients in turn.
 _TODOMAIN_   The right-hand side of each of the recipients in turn.
 _DATE_       The date the message was received by MailScanner.
 _HOUR_       The hour the message was received by MailScanner.
 This means that you can forward messages to email addresses which show the
 original recipients of the message, which could be very useful when
 delivering into spam archive management systems.

 The default value I have set here enables Thunderbird to automatically
 handle spam when set to trust the "SpamAssassin" headers.

 This can also be the filename of a ruleset, in which case the filename
 must end in ".rule" or ".rules".

 This is just like the "Spam Modify Subject" option above, except that
 it applies when the score from SpamAssassin is higher than the
 "High SpamAssassin Score" value.
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      yes   = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line.
 This can also be the filename of a ruleset.

 This is just like the "Spam Subject Text" option above, except that
 it applies when the score from SpamAssassin is higher than the
 "High SpamAssassin Score" value.
 The exact string "_SCORE_" will be replaced by the numeric
 SpamAssassin score.
 The exact string "_STARS_" will be replaced by a row of stars
 whose length is the SpamAssassin score.
 This can also be the filename of a ruleset.

 If a message achieves a SpamAssassin score higher than this value,
 then the "High Scoring Spam Actions" are used. You may want to use
 this to deliver moderate scores, while deleting very high scoring messsages.
 This can also be the filename of a ruleset.

 Name of this host, or a name like "The MailScanner" if you want to hide
 the real hostname. It is used in the Help Desk note contained in the
 virus warnings sent to users.
 Remember you can use $HOSTNAME in here, so you might want to set it to
 Hostname = The %org-name% ($HOSTNAME) MailScanner
 This can also be the filename of a ruleset.

 Setting this adds the MailScanner message id number to a header
 in the message. If you do not want this header, just set this to be
 an empty string (put nothing after the '=').
 This can also be the filename of a ruleset.

 This is a list of filenames (or parts of filenames) that may appear in
 the filename of a web bug URL. They are only checked in the filename,
 not any directories or hostnames in the URL of the possible web bug.

 If it appears, then the web bug is assumed to be a harmless "spacer" for
 page layout purposes and not a real web bug at all.
 It should be a space- and/or comma-separated list of filename parts.

 Note: Use this with care, as spammers may use this to circumvent the
       web bug trap. It is disabled by default because of this problem.

 This can also be the filename of a ruleset.
Ignored Web Bug Filenames = spacer pixel.gif pixel.png

 Spammers have learnt that they can get their message through by sending
 a message with lots of recipients, one of which chooses to whitelist
 everything coming to them, including the spammer.
 So if a message arrives with more than this number of recipients, ignore
 the "Is Definitely Not Spam" whitelist.

 Normally, SpamAssassin skips over all non-text attachments and does not
 scan them for indications that the message is spam.
 This setting over-rides that behaviour, telling SpamAssassin to scan all
 attachments regardless of type. This can be very useful for spotting rude
 and derogatory content in Microsoft Word documents, for example.
 However, it does slightly slow SpamAssassin and so is disabled by default.
 Setting this to "yes" will have no effect without a small patch to the
 SpamAssassin code. You can fetch the patch for your version of SpamAssassin
 from "http://www.mailscanner.info/mcp.htmlpatches". That web page will
 explain in detail how to apply the patch.
 This can also be the filename of a ruleset.

 Include the name of the virus scanner in each of the scanner reports.
 This also includes the translation of "MailScanner" in each of the report
 lines resulting from one of MailScanner's own checks such as filename,
 filetype or dangerous HTML content. To change the name "MailScanner", look
 in reports/...../languages.conf.

 Very useful if you use several virus scanners, but a bad idea if you
 don't want to let your customers know which scanners you use.

 Do you want to include the numerical scores in the detailed SpamAssassin
 report, or just list the names of the scores

 Set location of incoming mail queue

 This can be any one of
 1. A directory name
    Example: /var/spool/mqueue.in
 2. A wildcard giving directory names
    Example: /var/spool/mqueue.in/*
 3. The name of a file containing a list of directory names,
    which can in turn contain wildcards.
    Example: /opt/MailScanner/etc/mqueue.in.list.conf

 If you are using sendmail and have your queues split into qf, df, xf
 directories, then just specify the main directory, do not give me the
 directory names of the qf,df,xf directories.
 Example: if you have /var/spool/mqueue.in/qf
                      /var/spool/mqueue.in/df
                      /var/spool/mqueue.in/xf
 then just tell me /var/spool/mqueue.in. I will find the subdirectories
 automatically.

 Set where to unpack incoming messages before scanning them
 This can completely safely use tmpfs or a ramdisk, which will
 give you a significant performance improvement.
 NOTE: The path given here must not include any links at all,
 NOTE: but must be the absolute path to the directory.
 NOTE: If you change this, you should change these too:
 NOTE:        SpamAssassin Temporary Dir
 NOTE:        SpamAssassin Cache Database File

 If you want processes running under the same *group* as MailScanner to
 be able to read the working files (and list what is in the
 directories, of course), set to 0640. If you want *all* other users to
 be able to read them, set to 0644. For a detailed description, if
 you're not already familiar with it, refer to `man 2 chmod`.
 Typical use: external helper programs of virus scanners (notably ClamAV),
 like unpackers.
 Use with care, you may well open security holes.

 Note: If the "Run As User" is "root" (or not set at all) and you are
       using the "clamd" virus scanner, then this must be set:
       Incoming Work Group = clamav
       Incoming Work Permissions = 0640

 If you want to create the temporary working files so they are owned
 by a user other than the "Run As User" setting at the top of this file,
 you can change that here.

 Note: If the "Run As User" is not "root" you cannot change the
       user but may still be able to change the group, if the
       "Run As User" is a member of both of the groups "Run As Group"
       and "Incoming Work Group"
 Note: If the "Run As User" is "root" (or not set at all) and you are
       using the "clamd" virus scanner AND clamd is not running as root,
       then this must be set to the group clamd is using (from your
       clamd.conf), example:
       Incoming Work Group = clamav
       Incoming Work Permissions = 0640

 Add this extra header to all mail as it is processed.
 The contents is set by "Information Header Value" and is intended for
 you to be able to insert a help URL for your users.
 If you don't want an information header at all, just comment out this
 setting or set it to be blank.
 This can also be the filename of a ruleset.

 Set the "Information Header" to this value.
 This can also be the filename of a ruleset.

 Set where to find the HTML and text versions that will be added to the
 end of all clean messages, if "Sign Clean Messages" is set.
 These can also be the filenames of rulesets.

 Set where to find the HTML and text versions that will be inserted at
 the top of messages that have had viruses removed from them.
 These can also be the filenames of rulesets.

 If you use the 'attachment' Spam Action or High Scoring Spam Action
 then this is the location of inline spam report that is inserted at
 the top of the message.

 Was this message transmitted using IPv6 or IPv4 in its last hop?
 To stop this header appearing, set it to be blank.
 This can also be the filename of a ruleset.

 Spam Whitelist:
 Make this point to a ruleset, and anything in that ruleset whose value
 is "yes" will *never* be marked as spam.
 The whitelist check is done before the blacklist check. If anyone whitelists
 a message, then all recipients get the message. If no-one has whitelisted it,
 then the blacklist is checked.
 This setting over-rides the "Is Definitely Spam" setting.
 This can also be the filename of a ruleset.
Is Definitely Not Spam = no

 Spam Blacklist:
 Make this point to a ruleset, and anything in that ruleset whose value
 is "yes" will *always* be marked as spam.
 This value can be over-ridden by the "Is Definitely Not Spam" setting.
 This can also be the filename of a ruleset.

 Do you want to stop any virus-infected spam getting into the spam or MCP
 archives? If you have a system where users can release messages from the
 spam or MCP archives, then you probably want to stop them being able to
 release any infected messages, so set this to yes.
 It is set to no by default as it causes a small hit in performance, and
 many people don't allow users to access the spam quarantine, so don't
 need it.
 This can also be the filename of a ruleset.

 This is a list of server names (or parts of) which are known to host web
 bugs. All images from these hosts will be replaced by the "Web Bug
 Replacement" defined below.
 This can also be the filename of a ruleset.

 Set where to find all the strings used so they can be translated into
 your local language.
 This can also be the filename of a ruleset so you can produce different
 languages for different messages.

 Address of the local Postmaster, which is used as the "From" address in
 virus warnings sent to users.
 This can also be the filename of a ruleset.

 Where to put the virus scanning engine lock files.
 These lock files are used between MailScanner and the virus signature
 "autoupdate" scripts, to ensure that they aren't both working at the
 same time (which could cause MailScanner to let a virus through).

 How to lock spool files.
 Don't set this unless you *know* you need to.
 For sendmail, it defaults to "posix".
 For sendmail 8.12 and older, you will probably need to change it to flock,
 particularly on Linux systems.
 For Exim, it defaults to "posix".
 No other type is implemented.

 Log all occurrences of HTML tags found in messages, that can be blocked.
 This will help you build up your whitelist of message sources for which
 particular HTML tags should be allowed, such as mail from newsletters
 and daily cartoon strips.
 This can also be the filename of a ruleset.

 Do you want to log all messages that are delivered and not delivered
 to the original recipients. Note that this log output will include
 the Subject: of the original email, so is switched off by default.
 In some countries, particularly the EU, it may well be illegal to log
 the Subject: of email messages.

 Do you want all non-spam to be logged? Useful if you want to see
 all the SpamAssassin reports of mail that was marked as non-spam.
 Note: It will generate a lot of log traffic.

 Log all the filenames that are allowed by the MIME types set in Filetype
 Rules, or just the MIME tyes that are denied?
 This can also be the filename of a ruleset.

 Log all the filenames that are allowed by the Filename Rules, or just
 the filenames that are denied?
 This can also be the filename of a ruleset.

 Log all the filenames that are allowed by the Filetype Rules, or just
 the filetypes that are denied?
 This can also be the filename of a ruleset.

 Log all occurrences of "Silent Viruses" as defined above?
 This can only be a simple yes/no value, not a ruleset.

 Do you want all spam to be logged? Useful if you want to gather
 spam statistics from your logs, but can increase the system load quite
 a bit if you get a lot of spam.

 Log all actions from the "SpamAssassin Rule Actions" setting?
 This can also be the filename of a ruleset.

 Do you want to log the processing speed for each section of the code
 for a batch? This can be very useful for diagnosing speed problems,
 particularly in spam checking.

 Add this extra header to all mail as it is processed.
 This *must* include the colon ":" at the end.
 This can also be the filename of a ruleset.

 This is the version number of the MailScanner distribution that created
 this configuration file. Please do not change this value.

 Add the "Inline HTML Warning" or "Inline Text Warning" to the top of
 messages that have had attachments removed from them?
 This can also be the filename of a ruleset.

 When a message is to not be virus-scanned (which may happen depending
 upon the setting of "Virus Scanning", especially if it is a ruleset),
 do you want to add the header advising the users to get their email
 virus-scanned by you?
 Very good for advertising your MailScanning service and encouraging
 users to give you some more money and sign up to virus scanning.
 This can also be the filename of a ruleset.

 How many MailScanner processes do you want to run at a time?
 There is no point increasing this figure if your MailScanner server
 is happily keeping up with your mail traffic.
 If you are running on a server with more than 1 CPU, or you have a
 high mail load (and/or slow DNS lookups) then you should see better
 performance if you increase this figure.
 If you are running on a small system with limited RAM, you should
 note that each child takes just over 20MB.

 As a rough guide, try 5 children per CPU. But read the notes above.

 How much of the message should be passed to the Custom Spam Scanner.
 Most spam tools only need the first 20kbytes of the message to determine
 if it is spam or not. Passing more than is necessary only slows things
 down.
 This can also be the filename of a ruleset.

 If the Custom Spam Scanner times out more times in a row than this,
 then it will be marked as "unavailable" until MailScanner next re-
 starts itself.

 The maximum depth to which zip archives, rar archives and Microsoft Office
 documents will be unpacked, to allow for checking filenames and filetypes
 within zip and rar archives and embedded within Office documents.

 Note: This setting does *not* affect virus scanning in archives at all.

 To disable this feature set this to 0.
 A common useful setting is this option = 0, and Allow Password-Protected
 Archives = no. That block password-protected archives but does not do
 any filename/filetype checks on the files within the archive.
 This can also be the filename of a ruleset.

 The maximum size, in bytes, of any attachment in a message.
 If this is set to zero, effectively no attachments are allowed.
 If this is set less than zero, then no size checking is done.
 This can also be the filename of a ruleset, so you can have different
 settings for different users. You might want to set this quite small for
 large mailing lists so they don't get deluged by large attachments.
 This can also be the filename of a ruleset.

 The maximum number of attachments allowed in a message before it is
 considered to be an error. Some email systems, if bouncing a message
 between 2 addresses repeatedly, add information about each bounce as
 an attachment, creating a message with thousands of attachments in just
 a few minutes. This can slow down or even stop MailScanner as it uses
 all available memory to unpack these thousands of attachments.
 This can also be the filename of a ruleset.

 The maximum size, in bytes, of any message including the headers.
 If this is set to zero, then no size checking is done.
 This can also be the filename of a ruleset, so you can have different
 settings for different users. You might want to set this quite small for
 dialup users so their email applications don't time out downloading huge
 messages.

 Limit the number of attempts made at processing any particular message.
 If you get a message which repeatedly crashes MailScanner, it will
 limit the impact by ignoring the message and refusing to process it,
 after more than the given number of attempts have been made at it.
 Note that enabling this feature causes a slight performance hit.
 Set this to 0 to disable the limit and the entire Processing Attempts
 Database and its requirement for SQLite.
 This cannot be a ruleset, only a simple value.

 If more messages are found in the queue than this, then switch to an
 "accelerated" mode of processing messages. This will cause it to stop
 scanning messages in strict date order, but in the order it finds them
 in the queue. If your queue is bigger than this size a lot of the time,
 then some messages could be greatly delayed. So treat this option as
 "in emergency only".

 SpamAssassin is not very fast when scanning huge messages, so messages
 bigger than this value will be truncated to this length for SpamAssassin
 testing. The original message will not be affected by this. This value
 is a good compromise as very few spam messages are bigger than this.

 Now for the options:
 1) <length of data in bytes>
 2) <length of data in bytes> trackback
 3) <length of data in bytes> continue <max extra bytes allowed>

 1) Put in a simple number.
    This will be the simple cut-off point for messages that are larger than
    this number.
 2) Put in a number followed by 'trackback'.
    Once the size limit is reached, MailScanner reverses towards the start
    of the message, until it hits a line that is blank. The message passed
    to SpamAssassin is truncated there. This stops any part-images being
    passed to SpamAssassin, and so avoids rules which trigger on this.
 3) Put in a number followed by 'continue' followed by another number.
    Once the size limit is reached, MailScanner continues adding to the data
    passed to SpamAssassin, until at most the 2nd number of bytes have been
    added looking for a blank line. This tries to complete the image data
    that has been started when the 1st number of bytes has been reached,
    while imposing a limit on the amount that can be added (to avoid attacks).

 If all this confuses you, just leave it alone at "40k" as that is good.

 If SpamAssassin times out more times in a row than this, then it will be
 marked as "unavailable" until MailScanner next re-starts itself.
 This means that remote network failures causing SpamAssassin trouble will
 not mean your mail stops flowing.

 Spammers do not have the power to send out huge messages to everyone as
 it costs them too much (more smaller messages makes more profit than less
 very large messages). So if a message is bigger than a certain size, it
 is highly unlikely to be spam. Limiting this saves a lot of time checking
 huge messages.
 Disable this option by setting it to a huge value.
 This is measured in bytes.
 This can also be the filename of a ruleset.

 The maximum number of timeouts caused by any individual "Spam List" or
 "Spam Domain List" before it is marked as "unavailable". Once marked,
 the list will be ignored until the next automatic re-start (see
 "Restart Every" for the longest time it will wait).
 This can also be the filename of a ruleset.

 The rest of these options are clones of the equivalent spam options

 The minimum size, in bytes, of any attachment in a message.
 If this is set less than or equal to zero, then no size checking is done.
 It is very useful to set this to 1 as it removes any zero-length
 attachments which may be created by broken viruses.
 This can also be the filename of a ruleset.

 Minimum acceptable code stability status -- if we come across code
 that's not at least as stable as this, we barf.
 This is currently only used to check that you don't end up using untested
 virus scanner support code without realising it.
 Levels used are:
 none          - there may not even be any code.
 unsupported   - code may be completely untested, a contributed dirty hack,
                 anything, really.
 alpha         - code is pretty well untested. Don't assume it will work.
 beta          - code is tested a bit. It should work.
 supported     - code *should* be reliable.

 Don't even *think* about setting this to anything other than "beta" or
 "supported" on a system that receives real mail until you have tested it
 yourself and are happy that it is all working as you expect it to.
 Don't set it to anything other than "supported" on a system that could
 ever receive important mail.

 READ and UNDERSTAND the above text BEFORE changing this.

 This sets the minimum number of "Spam Score Characters" which will appear
 if a message triggered the "Spam List" setting but received a very low
 SpamAssassin score. This means that people who only filter on the "Spam
 Stars" will still be able to catch messages which receive a very low
 SpamAssassin score. Set this value to 0 to disable it.
 This can also be the filename of a ruleset.

 If a location specified in "Archive Mail" is not found, should it assume
 that the location is a file or a directory name?
 Before this option was added, it was always assumed to be a directory.
 However, if the _FROMUSER_, _FROMDOMAIN_, _TOUSER_, _TODOMAIN_, _DATE_
 or _HOUR_ tokens are used in the name of the location, it might be
 useful to store the messages in an mbox file containing the address of
 the recipient.

 This can also be the filename of a ruleset.

 ClamAVModule only: monitor each of these files for changes in size to
 detect when a ClamAV update has happened.
 This is only used by the "clamavmodule" virus scanner, not the "clamav"
 scanner setting.

 SophosSAVI only: monitor each of these files for changes in size to
 detect when a Sophos update has happened. The date of the Sophos Lib Dir
 is also monitored.
 This is only used by the "sophossavi" virus scanner, not the "sophos"
 scanner setting.

 Set whether to use postfix, sendmail, exim or zmailer.
 If you are using postfix, then see the "SpamAssassin User State Dir"
 setting near the end of this file

 What to do when you get several MailScanner headers in one message,
 from multiple MailScanner servers. Values are
      "append"  : Append the new data to the existing header
      "add"     : Add a new header
      "replace" : Replace the old data with the new data
 Default is "append"
 This can also be the filename of a ruleset.

 If you supply a space-separated list of message "precedence" settings,
 then senders of those messages will not be warned about anything you
 rejected. This is particularly suitable for mailing lists, so that any
 MailScanner responses do not get sent to the entire list.

 Strings listed here will be searched for in the output of the virus scanners.
 It works to achieve the opposite effect of the "Silent Viruses" listed above.
 If a string here is found in the output of the virus scanners, then the
 message will be treated as if it were not infected with a "Silent Virus".
 If a message is detected as both a silent virus and a non-forging virus,
 then the ___non-forging status will override the silent status.___
 In simple terms, you should list virus names (or parts of them) that you
 know do *not* forge the From address.
 A good example of this is a document macro virus or a Joke program.
 Another word that can be put in this list is the special keyword
    Zip-Password  : inserting this will cause senders to be warned about
                    password-protected zip files, when they are not allowed.
                    This will over-ride the All-Viruses setting in the list
                    of "Silent Viruses" above.

 This is just like the "Spam Actions" option above, except that it applies
 to messages that are *NOT* spam.
    deliver                 - deliver the message as normal
    delete                  - delete the message
    store                   - store the message in the (non-spam) quarantine
    store-nonmcp            - store the message in the non-MCP quarantine
    store-mcp               - store the message in the MCP quarantine
    store-nonspam           - store the message in the non-spam quarantine
    store-spam              - store the message in the spam quarantine
    store-<directory-path>  - store the message in the <directory-path>
    forward user@domain.com - forward a copy of the message to user@domain.com
                              See the note below about the keywords that
                              can be used.
    striphtml               - convert all in-line HTML content to plain text
    header "name: value"    - Add the header
                                name: value
                              to the message. name must not contain any spaces.
                              The "value" may contain the magic keyword "_TO_"
                              anywhere in it. _TO_ will be replaced by a
                              comma-separated list of the original recipients
                              of the message. This is very useful if you just
                              forward the message to a new address and don't
                              use the "deliver" action, as otherwise the list
                              of the original recipients may be lost.
    custom(parameter)       - Call the CustomAction function in /usr/lib/Mail-
                              Scanner/MailScanner/CustomFunctions/CustomAction
                              .pm with the 'parameter' passed in. This can be
                              used to implement any custom action you require.

 "forward" keywords
 ==================
 In an email address specified in the "forward" action, several keywords can
 be used which will be substituted with various properties of the message:
 _FROMUSER_   The left-hand side of the address of the sender.
 _FROMDOMAIN_ The right-hand side of the address of the sender.
 _TOUSER_     The left-hand side of each of the recipients in turn.
 _TODOMAIN_   The right-hand side of each of the recipients in turn.
 _DATE_       The date the message was received by MailScanner.
 _HOUR_       The hour the message was received by MailScanner.
 This means that you can forward messages to email addresses which show the
 original recipients of the message, which could be very useful when
 delivering into spam archive management systems.

 The default value I have set here enables Thunderbird to automatically
 handle spam when set to trust the "SpamAssassin" headers.

 This can also be the filename of a ruleset, in which case the filename
 must end in ".rule" or ".rules".

 The visible part of the email address used in the "From:" line of the
 notices. The <user@domain> part of the email address is set to the
 "Local Postmaster" setting.

 What signature to add to the bottom of the notices.
 To insert a line-break in there, use the sequence "\n".

 Include the full headers of each message in the notices sent to the local
 system administrators?
 This can also be the filename of a ruleset.

 Where to send the notices.
 This can also be the filename of a ruleset.

 Do you want to notify the people who sent you messages containing
 viruses or badly-named filenames?
 This can also be the filename of a ruleset.

 *If* "Notify Senders" is set to yes, do you want to notify people
 who sent you messages containing attachments that are blocked due to
 their filename or file contents?
 This can also be the filename of a ruleset.

 *If* "Notify Senders" is set to yes, do you want to notify people
 who sent you messages containing attachments that are blocked due to
 being too small or too large?
 This can also be the filename of a ruleset.

 *If* "Notify Senders" is set to yes, do you want to notify people
 who sent you messages containing other blocked content, such as
 partial messages or messages with external bodies?
 This can also be the filename of a ruleset.

 *If* "Notify Senders" is set to yes, do you want to notify people
 who sent you messages containing viruses?
 The default value has been changed to "no" as most viruses now fake
 sender addresses and therefore should be on the "Silent Viruses" list.
 This can also be the filename of a ruleset.

 Set location of outgoing mail queue.
 This can also be the filename of a ruleset.

 As an opposite to the "safe" list above, there is also a live continuously-
 updated list of known bad sites, which will always trigger the "Find
 Phishing Fraud" test described above.
 This is a space-separated list of the names of files which contain
 a list of link destinations which should always trigger the test. This
 file should be updated hourly.
 This can only be the name of the file containing the list, it *cannot*
 be the filename of a ruleset.

 If a potential phishing attack is found in the message, do you want to
 modify the subject line?
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      yes   = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line.
 This can also be the filename of a ruleset.

 There are some companies, such as banks, that insist on sending out
 email messages with links in them that are caught by the "Find Phishing
 Fraud" test described above.
 This is a space-separated list of the names of files which contain a
 list of link destinations which should be ignored in the test. This may,
 for example, contain the known websites of some banks.
 See the file itself for more information.
 This can only be the names of the files containing the list, it *cannot*
 be the filename of a ruleset.

 This is the text to add to the start of the subject if the "Phishing
 Modify Subhect" option is set.
 This can also be the filename of a ruleset.

 Set where to store the process id number so you can stop MailScanner

 Some people prefer that message headers are added in strict order with
 the newest headers at the top and the oldest headers at the bottom.
 This is also required if you receive a message which is authenticated by
 DKIM, and you are forwarding that message onto somewhere else, and want
 not to break the DKIM signature.
 **Note**: To avoid breaking DKIM signatures, you *must* also set
   Multiple Headers = add
 So if some of your users forward mail from PayPal, Ebay or Yahoo! to
 accounts stored on Gmail or Googlemail, then you need to set this to "yes"
 and "Multiple Headers = add" to avoid breaking the DKIM signature.
 It may be worth using a ruleset to just apply this to messages sent by
 the companies mentioned above.
 This can also be the filename of a ruleset.

 This is the location of the database file used to track the number of
 times any message has been attempted.
 To clear out the database, just delete the file, MailScanner will re-
 create it automatically when it starts.

 Set where to store infected and message attachments (if they are kept)
 This can also be the filename of a ruleset.

 Do you want to store copies of the infected attachments and messages?
 This can also be the filename of a ruleset.

 Do you want to store copies of messages which have been disarmed by
 having their HTML modified at all?
 This can also be the filename of a ruleset.

 If you want processes running under the same *group* as MailScanner to
 be able to read the quarantined files (and list what is in the
 directories, of course), set to 0640. If you want *all* other users to
 be able to read them, set to 0644. For a detailed description, if
 you're not already familiar with it, refer to `man 2 chmod`.
 Typical use: let the webserver have access to the files so users can
 download them if they really want to.
 Use with care, you may well open security holes.

 There is no point quarantining most viruses these days as the infected
 messages contain no useful content, so if you set this to "no" then no
 infections listed in your "Silent Viruses" setting will be quarantined,
 even if you have chosen to quarantine infections in general. This is
 currently set to "yes" so the behaviour is the same as it was in
 previous versions.
 This can also be the filename of a ruleset.

 If you want to create the quarantine/archive so the files are owned
 by a user other than the "Run As User" setting at the top of this file,
 you can change that here.
 Note: If the "Run As User" is not "root" then you cannot change the
       user but may still be able to change the group, if the
       "Run As User" is a member of both of the groups "Run As Group"
       and "Quarantine Group".

 Do you want to quarantine the original *entire* message as well as
 just the infected attachments?
 This can also be the filename of a ruleset.

 When you quarantine an entire message, do you want to store it as
 raw mail queue files (so you can easily send them onto users) or
 as human-readable files (header then body in 1 file)?

 How often (in seconds) should each process check the incoming mail
 queue for new messages? If you have a quiet mail server, you might
 want to increase this value so it causes less load on your server, at
 the cost of slightly increasing the time taken for an average message
 to be processed.

 When working out from IP address the message was sent from,
 no or 0  ==> use the SMTP client address, ie. the address of the system
              talking to the MailScanner server. This is the normal setting.
 yes or 1 ==> use the first IP address contained in the first "Received:"
              header at the top of the email message's headers.
 Any number > 1 ==> use the first IP address contained in the n-th
                    "Received:" header starting from the top of the email
                    message's headers.
 Users of BarricadeMX should note that this setting will always be forced
 to 2, so it will always give you IP address of the system connecting to
 BarricadeMX.

 This is very useful when you are injecting mail into a MailScanner server
 using "fetchmail" as otherwise all mail will appear to be coming from the
 the IP address of the system running "fetchmail", and not the address the
 mail actually came from.
 You need to use this together with the "invisible" option in "fetchmail",
 so that "fetchmail" does not add its own "Received:" header to the start
 of the message.

 This value *cannot* be the filename of a ruleset.

 If you are using the Bayesian statistics engine on a busy server,
 you may well need to force a Bayesian database rebuild and expiry
 at regular intervals. This is measures in seconds.
 1 day = 86400 seconds.
 To disable this feature set this to 0.
 Note: If you enable this feature, set "bayes_auto_expire 0" in
       spam.assasssin.prefs.conf which you will find in the same
       directory as this file.

 If you use the 'notify' Spam Action or High Scoring Spam Action then
 this is the location of the notification message that is sent to the
 original recipients of the message.

 Set where to find the message text sent to users who triggered the ruleset
 you are using with the "Reject Message" option.

 You may not want to receive mail from certain addresses and/or to certain
 addresses. If so, you can do this with your email transport (sendmail,
 Postfix, etc) but that will just send a one-line message which is not
 helpful to the user sending the message.
 If this is set to yes, then the message set by the "Rejection Report"
 will be sent instead, and the incoming message will be deleted.
 If you want to store a copy of the original incoming message then use the
 "Archive Mail" setting to archive a copy of it.
 The purpose of this option is to set it to be a ruleset, so that you
 can reject messages from a few offending addresses where you need to  send
 a polite reply instead of just a brief 1-line rejection message.

 If any of these headers are included in a a message, they will be deleted.
 This is a space-separated list of a mixture of any combination of
 1. Names of headers, optionally ending with a ':'
    (the ':' will be added if not supplied)
 2. Regular expressions starting and ending with a '/'.
    These regular expressions are matched against the entire header line,
    not just the name of the header.
    **NOTE** The regular expressions must *not* contain spaces,
             so use '\s' instead of ' '.
 This is very useful for removing return-receipt requests and any headers
 which mean special things to your email client application.
 X-Mozilla-Status is bad as it allows spammers to make a message appear to
 have already been read, which is believed to bypass some naive spam
 filtering systems.
 Receipt requests are bad as they give any attacker confirmation that an
 account is active and being read. You don't want this sort of information
 to leak outside your corporation. So you might want to remove
     Disposition-Notification-To
     Return-Receipt-To
     X-Confirm-Reading-To
     Disposition-Notification-To
     Receipt-Requested-To
     Confirm-Reading-To
     MDRcpt-To
     MDSend-Notifications-To
     Smtp-Rcpt-To
     Return-Receipt-To
     Read-Receipt-To
     X-Confirm-Reading-To
     X-Acknowledge-To
     Delivery-Receipt-To
     X-PMrqc
     Errors-To
     X-IMAPBase
     X-IMAP
     X-UID
     Status
     X-Status
     X-UIDL
     X-Keywords
     X-Mozilla-Status
     X-Mozilla-Status2
 If you are having problems with duplicate message-id headers when you
 release spam from the quarantine and send it to an Exchange server, then add
     Message-Id.
 Each header should end in a ":", but MailScanner will add it if you forget.
 Headers should be separated by commas or spaces.
 This can also be the filename of a ruleset.

 This replaces the SpamAssassin configuration value 'required_hits'.
 If a message achieves a SpamAssassin score higher than this value,
 it is spam. See also the High SpamAssassin Score configuration option.
 This can also be the filename of a ruleset, so the SpamAssassin
 required_hits value can be set to different values for different messages.

 To avoid resource leaks, re-start periodically. Forces a re-read of all
 the configuration files too, so new updates to the bad phishing sites list
 are read frequently.

 Group to run as (not normally used for sendmail)
Run As Group = mail
Run As Group = postfix

 User to run as (not normally used for sendmail)
 If you want to change the ownership or permissions of the quarantine or
 temporary files created by MailScanner, please see the "Incoming Work"
 settings later in this file.
Run As User = mail
Run As User = postfix

 Set Run In Foreground to "yes" if you want MailScanner to operate
 normally in foreground (and not as a background daemon).
 Use this if you are controlling the execution of MailScanner
 with a tool like DJB's 'supervise' (see http://cr.yp.to/daemontools.html).

 If this is set to "yes", then email messages passing through MailScanner
 will be processed and checked, and all the other options in this file
 will be used to control what checks are made on the message.

 If this is set to "no", then email messages will NOT be processed or
 checked *at all*, and so any viruses or other problems will be ignored.

 If this is set to "virus", then email messages will only be scanned for
 viruses and *nothing* else.

 The purpose of this option is to set it to be a ruleset, so that you
 can skip all scanning of mail destined for some of your users/customers
 and still scan all the rest.
 A sample ruleset would look like this:
   To:       bad.customer.com  no
   From:     ignore.domain.com no
   From:     my.domain.com     virus
   FromOrTo: default           yes
 That will scan all mail except mail to bad.customer.com and mail from
 ignore.domain.com. To set this up, put the 3 lines above into a file
 called /etc/MailScanner/rules/scan.messages.rules and set the next line to
 Scan Messages = %rules-dir%/scan.messages.rules
 This can also be the filename of a ruleset (as illustrated above).

 When the message has been scanned but no other subject line changes
 have happened, do you want modify the subject line?
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line, or
      yes   = Add text to the end of the subject line.
 This makes very good advertising of your MailScanning service.
 This can also be the filename of a ruleset.

 This is the text to add to the start/end of the subject line if the
 "Scanned Modify Subject" option is set.
 This can also be the filename of a ruleset.

 Set where to find the messages that are delivered to the sender, when they
 sent an email containing either an error, banned content, a banned filename
 or a virus infection.
 These can also be the filenames of rulesets.

 There are 3 reports:
   Sender Spam Report         -  sent when a message triggers both a Spam
                                 List and SpamAssassin,
   Sender Spam List Report    -  sent when a message triggers a Spam List,
   Sender SpamAssassin Report -  sent when a message triggers SpamAssassin.

 These can also be the filenames of rulesets.

 Set how to invoke MTA when sending messages MailScanner has created
 (e.g. to sender/recipient saying "found a virus in your message")
 This can also be the filename of a ruleset.

 Sendmail2 is provided for Exim users.
 It is the command used to attempt delivery of outgoing cleaned/disinfected
 messages.
 This is not usually required for sendmail.
 This can also be the filename of a ruleset.
For Exim users: Sendmail2 = /usr/sbin/exim -C /etc/exim/exim_send.conf
For sendmail users: Sendmail2 = /usr/lib/sendmail
Sendmail2 = /usr/sbin/sendmail -C /etc/exim/exim_send.conf

 Notify the local system administrators ("Notices To") when any infections
 are found?
 This can also be the filename of a ruleset.

 When using an image in the signature, there are 2 filenames which need
 to be set. The first is the location in this server's filesystem of the
 image file itself. The second is the name of the image as it is stored in
 the attachment. The HTML version of the signature will refer to this
 second name in the HTML <img> tag.
 Note: the filename extension will be used as the MIME subtype, so a GIF
 image must end in ".gif" for example. (.jpg ==> "jpeg" as a special case)
 See "Attach Image To Signature" for notes on how to use this.

 Add the "Inline HTML Signature" or "Inline Text Signature" to the end
 of uninfected messages?
 If you add your own signature in your email application, and include the
 magic token "_SIGNATURE_" in your email message, the signature will be
 inserted just there, rather than at the end of the message.
 This can also be the filename of a ruleset.

 If this is "no", then (as far as possible) messages which have already
 been processed by another MailScanner server will not have the clean
 signature added to the message. This prevents messages getting many
 copies of the signature as they flow through your site.
 This can also be the filename of a ruleset.

 Strings listed here will be searched for in the output of the virus scanners.
 It is used to list which viruses should be handled differently from other
 viruses. If a virus name is given here, then
 1) The sender will not be warned that he sent it
 2) No attempt at true disinfection will take place
    (but it will still be "cleaned" by removing the nasty attachments
     from the message)
 3) The recipient will not receive the message,
    unless the "Still Deliver Silent Viruses" option is set
 Other words that can be put in this list are the 5 special keywords
    HTML-IFrame   : inserting this will stop senders being warned about
                    HTML Iframe tags, when they are not allowed.
    HTML-Codebase : inserting this will stop senders being warned about
                    HTML Object Codebase/Data tags, when they are not allowed.
    HTML-Script   : inserting this will stop senders being warned about
                    HTML Script tags, when they are not allowed.
    HTML-Form     : inserting this will stop senders being warned about
                    HTML Form tags, when they are not allowed.
    Zip-Password  : inserting this will stop senders being warned about
                    password-protected zip files, when they are not allowed.
                    This keyword is not needed if you include All-Viruses.
    All-Viruses   : inserting this will stop senders being warned about
                    any virus, while still allowing you to warn senders
                    about HTML-based attacks. This includes Zip-Password
                    so you don't need to include both.

 The default of "All-Viruses" means that no senders of viruses will be
 notified (as the sender address is always forged these days anyway),
 but anyone who sends a message that is blocked for other reasons will
 still be notified.

 This can also be the filename of a ruleset.

 If an attachment or the entire message triggered a size check, but
 there was nothing else wrong with the message, do you want to modify
 the subject line?
 This can be 1 of 4 values:
      no    = Do not modify the subject line, or
      start = Add text to the start of the subject line, or
      yes   = Add text to the start of the subject line, or
      end   = Add text to the end of the subject line.
 This makes filtering in Outlook very easy.
 This can also be the filename of a ruleset.

 This is the text to add to the start of the subject if the
 "Size Modify Subject" option is set.
 You might want to change this so your users can see at a glance
 whether it just was just the message or attachment size that
 MailScanner rejected.
 This can also be the filename of a ruleset.

 The directory (or a link to it) containing all the Sophos *.ide files.
 This is only used by the "sophossavi" virus scanner, and is irrelevant
 for all other scanners.

 The directory (or a link to it) containing all the Sophos *.so libraries.
 This is only used by the "sophossavi" virus scanner, and is irrelevant
 for all other scanners.

 This is a list of actions to take when a message is spam.
 It can be any combination of the following:
    deliver                 - deliver the message as normal
    delete                  - delete the message
    store                   - store the message in the (spam) quarantine
    store-nonmcp            - store the message in the non-MCP quarantine
    store-mcp               - store the message in the MCP quarantine
    store-nonspam           - store the message in the non-spam quarantine
    store-spam              - store the message in the spam quarantine
    store-<directory-path>  - store the message in the <directory-path>
    bounce                  - send a rejection message back to the sender
    forward user@domain.com - forward a copy of the message to user@domain.com
                              See the note below about the keywords that
                              can be used.
    striphtml               - convert all in-line HTML content to plain text.
                              You need to specify "deliver" as well for the
                              message to reach the original recipient.
    attachment              - Convert the original message into an attachment
                              of the message. This means the user has to take
                              an extra step to open the spam, and stops "web
                              bugs" very effectively.
    notify                  - Send the recipients a short notification that
                              spam addressed to them was not delivered. They
                              can then take action to request retrieval of
                              the original message if they think it was not
                              spam.
    header "name: value"    - Add the header
                                name: value
                              to the message. name must not contain any spaces.
                              The "value" may contain the magic keyword "_TO_"
                              anywhere in it. _TO_ will be replaced by a
                              comma-separated list of the original recipients
                              of the message. This is very useful if you just
                              forward the message to a new address and don't
                              use the "deliver" action, as otherwise the list
                              of the original recipients may be lost.
    custom(parameter)       - Call the CustomAction function in /usr/lib/Mail-
                              Scanner/MailScanner/CustomFunctions/CustomAction
                              .pm with the 'parameter' passed in. This can be
                              used to implement any custom action you require.

 "forward" keywords
 ==================
 In an email address specified in the "forward" action, several keywords can
 be used which will be substituted with various properties of the message:
 _FROMUSER_   The left-hand side of the address of the sender.
 _FROMDOMAIN_ The right-hand side of the address of the sender.
 _TOUSER_     The left-hand side of each of the recipients in turn.
 _TODOMAIN_   The right-hand side of each of the recipients in turn.
 _DATE_       The date the message was received by MailScanner.
 _HOUR_       The hour the message was received by MailScanner.
 This means that you can forward messages to email addresses which show the
 original recipients of the message, which could be very useful when
 delivering into spam archive management systems.

 The default value I have set here enables Thunderbird to automatically
 handle spam when set to trust the "SpamAssassin" headers.

 This can also be the filename of a ruleset, in which case the filename
 must end in ".rule" or ".rules".
Spam Actions = store forward anonymous@ecs.soton.ac.uk

 Set this option to "yes" to enable the automatic whitelisting functions
 available within SpamAssassin. This will cause addresses from which you
 get real mail, to be marked so that it will never incorrectly spam-tag
 messages from those addresses.
 To disable whitelisting, you must set "use_auto_whitelist 0" in your
 spam.assassin.prefs.conf file as well as set this to no.

 The SpamAssassin cache uses a database file which needs to be writable
 by the MailScanner "Run As User". This file will be created and setup for
 you automatically when MailScanner is started.
 Note: If you move the "Incoming Work Dir" then you should move this too.