[Mimedefang] Help with Spamassassin

[Jim McCullars]

On Wed, 2 Jun 2004, Mark Penkower wrote:

> I do not plan on doing anything sophisticated with it. I don't want to
> use any point based system.  I simply want to define a list of banned
> words in the body.  If any of these words are present, bounce the email.

   There are two things you will need to do.  One, define the rules in
your local SpamAssassin config (the location depends on your installation,
but if you will look at the mimedefang-filter man page, it will show where
MIMEDefang thinks it should be); and two, update your MD filter to detect
that your local rule was triggered and bounce the email.

   For the first part, put something like this in your local SA config
file that MD uses:

body LOCAL_BANNED_WORD /\b(?:word1|word2|word3|word4|word5)\b/i
describe LOCAL_BANNED_WORD Words that should not appear in any email
score LOCAL_BANNED_WORD .01

   For the second part, look in the sample filter file that comes with MD.
In the filter_end() subroutine, take the part that looks like this:

    if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 100*1024) {
            # Only scan messages smaller than 100kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my($hits, $req, $names, $report) = spam_assassin_check();
            if ($hits >= $req) {
                md_graphdefang_log('spam', $hits, $RelayAddr);
                my($score);
                if ($hits < 40) {
                    $score = "*" x int($hits);
                } else {
                    $score = "*" x 40;
                }
                # We add a header which looks like this:
                # X-Spam-Score: 6.8 (******) NAME_OF_TEST,NAME_OF_TEST
                # The number of asterisks in parens is the integer part
                # of the spam score clamped to a maximum of 40.
                # MUA filters can easily be written to trigger on a
                # minimum number of asterisks...
                action_change_header("X-Spam-Score", "$hits ($score) $names");

                # If you find the SA report useful, add it, I guess...
                action_add_part($entity, "text/plain", "-suggest",
                                "$report\n",
                                "SpamAssassinReport.txt", "inline");
            } else {
                # Delete any existing X-Spam-Score header?
                action_delete_header("X-Spam-Score");
            }
        }
    }


and change it to look like this (untested):

    if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 100*1024) {
            # Only scan messages smaller than 100kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my($hits, $req, $names, $report) = spam_assassin_check();
            #
            # bounce the message if (and only if) SA triggered the local
            # banned wordlist rule
            #
            if ($names =~ /LOCAL_BANNED_WORD/) {
              return action_bounce("Unacceptable content detected")
            }
        }
    }


   HTH...

Jim McCullars
University of Alabama in Huntsville