You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by dougp23 <do...@gmail.com> on 2007/04/04 14:30:32 UTC
Block a user based on content
I have a user IN the company, who loves to forward these large messages,
things like "Check out these so cute puppies", and "Photoshop Magic" and
what not. Pure drivel.
Anyway, Can I tell SA to "block sending email from jsmith" when "mutliple
jpgs attached" or something like that?
I would appreciate any hints!
--
View this message in context: http://www.nabble.com/Block-a-user-based-on-content-tf3525541.html#a9835974
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Block a user based on content
Posted by JamesDR <ja...@trusswood.net>.
dougp23 wrote:
> I have a user IN the company, who loves to forward these large messages,
> things like "Check out these so cute puppies", and "Photoshop Magic" and
> what not. Pure drivel.
>
> Anyway, Can I tell SA to "block sending email from jsmith" when "mutliple
> jpgs attached" or something like that?
>
> I would appreciate any hints!
It may be time for an internal policy change...
You may be able to do something with a meta rule that looks at the size
of the JPEG content verses txt parts (iirc, there is already a rule that
does this somewhere..) and combines w/ the sender.
As some background, I illustrated to management how much it costs them
every month to transmit, store, archive and maintain the archives just
for users to forward files internally that are already saved to shared
paths.... You can bet the internal file swapping stopped :-D All they do
now is "The file at drive:\path\file.name" If the images are also not
work related, there is that issue as well (unless where you are its
considered 'ok', now where I'm at.)
--
Thanks,
James
Re: Block a user based on content
Posted by "John D. Hardin" <jh...@impsec.org>.
On Wed, 4 Apr 2007, guenther wrote:
> Also, since you are specifically aiming at *large* mail, keep in
> mind that there usually is a max size for mail to be scanned at
> all. IMHO SA is not the best candidate for this kind of "gathering
> logs".
Agreed. You might be better served just by analysing your MTA logs -
you should be able to calculate user_name, total_outbound_bytes
information fairly easily from that using just a simple perl script.
And if you add a "net impact" analysis of message_bytes *
number_of_message_recipients then abuse will stand out more clearly...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Gun Control is nothing more than an attempt to return to feudalism,
where the peasants are helpless and must humbly petition their lord
and master to protect them from bandits and thieves (when they can
get around to it), and where the lords and masters can abuse the
peasants whenever they like without fear of effective resistance.
-----------------------------------------------------------------------
9 days until Thomas Jefferson's 264th Birthday
Re: Block a user based on content
Posted by guenther <gu...@rudersport.de>.
Please resist the urge to top-post.
On Wed, 2007-04-04 at 06:17 -0700, dougp23 wrote:
> You are right. I don't want to block the mail, but I do want to assign a
> high enough value to it that it would be marked as spam. In this way, I can
> then go to management and show them how much spam this worker is sending.
So the mail gets tagged. Then what? Regardless of the mail being blocked
or not, whatever calls SA still needs to take action. In this case, it
sounds like "logging"...
> Yes, I do scan outgoing email for viruses using clamd
Unrelated. I asked, if you are scanning outgoing mail for Spam. Not
viruses. Cause if you don't process outgoing mail by SA, a SA based
solution to log these mails is not an option.
Also, since you are specifically aiming at *large* mail, keep in mind
that there usually is a max size for mail to be scanned at all. IMHO SA
is not the best candidate for this kind of "gathering logs".
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Block a user based on content
Posted by dougp23 <do...@gmail.com>.
You are right. I don't want to block the mail, but I do want to assign a
high enough value to it that it would be marked as spam. In this way, I can
then go to management and show them how much spam this worker is sending.
Yes, I do scan outgoing email for viruses using clamd
guenther-2 wrote:
>
> On Wed, 2007-04-04 at 05:30 -0700, dougp23 wrote:
>> I have a user IN the company, who loves to forward these large messages,
>> things like "Check out these so cute puppies", and "Photoshop Magic" and
>> what not. Pure drivel.
>>
>> Anyway, Can I tell SA to "block sending email from jsmith" when "mutliple
>> jpgs attached" or something like that?
>
> No. Usual answer...
>
> SA does not block mail. SA tags mail. It is the duty of whatever you are
> using that calls SA to take appropriate action.
>
>> I would appreciate any hints!
>
> For starters... Are you actually scanning outgoing mail for Spam?
>
> guenther
>
>
> --
> char
> *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
> main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8?
> c<<=1:
> (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0;
> }}}
>
>
>
--
View this message in context: http://www.nabble.com/Block-a-user-based-on-content-tf3525541.html#a9836724
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Block a user based on content
Posted by guenther <gu...@rudersport.de>.
On Wed, 2007-04-04 at 05:30 -0700, dougp23 wrote:
> I have a user IN the company, who loves to forward these large messages,
> things like "Check out these so cute puppies", and "Photoshop Magic" and
> what not. Pure drivel.
>
> Anyway, Can I tell SA to "block sending email from jsmith" when "mutliple
> jpgs attached" or something like that?
No. Usual answer...
SA does not block mail. SA tags mail. It is the duty of whatever you are
using that calls SA to take appropriate action.
> I would appreciate any hints!
For starters... Are you actually scanning outgoing mail for Spam?
guenther
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}