You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by leemansvg <mi...@usd465.com> on 2006/11/30 22:02:29 UTC
Prevent scanning internal mail
This might be a simple question for most of you. How would I prevent
spamassassin from scanning my internal mail, e.g from a particular server,
or originating from my internal network. E.g if my domain was mydomain.org,
I could whitelist 'mydomain.org' the problem is lately I've seen these pesky
spammers forge email accounts with my own domain name so I dont want to do
that. Any help will be greatly appreciated.
--
View this message in context: http://www.nabble.com/Prevent-scanning-internal-mail-tf2734288.html#a7627865
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Prevent scanning internal mail
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
leemansvg wrote:
> This might be a simple question for most of you. How would I prevent
> spamassassin from scanning my internal mail
Don't pass the mail to SpamAssassin. SA is a mail filter, it'll filter
anything it's given.
Daryl
Re: Prevent scanning internal mail
Posted by Gary V <mr...@hotmail.com>.
>From: Ray Anderson <rs...@rb-com.com>
>
>My solution to this problem is this:
>
>I'm running postfix 2.1.5-5 on Fedora Core 3 and recently had this same
>question come up. I was whitelisting all 30something domains I hosted but
>ran into spammers using foo@<domain name> to get around spam filtering.
>
>My solution was to create a rule in postfix main.cf:
>
>
>smtpd_recipient_restrictions =
> permit_sasl_authenticated,
> check_client_access pcre:/etc/postfix/non-auth.re,
> -- snip --
>
>And the contents of non-auth.re is:
>/^/ PREPEND X-No-Auth: Unauthenticated Sender
>
>Since postfix aborts checking at the first match, this has the effect of
>stamping every single message with a header that I can find and react to,
>which for me bypasses spamd -- note: this decision takes place _after_
>virus scanning, etc.
>
>Hope this helps someone.
>
>-=Ray
>
Variations on a theme:
http://marc.theaimsgroup.com/?l=amavis-user&m=116490679931010
Of course regexp can be used in place of pcre if pcre is not support on a
particular build.
Gary V
Gary V
_________________________________________________________________
Fixing up the home? Live Search can help
http://imagine-windowslive.com/search/kits/default.aspx?kit=improve&locale=en-US&source=hmemailtaglinenov06&FORM=WLMTAG
Re: Prevent scanning internal mail
Posted by Ray Anderson <rs...@rb-com.com>.
Craig Morrison wrote:
> Gary V wrote:
>> Exactly. How you prevent sending the message through SA is not a
>> function of SA itself, but of the implementation, and because of the
>> large number of implementations and configurations I question whether
>> it would be practical (or even related) to provide examples of the
>> various procedures.
>
> Point well taken Gary.
>
>>
>> I didn't see much of anything on this subject in the Wiki.
>
> Neither did I.
>
> I've been googling a bit and the cornucopia of hits for
> <insert_your_MTA_here>+spamassassin is a mess. :-)
>
My solution to this problem is this:
I'm running postfix 2.1.5-5 on Fedora Core 3 and recently had this same
question come up. I was whitelisting all 30something domains I hosted
but ran into spammers using foo@<domain name> to get around spam filtering.
My solution was to create a rule in postfix main.cf:
smtpd_recipient_restrictions =
permit_sasl_authenticated,
check_client_access pcre:/etc/postfix/non-auth.re,
-- snip --
And the contents of non-auth.re is:
/^/ PREPEND X-No-Auth: Unauthenticated Sender
Since postfix aborts checking at the first match, this has the effect of
stamping every single message with a header that I can find and react
to, which for me bypasses spamd -- note: this decision takes place
_after_ virus scanning, etc.
Hope this helps someone.
-=Ray
Re: Prevent scanning internal mail
Posted by Craig Morrison <cr...@2cah.com>.
Gary V wrote:
> Exactly. How you prevent sending the message through SA is not a
> function of SA itself, but of the implementation, and because of the
> large number of implementations and configurations I question whether it
> would be practical (or even related) to provide examples of the various
> procedures.
Point well taken Gary.
>
> I didn't see much of anything on this subject in the Wiki.
Neither did I.
I've been googling a bit and the cornucopia of hits for
<insert_your_MTA_here>+spamassassin is a mess. :-)
--
Craig
Re: Prevent scanning internal mail
Posted by Gary V <mr...@hotmail.com>.
>There's always the blunt method:
>
>"How do I have spamassassin...
>not scan outgoing mail?
>not scan mail for authenticated users?
>not scan mail for Bob, but scan mail for Joe?
>not scan mail from yahoo.com?
>not scan mail <insert condition here>?
>
>Answer:
>Don't call spamassassin when that condition is met. Spamassassin will scan
>all mail fed to it. However you are calling spamassassin, create a work
>around to not call spamassassin for that event.
>
>Think of it as a paper shredder. Your wife gives you a stack of papers, and
>says shred everything except the bank statements.
>
>If you put a bank statement in the shredder, the shredder will shred it."
>
>:-D
Exactly. How you prevent sending the message through SA is not a function of
SA itself, but of the implementation, and because of the large number of
implementations and configurations I question whether it would be practical
(or even related) to provide examples of the various procedures.
I didn't see much of anything on this subject in the Wiki.
Gary V
_________________________________________________________________
Fixing up the home? Live Search can help
http://imagine-windowslive.com/search/kits/default.aspx?kit=improve&locale=en-US&source=hmemailtaglinenov06&FORM=WLMTAG
Re: Prevent scanning internal mail
Posted by Evan Platt <ev...@espphotography.com>.
At 02:13 PM 11/30/2006, you wrote:
>Because of the many ways SA can be implemented, other than the
>suggestion provided, the task of providing a working example of how
>this is accomplished for each possible implementation is not simple
>(because it's no small task to imagine every possible
>implementaion). For example, I came up with about 15 scenarios when
>the implementation involves amavisd-new and Postfix. Considering the
>number of other implementations and specific needs, it is apparent
>there are many ways to approach the issue. In this case for example,
>more information would be needed to give a practical example.
There's always the blunt method:
"How do I have spamassassin...
not scan outgoing mail?
not scan mail for authenticated users?
not scan mail for Bob, but scan mail for Joe?
not scan mail from yahoo.com?
not scan mail <insert condition here>?
Answer:
Don't call spamassassin when that condition is met. Spamassassin will
scan all mail fed to it. However you are calling spamassassin, create
a work around to not call spamassassin for that event.
Think of it as a paper shredder. Your wife gives you a stack of
papers, and says shred everything except the bank statements.
If you put a bank statement in the shredder, the shredder will shred it."
:-D
Re: Prevent scanning internal mail
Posted by Evan Platt <ev...@espphotography.com>.
At 02:35 PM 11/30/2006, you wrote:
>On Thu, Nov 30, 2006 at 04:46:41PM -0500, Craig Morrison wrote:
> > Is there a FAQ entry for this somewhere on the wiki?
>
>There could be, but most people don't look there anyway. I haven't checked.
Read through some frequently asked questions?
FAQ that!
:-D
Re: Prevent scanning internal mail
Posted by Theo Van Dinter <fe...@apache.org>.
On Thu, Nov 30, 2006 at 04:46:41PM -0500, Craig Morrison wrote:
> Is there a FAQ entry for this somewhere on the wiki?
There could be, but most people don't look there anyway. I haven't checked.
--
Randomly Selected Tagline:
"The very essence of leadership is that you have to have a vision. You
can't blow an uncertain trumpet." - Theodore Hesburgh
Re: Prevent scanning internal mail
Posted by Gary V <mr...@hotmail.com>.
>Theo Van Dinter wrote:
>>On Thu, Nov 30, 2006 at 01:02:29PM -0800, leemansvg wrote:
>>>This might be a simple question for most of you. How would I prevent
>>>spamassassin from scanning my internal mail, e.g from a particular
>>>server,
>>>or originating from my internal network.
>>
>>Don't pass those to SpamAssassin. Once SA gets a mail, it'll be scanned.
>>
>
>Is there a FAQ entry for this somewhere on the wiki?
>
>If not, there should be.. This is the 3rd or 5th time in the past couple
>days something similar has been asked..
>
>--
>Craig
Because of the many ways SA can be implemented, other than the suggestion
provided, the task of providing a working example of how this is
accomplished for each possible implementation is not simple (because it's no
small task to imagine every possible implementaion). For example, I came up
with about 15 scenarios when the implementation involves amavisd-new and
Postfix. Considering the number of other implementations and specific needs,
it is apparent there are many ways to approach the issue. In this case for
example, more information would be needed to give a practical example.
http://www200.pair.com/mecham/spam/bypassing.html
Gary V
_________________________________________________________________
Fixing up the home? Live Search can help
http://imagine-windowslive.com/search/kits/default.aspx?kit=improve&locale=en-US&source=hmemailtaglinenov06&FORM=WLMTAG
Re: Prevent scanning internal mail
Posted by Craig Morrison <cr...@2cah.com>.
Theo Van Dinter wrote:
> On Thu, Nov 30, 2006 at 01:02:29PM -0800, leemansvg wrote:
>> This might be a simple question for most of you. How would I prevent
>> spamassassin from scanning my internal mail, e.g from a particular server,
>> or originating from my internal network.
>
> Don't pass those to SpamAssassin. Once SA gets a mail, it'll be scanned.
>
Is there a FAQ entry for this somewhere on the wiki?
If not, there should be.. This is the 3rd or 5th time in the past couple
days something similar has been asked..
--
Craig
Re: Prevent scanning internal mail
Posted by Theo Van Dinter <fe...@apache.org>.
On Thu, Nov 30, 2006 at 01:02:29PM -0800, leemansvg wrote:
> This might be a simple question for most of you. How would I prevent
> spamassassin from scanning my internal mail, e.g from a particular server,
> or originating from my internal network.
Don't pass those to SpamAssassin. Once SA gets a mail, it'll be scanned.
--
Randomly Selected Tagline:
[Rob] Reiner agrees. "If it was made clear to people that we could win
the war on terrorism by driving a hybrid car, that we could stop global
warming by driving a hybrid, I think people would do it," he says. "But
people haven't made those kind of connections."
- http://www.washingtonpost.com/wp-dyn/articles/A2587-2002Jun5.html