diff options
author | Shlomi Fish <shlomif@shlomifish.org> | 2017-10-06 15:43:36 +0300 |
---|---|---|
committer | Shlomi Fish <shlomif@shlomifish.org> | 2017-10-06 15:43:36 +0300 |
commit | 9dab12d056733eb5a8ae03e18130f8b933900b0a (patch) | |
tree | 56b8008b4ee05b8151cbe9cf3eebcdfbfa55b6b9 /README.md | |
parent | 5cb5c861dedc0a5b6b089ae6b5758fce92f4aae0 (diff) | |
download | rspamd-9dab12d056733eb5a8ae03e18130f8b933900b0a.tar.gz rspamd-9dab12d056733eb5a8ae03e18130f8b933900b0a.zip |
Correct some grammar and formatting in the README.
Diffstat (limited to 'README.md')
-rw-r--r-- | README.md | 84 |
1 files changed, 42 insertions, 42 deletions
@@ -6,97 +6,97 @@ rules including regular expressions, statistical analysis and custom services such as URL black lists. Each message is analysed by Rspamd and given a `spam score`. -According to this spam score and the user's settings Rspamd recommends an action for +According to this spam score and the user's settings, Rspamd recommends an action for the MTA to apply to the message, for example, to pass, reject or add a header. -Rspamd is designed to process hundreds of messages per second simultaneously and has a number of -features available. +Rspamd is designed to process hundreds of messages per second simultaneously, and sports a number of +usefulrfeatures. -You can watch the following [introduction video](https://www.youtube.com/watch?v=_fl9i-az_Q0) from the [FOSDEM-2016](http://fosdem.org) where I describe the main features of Rspamd and explain why Rspamd runs so fast. +You can watch the following [introduction video](https://www.youtube.com/watch?v=_fl9i-az_Q0) from [FOSDEM-2016](http://fosdem.org) where I describe the main features of Rspamd and explain why Rspamd is so fast. -Rspamd is [packaged](https://rspamd.com/downloads.html) for the major Linux distributions and is also available via [FreeBSD ports](https://freshports.org/mail/rspamd), NetBSD [pkgsrc](https://pkgsrc.org) and [OpenBSD ports](http://openports.se/mail/rspamd). +Rspamd is [packaged](https://rspamd.com/downloads.html) for the major Linux distributions, and is also available via [FreeBSD ports](https://freshports.org/mail/rspamd), NetBSD [pkgsrc](https://pkgsrc.org) and [OpenBSD ports](http://openports.se/mail/rspamd). ## Spam filtering features -Rspamd distribution contains a number of mail processing features, including such techniques as: +The Rspamd distribution contains a number of mail processing features, including such techniques as: * **Regular expressions filtering** - allows basic processing of messages, their textual parts, MIME headers and SMTP data received by MTA against a set of expressions that includes both normal regular expressions and -message processing functions. Rspamd expressions are the powerful tool that allows to filter messages based on -some pre-defined rules. This feature is similar to regular expressions in SpamAssassin spam filter. +message processing functions. Rspamd expressions are a powerful tool that allows to filter messages based on +some pre-defined rules. This feature is similar to regular expressions in the SpamAssassin spam filter. * **SPF module** that allows to validate a message's sender against the policy defined in the DNS record of sender's domain. You can read -about SPF policies [here](http://www.openspf.org/). A number of mail systems includes SPF support, such as `Gmail` or `Yahoo Mail`. +about SPF policies [here](http://www.openspf.org/). A number of mail systems include SPF support, such as Gmail or Yahoo Mail. -* **DKIM module** validates a message cryptographic signature against a public key placed in the DNS record of sender's domain. Like SPF, +* **DKIM module** validates a message’s cryptographic signature against a public key placed in the DNS record of sender's domain. Like SPF, this technique is widely spread and allows to validate that a message is sent from that specific domain. * **DNS black lists** allows to estimate reputation of sender's IP address or network. Rspamd uses a number of DNS lists including such lists as -`SORBS` or `Spamhaus`. However, Rspamd doesn't trust any specific DNS list and use a conjunction of estimations instead that allows to +`SORBS` or `Spamhaus`. However, Rspamd doesn't trust any specific DNS list, and uses a conjunction of estimations instead that allows to avoid mistakes and false positives. Rspamd also uses positive and grey DNS lists for checking for trusted senders. -* **URL black lists** are rather similar to DNS black lists but uses URLs in a message to make an estimation of sender's reputation. -This technique is very useful for finding malicious or phished domains and filter such mail. +* **URL black lists** are rather similar to DNS black lists but use URLs in a message to make an estimation of the sender's reputation. +This technique is very useful for finding malicious or phished domains and filter E-mail that contains them. -* **Statistics** - Rspamd uses Bayesian classifier based on five-grams of input. This means that the input is estimated not based on individual -words, but all input is organized in chains that are further estimated by Bayesian classifier. This approach allows to achieve better results than -traditionally used monograms (or words literally speaking), that is described in details in the following [paper](http://osbf-lua.luaforge.net/papers/osbf-eddc.pdf). +* **Statistics** - Rspamd uses a Bayesian classifier based on five-grams of input. This means that the input is estimated not based on individual +words, but instead is organized in chains that are further estimated by the Bayesian classifier. This approach allows to achieve better results than +traditionally used monograms (or words literally speaking), that are described in details in the following [paper](http://osbf-lua.luaforge.net/papers/osbf-eddc.pdf). -* **Fuzzy hashes** - for checking of malicious mail patterns Rspamd uses so called `fuzzy hashes`. Unlike normal hashes, these structures are targeted to hide -small differences between text patterns allowing to find similar messages quickly. Rspamd has internal storage of such hashes and allows to block mass spam sendings -quickly based on user's feedback that specifies messages reputation. Moreover, this allows to feed Rspamd with data from [`honeypots`](http://en.wikipedia.org/wiki/Honeypot_(computing)#Spam_versions) +* **Fuzzy hashes** - for checking of malicious mail patterns, Rspamd uses the so called "fuzzy hashes". Unlike normal hashes, these structures are targeted to hide +the small differences between text patterns, allowing it to find eimilar messages quickly. Rspamd has an internal storage of such hashes and can block mass spam sendings +quickly based on feedback from the user that specifies messages’ reputation. Moreover, this allows to feed Rspamd with data from ["honeypots"](http://en.wikipedia.org/wiki/Honeypot_(computing)#Spam_versions) without polluting the statistical module. -Rspamd uses the conjunction of different techniques to make the final decision about a message. This allows to improve the overall quality of filtering and reduce the number of -false positives (e.g. when a innocent message is badly classified as a spam one). I have tried to simplify Rspamd usage by adding the following elements: +Rspamd uses the conjunction of different techniques to assign the final verdict to a message. This allows to improve the overall quality of filtering, and reduce the number of +false positives (e.g. when an innocent message is badly classified as a spam one). I have tried to simplify Rspamd’s usability by adding the following elements: -* **Web interface** - Rspamd is shipped with the fully functional Ajax-based web interface that allows to observe Rspamd statistic, to configure rules, weights and lists, to scan -and learn messages and to view the history of scans. The interface is self-hosted, requires zero configuration and follows the recent web applications standards. You don't need a -web server or applications server to run WebUI - you just need to run Rspamd itself and a web browser. +* **Web interface** - Rspamd is shipped with a fully functional Ajax-based web interface, that allows one to observe Rspamd statistics, to configure rules, weights and lists, to scan +and learn messages, and to view the history of scans. The interface is self-hosted, requires zero configuration and follows the recent web applications standards. You don't need a +web server or applications server to run it - you just need to run Rspamd itself and a web browser. -* **Integration with MTA** - Rspamd can work with the most popular mail transfer systems, such as Postfix, Exim or Sendmail. For Postfix and Sendmail, there is an [`Rmilter` project](https://github.com/vstakhov/rmilter), -whilst for Exim there are several solutions to work with Rspamd. Should you require MTA integration then please consult with the [integration guide](https://rspamd.com/doc/integration.html). +* **Integration with MTAs** - Rspamd can work with the most popular mail transfer systems, such as Postfix, Exim or Sendmail. For Postfix and Sendmail, there is an [`Rmilter` project](https://github.com/vstakhov/rmilter), +whilst for Exim there are several solutions to work with Rspamd. Should you require MTA integration then please consult the [integration guide](https://rspamd.com/doc/integration.html). -* **Extensive Lua API** - Rspamd ships with hundreds of [Lua functions](https://rspamd.com/doc/lua) that are available to write own rules for efficient and targeted spam filtering. +* **Extensive Lua API** - Rspamd ships with hundreds of [Lua functions](https://rspamd.com/doc/lua) that enable one to write their own rules for efficient and targeted spam filtering. -* **Dynamic tables** - Rspamd allows to specify bulk lists as `dynamic maps` that are checked in runtime with updating data when they are changed. Rspamd supports file, HTTP and HTTPS maps. +* **Dynamic tables** - Rspamd allows one to specify bulk lists as "dynamic maps", that are checked at runtime for updated data. Rspamd supports file, HTTP and HTTPS maps. ## Performance -Rspamd is designed to be fast. The core of Rspamd is written in `C` and uses an event-driven model that allows to process multiple messages simultaneously and without blocking. +Rspamd is designed to be fast. The core of Rspamd is written in C and uses an event-driven model that allows it to process multiple messages simultaneously and without blocking. Moreover, a set of techniques is used in Rspamd to process messages faster: -* **Finite state machines processing** - Rspamd uses specialized finite state machines for the performance critical tasks to process input faster than a set of regular expressions. -Of course, it is possible to implement these machines by ordinary `Perl regular expressions` but then they won't be compact or human-readable. On the contrary, Rspamd optimizes -such actions as headers processing, received elements extraction, protocol operations by building the concrete automata for an assigned task. +* **Finite state machines processing** - Rspamd uses specialized finite state machines for performance critical tasks to process input faster than a set of regular expressions. +Of course, it is possible to implement these machines by ordinary Perl regular expressions, but then they won't be compact or human-readable. Instead, Rspamd optimizes +such actions as headers processing, received elements extraction, and protocol operations by building the concrete automata for an assigned task. -* **Expressions optimizer** - allows to optimize expressions by execution of `likely false` or `likely true` expressions in order in the branches. That allows to reduce number of -expensive expressions calls when scanning a message. +* **Expressions optimizer** - allows Rspamd to optimize expressions by execution of `likely false` or `likely true` expressions in order in the branches. That reduces a number of +expensive expressions' calls when scanning a message. -* **Symbols optimizer** - Rspamd tries to check first the rules that are frequent or inexpensive in terms of time or CPU resources which allows to block spam before processing of +* **Symbols optimizer** - Rspamd tries to first evaluate the rules that are frequent or inexpensive in terms of time or CPU resources. This allows it to block spam before processing of expensive rules (rules with negative weights are always checked before other ones). -* **Event driven model** - Rspamd is designed not to block anywhere in the code and knowing that a spam check requires a lot of network operations, Rspamd can process many messages +* **Event driven model** - Rspamd is designed not to block anywhere in the code, and, given that a spam check requires a lot of network operations, Rspamd can process many messages simultaneously increasing the efficiency of shared DNS caches and other system resources. Moreover, event-driven system normally scales automatically and you won't need to do any tuning in the most of cases. -* **Hyperscan regular expressions engine** - Rspamd utilizes [Hyperscan](https://01.org/hyperscan) engine to match multiple regular expressions at the same time. You can watch the following [presentation](https://highsecure.ru/rspamd-hyperscan.pdf) where the main benefits of Hyperscan are described. +* **Hyperscan regular expressions engine** - Rspamd utilizes the [Hyperscan](https://01.org/hyperscan) engine to match multiple regular expressions at the same time. You can read the following [presentation](https://highsecure.ru/rspamd-hyperscan.pdf) where the main benefits of Hyperscan are described. -* **Clever choice of data structures** - Rspamd tries to use the optimal data structure for each task. For example, it uses very efficient suffix tries for fast matching of a text -against a set of multiple patterns. Or it uses radix bit trie for storing IP addresses information that provides O(1) access time complexity. +* **Clever choice of data structures** - Rspamd tries to use the optimal data structure for each task. For example, it uses very efficient suffix tries for fast matching of text +against a set of multiple patterns. Or it uses a radix bit trie for storing IP addresses information that provides O(1) access time complexity. ## Extensions -Besides its `C` core, Rspamd provides an extensive [Lua](http://lua.org) API to access almost all the features available directly from `C`. Lua is an extremely easy +Besides its C core, Rspamd provides an extensive [Lua](http://lua.org) API to access almost all the features available directly from C. Lua is an extremely easy to learn programming language though it is powerful enough to implement complex mail filters. In fact Rspamd has a significant amount of code written completely in Lua such as DNS blacklists checks, user's settings or different maps implementation. You can also write your own filters and rules in Lua adopting Rspamd functionality to your needs. -Furthermore, Lua programs are very fast and their performance is rather [close](http://attractivechaos.github.io/plb/) to pure `C`. However, you should mention that for the most -of performance critical tasks you usually use the Rspamd core functionality than Lua code. Anyway, you can also use `LuaJIT` with Rspamd if your goal is maximum performance. +Furthermore, Lua programs are very fast and their performance is rather [close](http://attractivechaos.github.io/plb/) to pure C. However, you should mention that for the most +of performance critical tasks you usually use the Rspamd core functionality than Lua code. Anyway, you can also use LuaJIT with Rspamd if your goal is maximum performance. From the Lua API you can do the following tasks: * **Reading the configuration parameters** - Lua code has the full access to the parsed configuration knobs and you can easily modify your plugins behaviour by means of the main |