[Mimedefang] sendmail-mimedefang-spamassassin]]]

Bill Friedman linguafr at sbcglobal.net
Sat Jul 5 23:44:00 EDT 2003


>Do you have a line in your sendmail .mc file that resembles:
>
>INPUT_MAIL_FILTER(`mimedefang', `S=local:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=S:5m;R:5m;E:5m')
>
>That would be the first thing I would check if you're not seeing any
>filtering. Are you seeing any X-Scanned-By: MIMEDefang 2.34 lines?
>  
>
Here's what I have.  I opted to not use the F=T option because I didn't 
want mail to stop being delivered if the filter wasn't working - that's 
how I
interpreted the effect of the option.

sendmail.mc:

INPUT_MAIL_FILTER(`mimedefang', 
`S=unix:/var/spool/MIMEDefang/mimedefang.sock, T=S:5m;R:5m')

/etc/mail/sendmail.cf:

Xmimedefang, S=unix:/var/spool/MIMEDefang/mimedefang.sock, T=S:5m;R:5m

>
>Just a quick overview of the process:
>
>Sendmail passes the message to mimedefang through the milter
>mechanism. Mimedefang looks at the message and alters it according to
>the instructions contained in mimedefang-filter. One of the ways that
>the message can be altered is when you tell mimdefang to use the
>spammassassin functions to determine how spammy a message is.
>Mimedefang takes the return value of the spam_assassin_check()
>function, and uses that to determine how high a message's spam acore
>was.
>
>For example, I use 
>
>my($hits, $req, $names, $report) = spam_assassin_check();
>	if ($hits >= $req) {
>[...]
>	action_change_header("X-Spam-Flag","YES");
>
>in the sub filter_end ($) section of mimedefang-filter 
>
Here are the references to SA in my mimedefang-filter.  I've included 
just the function header for the sake of brevity.
So, I have essentially what you do in sub filter_end, except I use the 
default arguments, which should still do something
to the header, right?

# The next 3 lines force SpamAssassin modules to be loaded and rules
# to be compiled immediately.  This may improve performance on busy
# mail servers.  Comment the lines out if you don't like them.
if ($Features{"SpamAssassin"}) {
    spam_assassin_init()->compile_now(1) if defined(spam_assassin_init());
}
............

# I added this based on the README.SPAMASSASSIN recommendation

sub filter_begin () {
  .........
    if (spam_assassin_is_spam()) {
        action_add_header("X-Spam-Warning", "SpamAssassin says this is 
SPAM");
    }
}

..........

sub filter_end ($) {
.........
   # Spam checks if SpamAssassin is installed
    if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 100*1024) {
            # Only scan messages smaller than 100kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my($hits, $req, $names, $report) = spam_assassin_check();
            if ($hits >= $req) {
                md_graphdefang_log('spam', $hits, $RelayAddr);
                my($score);
                if ($hits < 40) {
                    $score = "*" x int($hits);
                } else {
                    $score = "*" x 40;
                }
                # We add a header which looks like this:
                # X-Spam-Score: 6.8 (******) NAME_OF_TEST,NAME_OF_TEST
                # The number of asterisks in parens is the integer part
                # of the spam score clamped to a maximum of 40.
                # MUA filters can easily be written to trigger on a
                # minimum number of asterisks...
                action_change_header("X-Spam-Score", "$hits ($score) 
$names");

                # If you find the SA report useful, add it, I guess...
                action_add_part($entity, "text/plain", "-suggest",
                                "$report\n",
                                "SpamAssassinReport.txt", "inline");
            } else {
                # Delete any existing X-Spam-Score header?
                action_delete_header("X-Spam-Score");
...........

BTW, where are these quarantine reports located?

# If you want quarantine reports, uncomment next line
     send_quarantine_notifications();

>  
>  
>




More information about the MIMEDefang mailing list