SmiteCRC

# SmiteCRC - Spam detection system

Warning: SmiteCRC should no longer be used as it has been superceeded by
the ASpam spam detection system

- Overview - What is SmiteCRC
- Use of SmiteCRC output (For Users)
- Using SmiteCRC with SurgeMail
- Configuration Options
- What to do if SmiteCRC crashes
- Manually Download SmiteCRC

### Overview - What is SmiteCRC

SmiteCRC is to spam what a virus scanner is to viruses. It scans each incoming message and marks it as 'spam' with special headers. As the administrator you can then decide to reject the messages that are 'definitely' spam or more likely just let your users know that these special headers exist, they will then use their email clients filtering rules to store messages that have the 'spam' header in a seperate folder. Which they can quickly scan once a day for 'real' email messages and then delete. In this way users who want spam still get it but the tedious sorting of spam and non spam is made enormously quicker.

How does it work? In brief, it uses two systems. A set of rules that correctly identify most spam messages by content and a database of fuzzy CRCs that let it correctly find messages that other people have reported as spam even if they are slightly different on your system. Together the two systems give a very accurate indication if a message is spam.

Following is a technical description of how it works but if you just want to implement it jump to here:

The SmiteCRC client has four primary functions -

- Perform calculations on incoming messages (These values can be used by SmiteCRC to find duplicates).
- Run a rule filter over the email to look for elements common to spam and assigns a spam weighting.
- Download regular updates from the server for both messages reported as spam and filters.
- Check messages at POP time to establish if they have been reported as spam after delivery.

### Use of SmiteCRC output (For Users)

SmiteCRC adds two headers to messages that are of use for content filtering along with a CRC header describing the contents of the message.
X-Smite-CRC: A$3eHhzQ$EjWgRQ$1VD816z#1q4s9KO$63ZKjj#f12aeF$1lUn0u1#e5Eqn2$r3TqJ7
X-Smite-Match: 1
X-SpamDetect: ***: 3.581000 Suspect source,Asks you to click below,A word in all caps repeated on the line
X-Smite-CRC is added to the message when it is accepted for delivered and is a summary of the contents of the message. If the recipient of the message considers the message to be spam and submits it to smitespam.com, this header will be used to find matching messages.
X-Smite-Match indicates a match with a sufficiently high weighting has been found for the message in the SmiteCRC database. This header may be applied during delivery or at POP time. Messages with this header should be considered spam and this header can be used for filtering in e-mail clients. If the recipient believes this is not spam the X-Smite-CRC header should be submitted to smitespam.com as non-spam as some legitimate subscription email may be submitted as spam by users.
X-SpamDetect gives the results of the spam filter. A score above 5 would most likely indicate the message is spam. Users should not filter on the presence of this header but on the contents. To simplify filtering, searching for a score of 4 or more can simply be done by searching for "****" in the X-SpamDetect header.

Client | How to filter using SmiteSpam headers | Submitting to SmiteCRC
--- | --- | ---
Eudora 5.1 | Menu - Tools | Filters | New... Type 'X-Smite-Match' into the Header field and choose "appears". For the action, select "Transfer To" and select an appropriate destination folder for spam. Add a rule for 'X-SpamDetect' in the same way, but select "contains", and along with the contents "*****" | Forward to SpamBot. Or manually submit.
Netscape 4.x | Menu - Edit | Message Filters Click 'New' If the headers you want to filter against aren't in the drop-down list, click the Advanced button and add them to the list of custom headers. Filtering on the contents of headers is not possible, so it is recommended only X-Smite-Match is used with this client. | Forward to SpamBot Or Manually submit (Menu - View | Source)
Outlook Express |  | Forward as attachment to SpamBot Or Manually submit (Ctrl+F3 for source)

### Using SmiteCRC with SurgeMail

SmiteCRC is distributed with SurgeMail and integrated with the web admin interface. To enable simply set "Enable SmiteSpam" to "True" in the web admin interface - this is the default for new SurgeMail installations. In addition the "Allow users to specify specific spam settings" should be enabled. This gives users access to setting their own tolerance to spam and allowing users to store their suspected spam on the server so that they do not have to download it.

Check SmiteCRC is working in SurgeMail by looking at the status output. Near the top, you should see a line similar to the following -
Smite found 840, late 482, rule file 4224, total 5850
In the above example, SmiteCRC has been running for a while, and the statistics indicate the number of messages that have been scanned and matched.

Lastly you can configure SpamBot if required.

### Configuration options

All configuration options for SmiteCRC are placed in smitecrc.ini. This file must be located in the directory in which SmiteCRC is run. In general you will not need to modify any settings, but must specify SMITE_EMAIL and SMITE_PASS. Surgemail will do this automatically.

At a minimum, your smitecrc.ini should look like this -

smite_email user@example.com
smite_pass N1234

The details must be for an update account. A normal account with smitespam.com allows for submission of spam only. Update accounts are provided for all SurgeMail customers automatically, see details below.

Setting | Description | Default |
--- | --- | --- | ---
UPDATE_INT | Update interval from smitespam.com in minutes. | 60 |
MSG_SZ | Maximum message size to scan in bytes. Requires restart. | 1048576 (1MB) |
SMITE_EMAIL | E-mail address to login to smitespam.com. |  |
SMITE_PASS | Password for smitespam.com. |  |
MATCH_MIN | Minimum number of CRC values to match. | 5 |
SCORE_MIN | Minimum score from matching CRC's. | 8 |
RATIO_MIN | Minimum ratio of spam reports to non-spam reports. | 0 |
COUNT_MIN | Minimum number of spam reports to be spam. | 0 |
TRUST_ISSPAM | Ignore the score, trust smitespam.com when it says an item is spam. | TRUE |
DEBUG | Log exrtra debugging information. | FALSE |
UPDATE_START | Update database if required BEFORE accepting requests. Not recommended. | FALSE |
LOG_SIZE | Log size in bytes. | 1048576 (1MB) |
SKIP_FILTER | Don't run the filter. | FALSE |
FILTER_UPGRADE | Allow filter upgrades from smitespam.com. | TRUE |
FILTER_MAX | Maximum portion of message to send to the filter in bytes. | 10000 |

The settings SMITE_EMAIL, and SMITE_PASS are required. All other settings are optional. With the exception of changes requiring a restart of SmiteCRC, new configuration settings will be automatically applied when the file modification date changes. Changes to scoring settings are not recommended except for testing purposes or on the advice of support staff to address specific issues.

Each setting must be placed on a line by itself, containing the setting name, a single space and the value you wish to use.

### What to do if SmiteCRC crashes

Please ensure you are using the latest build of SmiteCRC before reporting any crashes. Email us the details of your platform and any crash related files (DrWtsn32.log from Windows NT systems). If the problem is occuring regularly it is possible that there is a specific message format causing the problem. In this case you should set 'WRITE_TEMP true' in smitecrc.ini, and take note of the process ID. When SmiteCRC next crashes a file called smitecrc_pid.msg will be left behind. This will contain the email that SmiteCRC was processing at the time of the crash.

### Manually download SmiteCRC

SmiteCRC is distributed with SurgeMail and the latest SurgeMail (1.4c+) has the ability to update SmiteCRC to the latest SmiteCRC binary using a button in the web admin interface. If you still want to download manually you can do so here:

Latest Version
FreeBSD 4.x (x86) | FreeBSD 4.x
FreeBSD 5.x (x86) | FreeBSD 5.x
Linux (x86) | Linux (libc6)
MacOS X | MacOS X
Solaris 7+ (Sparc) | Solaris 7 and later
Win32 (x86) | Microsoft Windows (9x,ME,NT,2000,XP)