[Mimedefang] mimedefang + spamassassin + binary attachments

Michael Grau m.grau at kcc.state.ks.us
Wed Jul 31 14:22:05 EDT 2002


This is an update or a problem I posted earlier. The problem is that
when mimedefang calls spamassassin, the known spam message sails
through with zero hits if a binary (gif) is attached to the message.
Also, interestingly, no qdir spool directory is created for these messages
even running mimedefang with the -k switch. I quarantined all messages
from a certain user in filter_begin to get a copy of the message.

I'm running as below:

mimedefang-multiplexor -U oas -R 50000 -M 50000 -p /var/run/mimedefang/multiplexor.pid -x 18 -m 6 -b 30 -i 300 -l 
-s /var/run/mimedefang/mdefang-mx.sock
mimedefang -U oas -m /var/run/mimedefang/mdefang-mx.sock -p /var/run/mimedefang/mimedefang.sock -s -t -k

Mail-SpamAssassin-2.31
mimedefang-2.16
sendmail-8.12.5

and on another machine (same behavior):

Mail-SpamAssassin-2.01
mimedefang-2.6
sendmail-8.13

Is mimedefang replacing LF with CR/LF? I only have the problem
when spamassassin is called from mimedefang or on a message that
has passed through mimedefang.

The problem seems to be related to the line endings on the message.
The ENTIRE_MESGAGE has all its line terminated with CR/LF, the gif
included. I don't belive the gif should have these line ending, at least
it doesn't have CR's before being sent. Sending the ENTIRE_MESSAGE with 
CR's directly to spamassassin results in zero hits:


spamassassin -t <ENTIRE_MESSAGE

  X-Spam-Status: No, hits=0.0 required=5.5
          tests=none
          version=2.31
  X-Spam-Level: 

--------

Remove the CR's (perl -pi -e "s/\cM//" ENTIRE_MESSAGE) and you get
the expected hits:


spamassassin -t <ENTIRE_MESSAGE2

  X-Spam-Status: Yes, hits=13.8 required=5.5
         tests=US_DOLLARS,NIGERIAN_SCAM_7,NIGERIAN_SCAM_6,US_DOLLARS_2,
                RISK_FREE
          version=2.31
  X-Spam-Flag: YES
  X-Spam-Level: *************
  X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $)
  X-Spam-Report:   13.8 hits, 5.5 required;
    *  4.5 -- BODY: Nigerian scam key phrase
    *  4.2 -- BODY: Mutated Nigerian scams (7)
    *  3.0 -- BODY: Mutated Nigerian scams (6)
    *  0.2 -- BODY: Nigerian scam key phrase ($NNN.N m/USDNNN.N m)
    *  1.9 -- BODY: Risk free.  Suuurreeee....

--------

Also, the message as delivered to the users INBOX does not have the CR ending
and also gets the expected hits:

spamassassin -t <ENTIRE_MESSAGE_INBOX

  X-Spam-Status: Yes, hits=13.8 required=5.5
          tests=US_DOLLARS,NIGERIAN_SCAM_7,NIGERIAN_SCAM_6,US_DOLLARS_2,
                RISK_FREE
          version=2.31
  X-Spam-Flag: YES
  X-Spam-Level: *************
  X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $)
  X-Spam-Report:   13.8 hits, 5.5 required;
    *  4.5 -- BODY: Nigerian scam key phrase
    *  4.2 -- BODY: Mutated Nigerian scams (7)
    *  3.0 -- BODY: Mutated Nigerian scams (6)
    *  0.2 -- BODY: Nigerian scam key phrase ($NNN.N m/USDNNN.N m)
    *  1.9 -- BODY: Risk free.  Suuurreeee....
 
 
 Can someone suggest a solution to this problem?
 Thanks! -- Mike



More information about the MIMEDefang mailing list