procmail
[Top] [All Lists]

Re: spam filtering for dummies

2000-02-05 16:43:50
At 03:32 -0600 2/5/00, Janelle H wrote:

I am new to the list, new to procmail, and I really don't know all that
much about UNIX either.  So although I've tried reading all sorts of FAQs,
mans, and other such things, mostly what has happened is that I have
gotten even more confused than I already was.

I really don't want to do anything all that complex, but I could really
use some help please!

What I want to do is filter out most of my incoming spam from repeat
spammers.

What I currently have in my .procmailrc file is a whole bunch of recipes
that look pretty much like this:

:0
* ^From:(_dot_)*(_at_)mailexcite(_dot_)com
$HOME/mail/filtered

Obviously, though, this recipe only looks at the "From" line.  What I
would like to do is have a recipe that searches the entire header for the
given search string.

Also, it would be nice if I could have one recipe that searches for all of
the search strings instead of having a separate recipe for each one (which
makes for a pretty long .procmailrc file).

I use procmail's scoring to do exactly that. You start by setting the score negative, and add points for every hit on your keyword list (or subtract them for things you want to whitelist).

One recipe for something like this might be:

:0 H:
* -5^0
* 10^0 @mailexcite\.com
* 10^0 some.other.condition
* 10^0 still_another_condition
. . . etc. . .
* -100^0 Subject: re: uce
$HOME/Mail/filtered

It totals up the score, and if it's greater than zero, it delivers to $HOME/Mail/filtered. The H indicates to egrep the headers, IIRC.

By using constructs like 10^0, I'm indicating it should only get scored for the first hit. If I used 10^1, it'd get ten points for each. If you used "* 10^1 mailexcite.com" instead and "mailexcite.com" appeared three times in the headers, it'd score 30 points. If you set VERBOSE=ON in your .procmailrc, it'll show you the scores anyway as it processes the recipe, but that's practically like cheating. :-)

You should probably read the procmailsc man page before trying this. Also, be aware that there's the potential to divert mail you didn't intend to if you don't use some sort of whitelisting.

If you need more than this, e-mail me off-list.

Scott
--
Chef, n.: Any cook who swears in French.

<Prev in Thread] Current Thread [Next in Thread>