SA and MTA message filtering

[o2 - Marcin Wasilewski <pi...@o2.pl>]

Hello,

I need some help with SA 3.1. and MTA configuration (Exim or Postfix).
My actual configuration looks like this:

Inet --> SPAM_ASSASSIN_MACHINE --> Mail Server (Exchange).

SPAM_ASSASSIN_MACHINE is running Debian with SPAM Proxy Daemon (SpamAssassin
Proxy) which check mail for spam and then send it to mail server.

I would like to add some new features to SPAM_ASSASSIN_MACHINE so it could
do something like this:
Inet --> SPAM_ASSASSIN_MACHINE --> Mail Server (Exchange).
                    \+ message filtering +/

(assuming that I have a list of valid Exchange mail addressess in a text
file)

1) if message is marked as SPAM and mail address doesn't exist - delete it
or move to a local folder on SA_MACHINE,
2) if message is marked as SPAM and mail address exist - pass it to the
Exchange mail server or move to a local folder on SA_MACHINE,
3) if message is not marked as SPAM and mail address exist - pass it to the
Exchange mail server,
4) if message is not marked as SPAM and mail address doesn't exist - pass it
to the Exchange mail server,

Is it possible to do and could You help me with this?
Best regards
Marcin

Re: SA and MTA message filtering

[Kenneth Porter <sh...@sewingwitch.com>]

--On Friday, August 18, 2006 11:17 AM -0400 Sanford Whiteman 
<sw...@cypressintegrated.com> wrote:

> Three  out  of your four objectives are markedly off-topic: there's no
> reason  for  SA  to  ever see mail for unknown local recipients. Those
> messages should be rejected by the MTA, using either your text file or
> direct  LDAP  lookup:  you  should  Google  or  post elsewhere for the
> specifics.  There's  a large archive of envelope-rejection methods for
> every popular MTA.

I like to use "tracking addresses" when registering with websites, by 
adding "+websitename" after my username (eg. 
shiva+spamassassinexample@sewingwitch.com). I can then tell how a spammer 
got my address. Alas, a lot of web coders exclude "+" as a valid character 
in an email address, so I end up using a dot instead, and using sendmail's 
wildcard recipient feature to route unknown addresses to me.

Anyone know how to get sendmail to recognize more than the "+" for this 
feature?

Re: SA and MTA message filtering

[Sanford Whiteman <sw...@cypressintegrated.com>]

> 1) if message is marked as SPAM and mail address doesn't exist - delete it
> or move to a local folder on SA_MACHINE,

> 3) if message is not marked as SPAM and mail address exist - pass it to the
> Exchange mail server,

> 4) if message is not marked as SPAM and mail address doesn't exist - pass it
> to the Exchange mail server,

Three  out  of your four objectives are markedly off-topic: there's no
reason  for  SA  to  ever see mail for unknown local recipients. Those
messages should be rejected by the MTA, using either your text file or
direct  LDAP  lookup:  you  should  Google  or  post elsewhere for the
specifics.  There's  a large archive of envelope-rejection methods for
every popular MTA.

> 2) if message is marked as SPAM and mail address exist - pass it to the
> Exchange mail server or move to a local folder on SA_MACHINE,

As  for  this  objective,  you've  listed  two  options.

- If you want to quarantine the messages on the MTA, it'd be up to the
MTA  docs  to  tell  you  how  to deal with the returned info from SA,
either  by  interpreting the returned SA weight directly or by parsing
headers.

-  If  you want to pseudo-quarantine them on the Exchange box, you can
use  individual  header  rules or a store-wide event sink to dump each
user's marked spam into into a mailbox subfolder with a fixed name.

--Sandy