You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Martin <ma...@idkommunikation.com> on 2004/06/02 10:51:34 UTC
Mail with large attachments not being checked by SA
Hi,
I've seen this a few times before:
Jun 2 10:42:50 aspam postfix/smtpd[13553]: connect from
av3-1-sn3.vrr.skanova.net[81.228.9.109]
Jun 2 10:42:50 aspam postfix/smtpd[13553]: 6166F13886:
client=av3-1-sn3.vrr.skanova.net[81.228.9.109]
Jun 2 10:42:50 aspam postfix/cleanup[13618]: 6166F13886:
message-id=<BC...@telia.com>
Jun 2 10:44:08 aspam postfix/nqmgr[28758]: 6166F13886:
from=<gn...@telia.com>, size=8210144, nrcpt=1 (queue active)
Jun 2 10:44:08 aspam postfix/smtpd[13553]: disconnect from
av3-1-sn3.vrr.skanova.net[81.228.9.109]
Jun 2 10:44:09 aspam postfix/pickup[13565]: D46BD13889: uid=500
from=<se...@telia.com>
Jun 2 10:44:09 aspam postfix/cleanup[13618]: D46BD13889:
message-id=<BC...@telia.com>
Jun 2 10:44:09 aspam postfix/pipe[13640]: 6166F13886:
to=<my...@mydomain.com>, relay=filter, delay=79, status=sent
(aspam.idkommunikation.com)
Jun 2 10:44:10 aspam postfix/nqmgr[28758]: D46BD13889:
from=<se...@telia.com>, size=8210267, nrcpt=1 (queue active)
Jun 2 10:44:18 aspam postfix/smtp[13649]: D46BD13889:
to=<my...@mydomain.com>, relay=192.168.2.70[192.168.2.70], delay=10,
status=sent (250 OK)
As you can see the message size is 8210267 (~8mb) But there's no trace
of SA scanning the message. Usually i see this line in a clean message:
ie: spamd[13675]: clean message (2.3/5.0) for filter:500 in 1.3 seconds,
8124 bytes.
Am i having any configuration issues here, or should SA not deal with
messages with large attachments?
Thank you
/ Martin
Re: Mail with large attachments not being checked by SA
Posted by Cami <ca...@mweb.co.za>.
> As you can see the message size is 8210267 (~8mb) But there's no trace
> of SA scanning the message. Usually i see this line in a clean message:
Do you know how long SA would take to scan an 8 meg mail??
> ie: spamd[13675]: clean message (2.3/5.0) for filter:500 in 1.3 seconds,
> 8124 bytes.
>
> Am i having any configuration issues here, or should SA not deal with
> messages with large attachments?
Default maximum size that SA will scan is 250k
Cami
Re: Mail with large attachments not being checked by SA
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Wed, 2 Jun 2004, Loren Wilton wrote:
> It could probably try to separate the binary from the text and only process
> the text, but apparently the devs don't consider this worthwhile. I suspect
There is already a tool that will let you do just that, MIMEDefang.
Use it to pick apart the message and then feed the various pieces
to appropriate tools (text & html -> SA, binaries -> AV, etc).
The Unix philosophy is to use many small tools, each one doing one
job well, rather than the all-singing-dancing bloat-ware approach.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Mail with large attachments not being checked by SA
Posted by Martin <ma...@idkommunikation.com>.
Loren Wilton wrote:
> SA assumes that large messages are real and skips them. If that 8MB were
> all text, it would take forever to process the message through SA anyway.
> It could probably try to separate the binary from the text and only process
> the text, but apparently the devs don't consider this worthwhile. I suspect
> they are right; the number of large messages that are spam (at least
> deliberate spam) are still (so far!) vanishingly small.
Hi Loren,
When it comes to my mind, it actually sounds quite logic. This is
probably the case. Thanks for pointing that out to me.
/ Martin
Re: Mail with large attachments not being checked by SA
Posted by Loren Wilton <lw...@earthlink.net>.
> Am i having any configuration issues here, or should SA not deal with
> messages with large attachments?
SA assumes that large messages are real and skips them. If that 8MB were
all text, it would take forever to process the message through SA anyway.
It could probably try to separate the binary from the text and only process
the text, but apparently the devs don't consider this worthwhile. I suspect
they are right; the number of large messages that are spam (at least
deliberate spam) are still (so far!) vanishingly small.
Loren