mailavenger for Debian
======================

Reference:
 A. Quick-n-painless three-steps cook list
 B. Additional Basic Tips
 C. Greylisting on MailAvenger
 D. Expirable Email Addresses
 E. Extra Information about MailAvenger

		
A.	Quick-n-painless three-steps cook list
	--------------------------------------

1. /etc/avenger/asmtpd.conf:

 Replace 'BindAddr' and 'Hostname' with the proper values.

 Take into account that you have to put your public IP here, or in case you are
  relaying email from a WAN/MAN/CAN etc, the IP of the interface in which 
  you see them.
 
 The MailAvenger SMTP (asmtpd) will attach to interface and bind for listing to
 TCP SYN fingerprints and network/routing information.

 For example:

 # head -n 5 /etc/avenger/asmtpd.conf 
 # Sample asmtpd.conf file, suitable for sendmail

 BindAddr 10.4.21.225
 Hostname smtp.man.debian.org

 
2. /etc/avenger/domains

 Think of any other domain(s) that doesn't match your MailAvenger hostname, 
  which you have already set in Part 1 above.
 
 In order to let MailAvenger SMTP know you authorize certain domains to be
  accepted for relaying, you have to add them in a one-per-line fashion,
  followed by a ':' (without the quotes) as the end of each line.

 For example:

 # head -n 5  /etc/avenger/domains 
 danzi.node.man.debian.org:
 donizetti.node.man.debian.org:
 eysler.node.man.debian.org:
 finzi.node.man.debian.org:
 fischer.node.man.debian.org:
 
 
3. enable the service at boot time
 a. If using systemd as init:

   systemctl enable mailavenger.service
   systemctl start mailavenger.service

 b. for things that still use the /etc/init.d/mailavenger script:

   In: /etc/default/mailavenger

   Switch the MailAvenger daemon on by taking out 'no' at RUN_DAEMON.
 
    -----------------------------------------------------------------------
     Do not delete or comment it out, otherwise MailAvenger will not start
    -----------------------------------------------------------------------

   then run:

     service mailavenger start

 ALL SET!!!
 Now your will have to take a look at your Mail log to watch them fall down 
 
 :-)


B.	Additional Basic Tips
	---------------------


 By default, MailAvenger is configured to log SMTP transactions in a debug mode
 This is because in the very first tries you'll be able to quickly find,
 in case of existing, any network misconfiguration or a missing authentic
 sender domain that you forgot to append at the 'domains' file at (A) Part 2.

 In addition to that, if you happen to receive (many) frequent emails from a 
  friendly and known sender, you may not want him to wait or spend some extra
  time for a STMP transaction, so you can white-list him into your MailAvenger
  setup.

 On the other hand, you also may want to white-list some servers that have poor
  Mail configuration, and, sure, let them know that they are not complaining
  with STMP standards in a nice and distinguish mail, but remember, not all the
  network/system administrators do care as much as you do for standardizing,
  and, of course, try not to verbosely laugh that much at them ;-)

 You can achieve this by fixing their IPs/Domains into the asmtpd.conf file.

 For example:

 # egrep '(TrustedNet|TrustedDomain)' /etc/avenger/asmtpd.conf 
 TrustedNet 10.4.13.225
 TrustedNet 10.4.14.33
 TrustedNet 10.4.14.225
 TrustedDomain 1.dhcptrustedpool.man.debian.org
 TrustedDomain 2.dhcptrustedpool.man.debian.org


C. 	Greylisting on MailAvenger
	--------------------------
 
 One of the awesome features of MailAvenger is that, even thought it handles
  mail filtering at SMTP'ing time, it keeps being flexible enough to create 
  YOUR OWN decision paths about what/who to send into a temporarily reject 
  list, also known as "Greylisting" technique.

 The concept behind Greylisting is pretty basic[0]:
 Temporarily reject any email from a sender that is't recognized by the you.
 
 Case A:
 If the mail is legitimate the originating server will, after a certain delay,
  try again and, if sufficient time has elapsed, the email will be accepted. 
 
 Case B:
 If the mail is from a spam sender, sending to many thousands of email 
  addresses, it will probably not be retried.


 Example
 =======

 This is simple but powerful example I took from Thomer M. Gil site[1] with a
  minor modification, that you'll find into /usr/share/doc/mailavenger/examples

  # cat /etc/avenger/default
  errcheck
  case "$SPF0" in
      error)
          defer "Temporary error in SPF record processing"
          ;;
      pass)
          accept "SPF sender PASS"
          ;;
  esac
  
  greylist_delay=5m
  greylist_ttl1=5h
  greylist_ttl2=4D

  greylist "${CLIENT_IP%.*} $RECIPIENT $SENDER"
  
  accept

  Explanation ( See also the avenger(1) manual page ).

  This 'default' file discards email that MailAvenger has flagged as coming
   from a non-existent sender (errcheck). 
  Then it immediately accepts email that comes from a SPF-verified sender 
   (accept "SPF sender PASS"). 
  Otherwise it greylists the sender's IP address (in fact, the /24) by telling
   it to send the email again in 5 minutes (greylist "${CLIENT_IP%.*} $RE....)
  Then (when the email comes a few minutes later), gets accepted and handed 
   to the MTA (which is responsible for delivering it to the user). 
 
  
  This is a MailAvenger output at /var/log/mail.log on a MTA waiting for them:


0. http://en.wikipedia.org/wiki/Greylisting
1. http://thomer.com/howtos/fight_spam.html


D. 	Expirable Email Addresses
	-------------------------

 Using the Mail Avenger macutil command.
  
 Create a file called $HOME/.avenger/.macutil containing a single line of text 
  that will be your password for macutil. It doesn't matter what you put in 
  there, as long as it is hard for spammers to guess.
  
 If your primary email address is user@your.host.com, then add the following:

 For csh users and derived shells
  At ~/.login:

	setenv MACUTIL_SENDER 'user+return+*@your.host.com'
	setenv MACUTIL_SENDMAIL '/usr/sbin/sendmail'


 For Bourne-Again Shell (Bash) or derived shells
  At ~/.profile:

	MACUTIL_SENDER='user+return+*@your.host.com'
	MACUTIL_SENDMAIL=/usr/sbin/sendmail
	export MACUTIL_SENDER
	export MACUTIL_SENDMAIL
  

 Then place the following in $HOME/.avenger/rcpt+return+default:

	macutil -c "$SUFFIX" 2> /dev/null \
	     || reject "<$RECIPIENT>... unknown or expired address"
  

 - Integrating with /usr/bin/Mail

  Put the following line in $HOME/.mailrc:

  	set sendmail="/usr/bin/sendmac"

  
 - Integrating with emacs / Gnus

  Place the following in your .emacs or .gnus file:
  
	  (setq message-sendmail-f-is-evil t)
	  (setq sendmail-program "/PATH/TO/YOUR/HOME/bin/sendmac"
	  
	  (setq macutil-expire "2M")
	  (defun av-from ()
	    (with-temp-buffer
	      (call-process "macutil" nil t nil
			    (concat "--expire=+" macutil-expire)
			    "--sender" "user+return+*@your.host.com"
			    "--from" "Your Full Name"
			    "--fromexp" "address expires")
	      (goto-char (point-max))
	      (delete-char -1)
	      (search-backward " <")
	      (insert "\n   ")
	      (buffer-string)))
	  
	  (setq message-generate-headers-first t)
	  (setq gnus-posting-styles
		'((".*"
		   ("From" '(av-from)))
		  ))



E. 	Extra Information about MailAvenger
	-----------------------------------

Q:  Why do you keep calling it 'MailAvenger' instead of 'Avenger' or 'asmtpd'? 
    Are you insane in the membrain?

A: The MailAvenger software is also known as plain 'Avenger', and there might
  eventually exist some files or directories that are named after each other.
 For practical reasons, I tried to stick with the cannonical name so no more 
  confusion is added into the equation and created a 'avenger' virtual package
  that points to the mailavenger software you are looking at :-)


 -- Philip Hands <phil@hands.com>, Wed, 26 Jun 2019 11:37:17 +0200
