From: Jeff Morgan [vmswiz@geonospamcities.com]
Sent: Wednesday, February 12, 2003 2:36 PM
To: Info-VAX@Mvb.Saic.Com
Subject: Re: Inspecting VMS SMTP email contents - ie, Content filter
gateway

Sol:

   I have a crude email content filter gateway that you should be able to
modify to do this.

   It's really very simple. Here's the gist of how it works...

   - Stop the TCPIP$SMTP_nodename_01 SMTP que and always keep it stopped.

   - Create a new TCPIP$APPROVED que with the exact same server que settings

   - Incoming emails go into the TCPIP$SMTP_nodename_01 que and go "pending"

   - Create a batch DCL command file that wakes up every 5 minutes, scans
the jobs in the pending que, and requeues them to the "tcpip$approved" que
if they pass your tests. There is no reason you couldn't modify the incoming
file before it is released. Ques work on file id, not name and version, so
you will have to open the file for update and make your changes or overwrite
the file completely.

   My content filter looks for specific spam phrases and deletes the jobs
that it thinks are spam. Currently I have a couple of hundred phrases to
search for. Argh!

   I also reque some of the emails to a TCPIP$SPAM que if the content filter
isn't sure they are spam. Then I can manually review them before releasing.
This way I quarantine emails that contain attachments with executables, bat
files, screen savers, pifs, etc.

   I'll post the code for TEC at my geocities web page
http://www.geocities.com/vmswiz/vms.html

   Now, if anyone knows how to pass an external file with search phrases to
the VMS search utility, please let me know! SEARCH X.TXT @PHRASES.TXT
doesn't work. Defining sys$input doesn't seem to work either. My routine has
59 separate "searches" with about 30 phrases per search.

   It's a great waste of cpu cycles and i/o, but it catches 90% of all the
spam for me.

   You can also use a similar routine for Multinet's smtp queues.

   Another technique I've used is that instead of stopping the
TCPIP$SMTP_nodename_01 que, set it to a job size maximum limit of 50 blocks
or so. Anything larger than the limit will go pending. Then, you only need
to parse and test the largest emails. It would be highly unusual for a
Microsoft attachment to be less than 25KB and skip past the content filter.

   Hope this helps.

                                                          Jeff


"Sol Gongola" <sol@adldata.com> wrote...

> ...I need to programmatically intercept email received by VMS
> and inspect it before it gets POPped to its final recipient...
>
> Thank you
> Sol Gongola