procmail
[Top] [All Lists]

Re: using a blacklist file to stop some spam

2002-02-12 09:14:49
On 12 Feb, General P. Fault wrote:
| In the previous episode (12.02.2002, 13:10:35), Manuel Hendel
| <Manuel(_dot_)Hendel(_at_)easygolucky(_dot_)de> said:
| 
| > I go the following in my .procmailrc:
| > 
| > ****
| > BLACKLIST=$PROCMAILDIR/blacklist
| > 
| > :0 Wi
| > | (formail -x from: -x sender: -x to: | grep -iq -f $BLACKLIST)
| > $MAILDIR/mail-blacklist
| > ****
| 
| try this:
| 
| :0:
| * ? test -f ${BLACKLIST} && (formail -zxFrom: -zxReply-To: | egrep -i -f
| ${BLACKLIST})
| $MAILDIR/mail-blacklist
| 

[Note: somewhere along the way both condition lines above got wrapped.
They each have to be on one line, or be continued with a trailing "\".]

Although this identifies Manuel's basic problem (incorrect syntax of the
condition), and fixes a couple other things (removing unnecessary flags
and adding the local lockfile), I wouldn't bother with "test -f". If
$BLACKLIST doesn't exist, then grep will exit non-zero and the condition
will fail anyway. If preventing the logging of that error is the intent
(though Manuel might want that error logged), stderr can be redirected
to /dev/null. I'd also suggest that formail's -z option is unnecessary,
though harmless. So I would "simplify" that to:

:0:
* ? formail -xFrom: -xReply-To: |grep -if $BLACKLIST 2>/dev/null
$MAILDIR/mail-blacklist

I reverted back to grep which should be fine given the examples Manuel
gave originally. If he uses extended regular expressions in $BLACKLIST,
he'll have to change it to egrep (or grep -E). I'm also pretty sure
prepending $MAILDIR/ to the delivery target is unnecessary but, since I
don't explicitly use $MAILDIR myself, someone else will have to chime
in if it matters.

Lastly, I'll note that you changed the headers extracted for matching
in a way that will make this filter less aggressive (he originally used
To:, Sender:, and From:). Making a guess from his original choices that
Manuel intends this filter to be more aggressive, not less, I'd suggest
removing formail altogether:

:0:
* ? grep -if $BLACKLIST
mail-blacklist

That way if any of the patterns turn up anywhere in the headers, the
messages will be filtered. If he wants to match on From: *and* To:, then
he'd probably be just as happy also matching Return-Path:, Received:,
etc. I can't say definitively, but I'd guess that letting procmail scan
all the headers is more efficient than using formail to extract specific
ones to pipe to grep. If my guess about Manuel's intent is correct, then
this is probably closer to what he's trying to do. Of course, if my
guess isn't correct, then he can replace and adjust the formail command
accordingly.

-- 
Reply to list please, or append "6" to "procmail" in address if you must.
Spammers' unrelenting address harvesting forces me to this...reluctantly.


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>