; This is a sample configuration file for NOBOGUS

; ----------------------------------------------------------------------
; First, the general options
; ----------------------------------------------------------------------

; Lines beginning with a semicolon and blank lines are ignored.

; We write a Binkley-style log file to standard list, or to
; the file given in the logfile command:

logfile = nobogus.log

; Various degrees of verbosity can be set in the log file, from 0 (nothing
; reported) to 6 (most verbose)

loglevel = 2

; The same control also works on the screen display.  Use 0 for near silent
; operation

screenlevel = 6

; If you want a dump of bad messages in your log file (to avoid having to look
; at the .BOG file to see what went wrong, set logbad to the max number of bad
; messages to show per packet.

logbadmsg = 5

; Any packet that meets one of the criteria defined below will be renamed
; with the extension 'BOG', as given by the Extension command:

extension = BOG

; As many filesets as desired can be searched for bad packets, by giving
; multiple packets commands.

packets = *.pkt

; Specify systems which you know are completely trustworthy using
; Ignore_Pkt_From.  Packets from these systems will not be checked.  Use
; this with extreme care!  If it is remotely conceivable that someone could
; masquerade as one of these systems, or somehow sneak past their security,
; then don't list them here.  Consider carefully whether the 2 or 3 minutes
; savings this can give you are worth the risk.

; Only net & node may be given; zone and point level are ignored.  You can
; abbreviate the list by leaving off the net if it's the same as the previous
; node.  Multiple Ignore_Pkt_From lines are allowed.

; ignore_pkt_from = 249/1 99

; Specify the percent of messages in a packet which have to match one of the
; search criteria in order to mark the packet as bad.  This could be used to
; let packets which are mostly okay slip through.  The sample setting is quite
; tolerant, because the count (below) is fairly low.

percent = 50

; Specify the number of messages in a packet which can match one of the
; search criteria and still not mark the packet as bad.  If *either* the
; percent or the count is exceeded, the packet will be renamed.  The value 
; of 5 means that most false alarms won't be stopped; only if there are
; 5 or more messages with problems (or at least half the packet) will 
; action be taken.

count = 5

; As many search criteria as desired can be set.  If a message matches
; any one of these criteria, it counts as a hit.  All searches are
; case-insensitive, i.e. Murdoch=murdoch=MURDOCH

; -----------------------------------------------------------------------
; Now, the tests.  First the ones that stop a bogus packet
; -----------------------------------------------------------------------

; The tests below aren't likely to catch every bad message in a packet,
; so we use StopPacket to sideline the whole packet if any of them are
; triggered.

StopPacket

; Give a string following one of the following
; field names:  From, To, Subject, Text (which is the whole message text,
; including the control lines), Kludge, Tearline, Origin, Path
; or Any for all of the above.
; Use | symbols to search multiple fields for the same string.

any = fidoghod

; Note that the leading blank is *not* significant in the search below:

to|from = the dork

; To get a leading blank, put the whole string in single quotes:

tearline= ' germermail'

; -----------------------------------------------------------------------
; Now some tests to stop individual messages
; -----------------------------------------------------------------------

; The tests below are likely to catch every bad message in a dump, so
; we'll just sideline the hits.  Any message not meeting the criteria will
; be allowed to toss

StopMessage

; Specify the oldest allowable messages by giving their age in days.

age = 100

; Specify the newest allowable messages by giving a negative (or 0) age.
; For example, this entry says that messages with tomorrow's date are fine,
; but nothing further in the future.  0 would mean that no future dates are
; allowed at all -- watch out for messages crossing time zones!  Only one
; positive and one negative age may be given.

age = -1

; The commands above always ignore messages dated Jan 1, 1980 (the default
; date on ancient clockless XT systems).  To also catch those, or any other
; special date, use the date command.  The format must be DD Mmm YY.  As
; many special dates as desired may be specified, one per line.  Note that
; the second date command below is redundant; the "age = -1" command above
; would already catch that date.

date = 01 Jan 80
date = 31 Dec 99

; Some mail processors don't put readable dates into messages.  By default,
; NOBOGUS won't do any tests on the dates in those messages.  Add the line
; below and any message with a date that NOBOGUS doesn't understand will
; count as bad.  NOBOGUS will always log any bad date that it sees;
; this option means that the packet may be marked as bad because of it.

date = bad

; The options below are mainly designed for dupe detection.  We'll stick with
; the StopMessage option for most of them, since dupes generally all have the
; same thing wrong with them.

; Use the "WrongMSGID" line to check that the node given in the MSGID kludge
; line in the message matches the node number given in the origin line.
; Only the net and node are checked; zone, point and network are ignored if
; present.  A warning is written if there is no MSGID line or if NOBOGUS can't
; decode it.

WrongMSGID

; Use the "WrongPath" option to flag a message as bad if the address
; in the origin line isn't found in the path line.
; "WrongPath = Node" goes for an exact match, "WrongPath = Net" requires
; only the net to match (to stop false alarms when the PATH was added
; by the hub).

WrongPath = Net

; There are a few systems that never show up in the PATH.  Sometimes they have
; multiple addresses, and use one in the origin and a different one in the
; path; sometimes they just don't use a PATH at all, and a system down the
; line adds one.  To avoid false alarms from these systems, add them to the
; list of "AlwaysWrong" systems.  This only affects the WrongPath search.
; The usual abbreviations can be used for multiple nodes in the same net.

AlwaysWrong = 243/12 15

; Dupes often follow circular paths.  The Circular option is designed to find
; cases where a single address appears more than once in the path.  The hard
; part is that the path doesn't include zone information, so the same address
; in different zones can appear twice.  To resolve this, put the optional 'to'
; addresses after the main address; then the main one will only count if it's
; followed by one of those

; This will flag any message with 396/1 in the path twice

;Circular=396/1

; This will flag any message with 396/1 twice, both followed by 12/12 or 270/101

;Circular=396/1 to 12/12 270/101

; This one throws caution to the winds, and looks for *any* duplicate
; address in the path

Circular = All

; If you know that the a message passing through a certain system should
; always follow the same path on the way to you, then use ForcedPath.
; This is like MyAddress, except that a message is bad if one of the
; "to" systems *does not* appear after the first one.
; Multiple "to" systems can be listed; then any
; one of them is good enough.  If no "to" systems are listed, then the
; system listed must be last in the path, i.e. feeding directly to you.

; For example, this line says that messages passing through Planet Connect
; must next go to 396/1.

ForcedPath = 3615/50 to 396/1

; This line says that if 249/1 is in the path, it must be last.

ForcedPath = 249/1

; You can have almost as many MyAddress, Circular and ForcedPath tests as you
; like.  The limit is the amount of RAM to store them, or 16384 tests.

; The dupe detectors below are only likely to detect a few bad messages out of
; every bad batch, so we'll sideline the whole packet when any of them are
; triggered

; -----------------------------------------------------------------------
; Now the tests for dupes that stop a whole packet
; -----------------------------------------------------------------------

; Note that this is the second StopPacket section; you can have as
; many as you like.

StopPacket

; If you know a user name that's only going to appear from one of your
; links, you can use the KnownUser option.  You need to specify the name
; of the user and the system which normally sends his/her messages
; to you.  This is not the user's home system, it's the origin of the
; packet.  (Dupes often have bad origin lines, so you can't
; trust those.)  Only echomail messages will be checked, so you don't
; need to worry about crashed netmail being marked as bogus.
; The "from xxx/yyy" part of the KnownUser option is required.  If you
; want to catch all messages from a particular user, use the From=
; string search instead.

; Be careful setting these up; people do move around sometimes, and
; distribution topologies do change.

; This example will make sure that all messages from 'Dj Murdoch' come via
; node 270/101.  Note that unlike most other tests, the name must match
; exactly; NOBOGUS won't bother checking messages from 'dj murdoch', for
; instance.

;KnownUser=Dj Murdoch from 270/101

; If your own address is in the path, that probably signals a dupe.  The syntax
; of MyAddress is like Circular; you can optionally specify the systems
; you normally send to so you don't see messages from another zone as
; being dupes

; This will flag any message with 391/1 in the path even once

;MyAddress=396/1

; This will only flag it if it's followed by 12/12 or 270/101

;MyAddress=396/1 to 12/12 270/101

; -----------------------------------------------------------------------
; Now tests that just get logged, with no change to the packet  
; -----------------------------------------------------------------------

; We might be curious about trying out a new search, but not quite
; willing to risk it in "production" mode.  Use LogOnly to do the search
; and write the result to the log, but take no other action.

LogOnly

; Dupes sometimes have messed up path lines.  Use the "Onepath" option to
; flag a message as bad if there is more than one path line.

Onepath

; Same thing for Origin lines, but this one is a little more risky.  A
; message with two Origin lines could be a dupe, but someone may just
; have quoted it

Oneorigin
