spamassassin forwarding

[Scott Dortch <sd...@tofg.com>]

I am rather new to linux/postfix/spamassassin so I apologize in advance if this 
has been covered.  I looked through the archives and could not find anything.

A few months ago I successfully installed postfix my MYSQL support and multiple 
domains on linux.  Then after I felt confortable that all was well, I installed 
spamassassin.  It has been tagging email messages as (fairly well) for some 
time now.  

What I would like to see happen is for the messages that are tagged as spam to 
be rejected back to the original sender similar to the way postfix does when 
checking header and body content.  

An acceptable alternative would be to have all mail that is tagged as spam 
forwarded to another (maybe spamtrap for example) that holds messages for a 
certain time period (perhaps 7 days) then deletes them.  

Is this even possible?  Where do I go to learn?

Thanks in advance

Re: spamassassin forwarding

[Scott Dortch <sd...@tofg.com>]

Robert Menschel <Robert <at> Menschel.net> writes:

> 
> Hello Scott,
> 
> Monday, May 24, 2004, 2:00:49 PM, you wrote:
> 
> SD> What I would like to see happen is for the messages that are tagged
> SD> as spam to be rejected back to the original sender similar to the way
> SD> postfix does when checking header and body content.
> 
> If you can figure out how to bounce these back to the original *sender*
> rather than the other hapless victim whose email address is in the From
> or Reply-To header, then more power to you.
> 
> If you can't figure that out, then DO NOT bounce spam. All you'll do is
> share your problem with that other victim, and the spammer will get twice
> his money's worth for that one spam.
> 
> SD> An acceptable alternative would be to have all mail that is tagged as
> SD> spam forwarded to another (maybe spamtrap for example) that holds
> SD> messages for a certain time period (perhaps 7 days) then deletes them.
> 
> I drop ALL spam from three domains into my spamtrap to feed Bayes and my
> corpus. My method probably wouldn't work for you, since my setup is (pick
> one: crazy, strange, weird), but yes, it should be feasible.
> 
> How is SA called, and can you put another program into the stream which
> will redirect spam to your spamtrap?
> 
thank you for your suggestions.  I was hoping to reject the message immediately 
while the connection from the sender is still open.  Not really bounce it 
back.  Anyway, I can see where that could be very difficult.  

As fas as dropping all spam into a spamtrap, this interests me very much.  I 
have SA 2.55 installed now and would be willing to try to upgrade if there is 
an advantage.   I am not sure how SA is called.  I found a file called 
spamassassin-spamc.rc that contains the following:

:0fw
| /usr/bin/spamc

Although I am not sure from where it gets called.  I do not seem to have a 
bayes.db anywhere (which also interests me)  Was there a bayes with 2.55 or was 
that later?  Is there any documentation that would lay out how to set up a 
MYSQL/Postfix/Spamassassin/bayes configuration.  (maybe I need something else 
to, I am not sure amavis for example)?

Scott Dortch

Re: spamassassin forwarding

[Tim Wesemann <ti...@voicenet.com>]

>> If you can figure out how to bounce these back to the original *sender*
>> rather than the other hapless victim whose email address is in the From
>> or Reply-To header, then more power to you.

Actually...

You can use qpsmtpd (it does work with postfix, despite the seemingly
deceptive name...) to run SA while the connection is still open and return a
5xx to the originating MTA while still within the SMTP dialog resulting in
more of a "true bounce".

It's written in perl (slow, but very hackable) -- and I've had good results
using pperl.

--
Timothy G. Wesemann
Voicenet Systems Administration

Re: spamassassin forwarding

[Robert Menschel <Ro...@Menschel.net>]

Hello Scott,

Monday, May 24, 2004, 2:00:49 PM, you wrote:

SD> What I would like to see happen is for the messages that are tagged
SD> as spam to be rejected back to the original sender similar to the way
SD> postfix does when checking header and body content.

If you can figure out how to bounce these back to the original *sender*
rather than the other hapless victim whose email address is in the From
or Reply-To header, then more power to you.

If you can't figure that out, then DO NOT bounce spam. All you'll do is
share your problem with that other victim, and the spammer will get twice
his money's worth for that one spam.

SD> An acceptable alternative would be to have all mail that is tagged as
SD> spam forwarded to another (maybe spamtrap for example) that holds
SD> messages for a certain time period (perhaps 7 days) then deletes them.

I drop ALL spam from three domains into my spamtrap to feed Bayes and my
corpus. My method probably wouldn't work for you, since my setup is (pick
one: crazy, strange, weird), but yes, it should be feasible.

How is SA called, and can you put another program into the stream which
will redirect spam to your spamtrap?

Bob Menschel

Re: spamassassin forwarding

[Jeff Chan <je...@surbl.org>]

On Monday, May 24, 2004, 2:00:49 PM, Scott Dortch wrote:
> I am rather new to linux/postfix/spamassassin so I apologize in advance if this 
> has been covered.  I looked through the archives and could not find anything.

> A few months ago I successfully installed postfix my MYSQL support and multiple 
> domains on linux.  Then after I felt confortable that all was well, I installed 
> spamassassin.  It has been tagging email messages as (fairly well) for some 
> time now.  

> What I would like to see happen is for the messages that are tagged as spam to 
> be rejected back to the original sender similar to the way postfix does when 
> checking header and body content.  

Are you sure you want to do this?  Don't most spams have fake
return addresses?  Wouldn't that result in a lot of false
delivery failure messages to the forged sending addresses?

> An acceptable alternative would be to have all mail that is tagged as spam 
> forwarded to another (maybe spamtrap for example) that holds messages for a 
> certain time period (perhaps 7 days) then deletes them.  

> Is this even possible?  Where do I go to learn?

Yes, that's routinely done, but it's a function of the Mail
Delivery Agent, not SpamAssassin.  Perhaps the SA wiki describes
this further.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/