Thunderbird Forwarding Spam

[itdelany <it...@delany.com.ar>]

Hi


I am running a Postfix mail server set up with 
http://flurdy.com/docs/postfix/ flurdis guide  using SpamAssassin as well
with a Bayesian Filter.


At SpamAssasin site said this:


If you want to set up site-wide use of Bayesian classification, you should
set up a way for your users to send in misclassified mail to be "learned"
from.
If you create mailboxes for false positives and false negatives, you can
then run a cron job intermittently to learn all the mails in that mailbox as
spam (or non-spam).


So i said to my users to send unwanted email to trash@domain.com and
nonspam@domain.com, 
currently i reached the number necessary to run the sa-learn filter and i
saw this (at spamassasin site too):


For MUAs (Like Netscape/Mozilla) that do a good job with keeping original
headers intact, (almost) all you need to do is forward the email to the
feedback account and strip off the header added by the forward.

- Has someone gone throught this situation before? What did you do to clean
the email from forward headers? Can you please give me the details for
stripping forward headers added by Mozilla Thunderbird? 



Is this the only thing to do with Outlook based clients ? :

Create a *new* mail message in Outlook/Express. Resize the windows so that
you can see both your new message as well as the main O/OE window. Select
the messages you want to send as Spam or Ham (probably not both in the same
message) and drag them "into" the new message. This will send all the
messages as attachments to the main email.


Thanks for all your help !!
-- 
View this message in context: http://www.nabble.com/Thunderbird-Forwarding-Spam-tf2539303.html#a7074322
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Thunderbird Forwarding Spam

[itdelany <it...@delany.com.ar>]

I edited the script to be able to run it from command line, it parses every
file under $dirname variable 
and save the results (tripped emails) under $path.
I am not a Perl Coder (But a Java One ;) ) so comments are welcome. I made
it available here: 

#!/usr/bin/perl
#


my $path = "Spam/";
use Mail::SpamAssassin::Message;
use Data::UUID;
my $dirname = "MailsSpamToProcess/";


   
opendir(DIR, $dirname) or die "can't opendir $dirname: $!";

while (defined($file = readdir(DIR))) {

	#print $dirname . $file;
	open(INFO, $dirname . $file);		# Open the file
	@message = <INFO>;		# Read it into an array
	#print @message;

my $msg = Mail::SpamAssassin::Message->new(
    {
      'message' => \@message,

    }
) || die "Message error?";
print "@message";

foreach my $p ($msg->find_parts(qr/^message\b/i, 0)) {
    eval {

           #no warnings ;
           my $type = $p->{'type'};
           my $ug = new Data::UUID;
           my $uuid1 = $ug->create_str();
           my $attachname = $path . $uuid1 . ".eml";
           open OUT, ">", "$attachname" || die "Can't write file
$attachname:$!";
           binmode OUT;
           print OUT $p->decode();
    };
}



	close(INFO);
}
closedir(DIR)

I have one more question, before i enable bayes filter on my site, what if
no bayes_path is specified on local.cf? Will it use the default path 
(/root/.spamassassin/) ?

Thanks :) !

>I haven't tested this script by running it manually and this script is
>not written by me. But you can run it manually as it is a script it
>can be run from the command line. I don't know about the parameters
>may be you can pass a fake or unwanted email to this script.


-- 
View this message in context: http://www.nabble.com/Thunderbird-Forwarding-Spam-tf2539303.html#a7098708
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Thunderbird Forwarding Spam

[ankush grover <an...@gmail.com>]

On 10/30/06, itdelany <it...@delany.com.ar> wrote:
>
> Hey, thanks for your help, because i see that it will take me some time to do
> all that i'll ask you some preliminary questions:
>
> 1) Can i run the script by hand just for testing purposes?  Do you know how
> can i do this? Do i have to pass some parameters to the command line?

I haven't tested this script by running it manually and this script is
not written by me. But you can run it manually as it is a script it
can be run from the command line. I don't know about the parameters
may be you can pass a fake or unwanted email to this script.


> 2)The script takes the message and leaves everything down "Content-Type:
> Message" right?

May be yes. The script extracts the original mail from the forwarded
mail and then through sa-learn we make spamassassin learn it as spam.

> 3) Can i follow this rules on a production server? is it safe ?
>
People are using it on production server including me.

> Many Thanks for your help!
>
> your Script:
>
>
> _________________________
>
> #!/usr/bin/perl
>
> use strict;
> use warnings;
>
> my @message = <STDIN>;
> my $path = "/tmp/spam/";
>
> use Mail::SpamAssassin::Message;
> use Data::UUID;
>
> my $msg = Mail::SpamAssassin::Message->new(
>    {
>      'message' => \@message,
>    }
> ) || die "Message error?";
>
> foreach my $p ($msg->find_parts(qr/^message\b/i, 0)) {
>    eval {
>           no warnings ;
>           my $type = $p->{'type'};
>           my $ug = new Data::UUID;
>           my $uuid1 = $ug->create_str();
>           my $attachname = $path . $uuid1 . ".eml";
>           open OUT, ">", "$attachname" || die "Can't write file
> $attachname:$!";
>           binmode OUT;
>           print OUT $p->decode();
>    };
> }
>
>
>
> --
> View this message in context: http://www.nabble.com/Thunderbird-Forwarding-Spam-tf2539303.html#a7076401
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
>

Re: Thunderbird Forwarding Spam

[itdelany <it...@delany.com.ar>]

Hey, thanks for your help, because i see that it will take me some time to do
all that i'll ask you some preliminary questions:

1) Can i run the script by hand just for testing purposes?  Do you know how
can i do this? Do i have to pass some parameters to the command line?

2)The script takes the message and leaves everything down "Content-Type:
Message" right?

3) Can i follow this rules on a production server? is it safe ?

Many Thanks for your help!

your Script:


_________________________

#!/usr/bin/perl

use strict;
use warnings;

my @message = <STDIN>;
my $path = "/tmp/spam/";

use Mail::SpamAssassin::Message;
use Data::UUID;

my $msg = Mail::SpamAssassin::Message->new(
    {
      'message' => \@message,
    }
) || die "Message error?";

foreach my $p ($msg->find_parts(qr/^message\b/i, 0)) {
    eval {
           no warnings ;
           my $type = $p->{'type'};
           my $ug = new Data::UUID;
           my $uuid1 = $ug->create_str();
           my $attachname = $path . $uuid1 . ".eml";
           open OUT, ">", "$attachname" || die "Can't write file
$attachname:$!";
           binmode OUT;
           print OUT $p->decode();
    };
}



-- 
View this message in context: http://www.nabble.com/Thunderbird-Forwarding-Spam-tf2539303.html#a7076401
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Thunderbird Forwarding Spam

[ankush grover <an...@gmail.com>]

On 10/30/06, itdelany <it...@delany.com.ar> wrote:
>  Hi
>
>  I am running a Postfix mail server set up with flurdis guide using
> SpamAssassin as well with a Bayesian Filter.
>
>  At SpamAssasin site said this:
>
>  If you want to set up site-wide use of Bayesian classification, you should
> set up a way for your users to send in misclassified mail to be "learned"
> from. If you create mailboxes for false positives and false negatives, you
> can then run a cron job intermittently to learn all the mails in that
> mailbox as spam (or non-spam).
>
>  So i said to my users to send unwanted email to trash@domain.com and
> nonspam@domain.com,
>
> currently i reached the number necessary to run the sa-learn filter and i
> saw this (at spamassasin site too):
>
>  For MUAs (Like Netscape/Mozilla) that do a good job with keeping original
> headers intact, (almost) all you need to do is forward the email to the
> feedback account and strip off the header added by the forward.
>
>  - Has someone gone throught this situation before? What did you do to clean
> the email from forward headers? Can you please give me the details for
> stripping forward headers added by Mozilla Thunderbird?
>
>  Is this the only thing to do with Outlook based clients ? : Create a *new*
> mail message in Outlook/Express. Resize the windows so that you can see both
> your new message as well as the main O/OE window. Select the messages you
> want to send as Spam or Ham (probably not both in the same message) and drag
> them "into" the new message. This will send all the messages as attachments
> to the main email.
>

hey,

There is a script which can do this. Create a user suppose
report-spam@example.com and all the users will forward spam mails to
this address . Please note you need to choose "forward as attachment"
while forwarding the mail to this account (report-spam@example.com0

I am directly posting the mail from the person who helped me configuring this.

 1) user forwards spam message AS ATTACHMENT to a pre-defined
 email address

I tell my users to forward as attachment to report-spam@example.com.

 2) postfix pipes emails to this address to the modified
 script via local alias

I am also using virtual users.  You have to make sure that postfix knows
how to handle local aliases.  From my main.cf:

alias_maps = hash:/etc/aliases

...pointing to the local aliases file.  Then within that file, set up a
local alias to pipe all input to the script.  From my /etc/aliases:

spam-bayes:     "| /etc/scripts/strip_attached_messages.pl"

... Be sure to run the command 'newaliases' after updating the aliases
file.  Then you use virtual_alias_maps to set the
"report-spam@example.com" address to forward to the alias you set up.  I
use MySQL for my virtual_alias_maps, but if you use a file it would have
something like:

report-spam@example.com         spam-bayes

That will forward all emails sent to testing@example.com to the
spam-bayes alias, which will in turn pipe them into your script.

 3) the script strips out all attachments defined as content-type:
 message/*


Cron isn't necessary if you have the alias set up.

 5) a separate cron script then runs on a schedule to pipe all
 messages in /tmp/spam into sa-learn and delete them afterwards

 Need to setup the crontab to call this script

My cron script:
------------------------------------
#!/bin/sh

/usr/local/bin/sa-learn --spam --username=vscan /tmp/spam/
/bin/rm /tmp/spam/*
------------------------------------

--Username=vscan because I am using a single bayes database for all
mail, rather than individual bayes db's for each user.  This method
wouldn't work for individual bayes setups.  My crontab line:

53      1       *       *       *       root
/etc/scripts/train-bayes.sh

... To run it once per day at 1:53 am.  I get a nice email every morning
to root which says:

Learned tokens from 102 message(s) (102 message(s) examined)



The only thing to configure in the script is the path where you want the
attached messages stored until your sa-learn script runs.  I save mine
to /tmp/spam/, and that's where the train-bayes.sh script looks for
them.

Hope this helps.  It has been working very well for me so far.





the Script


_________________________

#!/usr/bin/perl

use strict;
use warnings;

my @message = <STDIN>;
my $path = "/tmp/spam/";

use Mail::SpamAssassin::Message;
use Data::UUID;

my $msg = Mail::SpamAssassin::Message->new(
    {
      'message' => \@message,
    }
) || die "Message error?";

foreach my $p ($msg->find_parts(qr/^message\b/i, 0)) {
    eval {
           no warnings ;
           my $type = $p->{'type'};
           my $ug = new Data::UUID;
           my $uuid1 = $ug->create_str();
           my $attachname = $path . $uuid1 . ".eml";
           open OUT, ">", "$attachname" || die "Can't write file
$attachname:$!";
           binmode OUT;
           print OUT $p->decode();
    };
}


Regards

Ankush Grover