Re: [Phpgroupware-developers] SPAM Assassin

[Patrick J. Walsh (mr_e)]

	So I pulled out all the stuff from our maildrop filter files that I think 
you might be interested in.  It just sends mail through to spamassassin, 
then checks for attached exe, vbs, etc files that might have viruses 
(anyone sending files like these to me would put them in a zip archive 
anyway).  If it finds anything like that, it converts the html parts to 
text and changes the subject to add a warning.  Finally, the part you're 
probably interested in, it looks at the spam rating and either trashes the 
e-mail (by sending it to /dev/null or, if you prefer, sending it to the 
trash folder) or puts it in a Spam mailbox (or whatever you define).

..mr_e



# Configure these
REFORMAIL="/usr/lib/courier/bin/reformail"
SPAMASSASSIN="/usr/bin/spamassassin"
SED="/bin/sed"
SPAMDEST="Maildir/.Spam"

# Run SpamAssassin
xfilter "$SPAMASSASSIN -P -w address@hidden"

# Not spam, but potential virus -- flag as spam anyway
# It's tempting to just delete mail like this.
if (/^[:space:]+filename=.*\.vbs\"$/:b || /^Content.*name=.*\.vbs\"/:b ||\
   /^[:space:]+filename=.*\.vbe\"$/:b || /^Content.*name=.*\.vbe\"/:b ||\
   /^[:space:]+filename=.*\.nsc\"$/:b || /^Content.*name=.*\.nsc\"/:b ||\
   /^[:space:]+filename=.*\.src\"$/:b || /^Content.*name=.*\.src\"/:b ||\
   /^[:space:]+filename=.*\.exe\"$/:b || /^Content.*name=.*\.exe\"/:b ||\
   /^[:space:]+filename=.*\.com\"$/:b || /^Content.*name=.*\.com\"/:b ||\
   /^Subject: I send you this file in order to have your advice/:h || \
   /^Subject:.*Outlook Express Update/:h || \
   /^[:space:]+filename=.*\.bat\"$/:b || /^Content.*name=.*\.bat\"/:b )
 {
   xfilter "$REFORMAIL -A'X-Antispam: Potential Virus'"
   SUBJ="${SUBJ}CAUTION: POTENTIAL VIRUS ATTACHED:"
 }

# Take potential spam and strip out the html
if ( /^X-Antispam/ )
 {
   			xfilter "$SED -e 's/^[Ss][Uu][Bb][Jj][Ee][Cc][Tt]: /Subject: 
SPAM:$SUBJ /'"
   			xfilter "$SED -e 's/^[Cc]ontent-[Tt]ype: text\/html;/Content-Type: 
text\/plain;/g'"
 }

if ( /^X-Spam-Status: Yes/ )
  {
               /^X-Spam-Status: Yes, hits=![:digit:]+\.?[:digit:]*/
               if ($MATCH2>9.5)
                   {
                               to "| cat - >/dev/null"
                                                  # Alternatively, put in the 
trash folder
                               #to "Maildir/.Trash"
                       }
               else
                       {
                               to "$SPAMDEST"
                       }
   }


--On Tuesday, July 30, 2002 10:46 AM -0700,
--Brook Humphrey <address@hidden> wrote:

> On Tuesday 30 July 2002 10:41, Patrick J. Walsh (mr_e) wrote:
> > SpamAssassin doesn't necessarily put stuff in your mbox.  If, for
> > example, you call SpamAssassin from Procmail, your mail will be
> > delivered wherever you've configured Procmail to put it.  I use Maildrop
> > and Courier IMAP and Maildrop by default would put it in the default
> > Maildir, but I filter for the SpamAssassin results and delete anything
> > with a score of ten or greater and throw everything else into a Spam
> > Maildir.  You could set this up in a site wide script pretty easily.
> >
> >         It's a great program, btw.  Definitely worth installing.
> >
> > ..mr_e
>
> Whould you mind posting your maildrop filter?
>
>
>
> --
>  -~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~
> `'~-                                       Brook Humphrey
>         Mobile PC Medic, 420 1st, Cheney, WA 99004, 509-235-9107
> http://www.webmedic.net, address@hidden, address@hidden
>                                  Holiness unto the Lord
>  -~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~
> `'~-
>
>
> _______________________________________________
> Phpgroupware-developers mailing list
> address@hidden
> http://mail.gnu.org/mailman/listinfo/phpgroupware-developers