[Mimedefang] mimedefang + spamassassin + binary attachments
Michael Grau
m.grau at kcc.state.ks.us
Wed Jul 31 14:22:05 EDT 2002
This is an update or a problem I posted earlier. The problem is that
when mimedefang calls spamassassin, the known spam message sails
through with zero hits if a binary (gif) is attached to the message.
Also, interestingly, no qdir spool directory is created for these messages
even running mimedefang with the -k switch. I quarantined all messages
from a certain user in filter_begin to get a copy of the message.
I'm running as below:
mimedefang-multiplexor -U oas -R 50000 -M 50000 -p /var/run/mimedefang/multiplexor.pid -x 18 -m 6 -b 30 -i 300 -l
-s /var/run/mimedefang/mdefang-mx.sock
mimedefang -U oas -m /var/run/mimedefang/mdefang-mx.sock -p /var/run/mimedefang/mimedefang.sock -s -t -k
Mail-SpamAssassin-2.31
mimedefang-2.16
sendmail-8.12.5
and on another machine (same behavior):
Mail-SpamAssassin-2.01
mimedefang-2.6
sendmail-8.13
Is mimedefang replacing LF with CR/LF? I only have the problem
when spamassassin is called from mimedefang or on a message that
has passed through mimedefang.
The problem seems to be related to the line endings on the message.
The ENTIRE_MESGAGE has all its line terminated with CR/LF, the gif
included. I don't belive the gif should have these line ending, at least
it doesn't have CR's before being sent. Sending the ENTIRE_MESSAGE with
CR's directly to spamassassin results in zero hits:
spamassassin -t <ENTIRE_MESSAGE
X-Spam-Status: No, hits=0.0 required=5.5
tests=none
version=2.31
X-Spam-Level:
--------
Remove the CR's (perl -pi -e "s/\cM//" ENTIRE_MESSAGE) and you get
the expected hits:
spamassassin -t <ENTIRE_MESSAGE2
X-Spam-Status: Yes, hits=13.8 required=5.5
tests=US_DOLLARS,NIGERIAN_SCAM_7,NIGERIAN_SCAM_6,US_DOLLARS_2,
RISK_FREE
version=2.31
X-Spam-Flag: YES
X-Spam-Level: *************
X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $)
X-Spam-Report: 13.8 hits, 5.5 required;
* 4.5 -- BODY: Nigerian scam key phrase
* 4.2 -- BODY: Mutated Nigerian scams (7)
* 3.0 -- BODY: Mutated Nigerian scams (6)
* 0.2 -- BODY: Nigerian scam key phrase ($NNN.N m/USDNNN.N m)
* 1.9 -- BODY: Risk free. Suuurreeee....
--------
Also, the message as delivered to the users INBOX does not have the CR ending
and also gets the expected hits:
spamassassin -t <ENTIRE_MESSAGE_INBOX
X-Spam-Status: Yes, hits=13.8 required=5.5
tests=US_DOLLARS,NIGERIAN_SCAM_7,NIGERIAN_SCAM_6,US_DOLLARS_2,
RISK_FREE
version=2.31
X-Spam-Flag: YES
X-Spam-Level: *************
X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $)
X-Spam-Report: 13.8 hits, 5.5 required;
* 4.5 -- BODY: Nigerian scam key phrase
* 4.2 -- BODY: Mutated Nigerian scams (7)
* 3.0 -- BODY: Mutated Nigerian scams (6)
* 0.2 -- BODY: Nigerian scam key phrase ($NNN.N m/USDNNN.N m)
* 1.9 -- BODY: Risk free. Suuurreeee....
Can someone suggest a solution to this problem?
Thanks! -- Mike
More information about the MIMEDefang
mailing list