[Mimedefang] SpamAssassin integration

Martin Bene martin.bene at icomedias.com
Sun Mar 3 07:56:57 EST 2002


Hi, just as a point of information:

in /etc/mail/mimedefang-filter, I've defined behaviour to bounce spammails on the SMTP level if they score above a  (fairly high) level - so far, no false positeves, but I still like to be able to check. therefore, in adition to the smtp bounce, I also use quarantine_entire message to get an admin notification with the possibility to check what's going on. I've slightly modified the quarantine message to get more informative output, see attached patch. (BTW: also fixes bug with wrong filename for ENTIRE_MESSAGE being sent by email).

Here's the spam-checking stuff from mimedefang-filter, copied from Mark Roedel (Thanks!!) except for the SMTP bounce.

I've found that this bounce keeps about 80% of the spam messages completely out of end-users mailboxes and I haven't had a single false - positive yet.

sub filter_begin {
    use POSIX qw(floor);
    my $hitsint;
    my $spamgraphchar = '*';
    my $spamgraph;

<removed default suspicious-character checks>

   # Don't run SA against messages bigger than 100k
    if ((-s "./INPUTMSG") <= (100 * 1024)) {
        my($hits, $req, $names, $report) = spam_assassin_check();
        $SAReport = $report;
        if ($hits >= $req) {
            action_add_header("X-Spam-Warning", "SpamAssassin says this message is SPAM");
        }
        if ($hits > 0) {
          $hitsint = floor($hits);
          $spamgraph = $spamgraphchar x $hitsint;
          action_add_header("X-Spam-Level","$spamgraph ($hits)");
          action_add_header("X-Spam-Report","$report");
        }
        # if we're quite confident it actually IS spam, just bounce it
        if ($hits > 15) {
          action_quarantine_entire_message();
          action_bounce("Message seems to be spam, rejected");
        }
    }
}
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mimedefang.patch
Type: application/octet-stream
Size: 1868 bytes
Desc: mimedefang.patch
URL: <https://lists.mimedefang.org/pipermail/mimedefang_lists.mimedefang.org/attachments/20020303/5363cf44/attachment.obj>


More information about the MIMEDefang mailing list