procmail
[Top] [All Lists]

Procmail, Spambouncer, and some weird behavior

2002-04-17 05:51:42

   Let me start by stating I am a procmail neophyte, so please go easy on me. 
I've read the FAQ and will attempt to
provide as much information as I can. Please feel free to ask me for me.

   I've installed the most wonderful Spambouncer at home after running in on 
Solaris at work. However, at home, I am
running it under RedHat 7.2 and instead of having mail delivered directly to 
me, I am using fetchmail to retreive it
from my POP server at my ISP. I run qppoper on the linux box so I can get the 
mail with Eudora from a Windows box
next to it.

   My POP account is setup such that *(_at_)ita(_dot_)org comes to me. However, 
there seems to be several organizations out in
the world that have acronyms every similar to mine, so, on a daily basis, I get 
a lot of misdirected mail for other
people. While not exactly spam, it is unwanted.

   In my .myemail address for Spambouncer, I have listed all the email 
addresses I use or want to get email from,
as per the web page. I have a handful of trusted addresses in my .nobounce 
file, and 2 mailing lists in my legistlists
file.

   It is my understanding that if an address does not appear in .nobounce, 
legitlists, or .myemail, spambouncer should
not tag the message as OK and pass it along. Is this an incorrect understanding?

   Here is the .fetchmailrc I am using to retreive the mail:

----------------- cut here ---------------

poll mail00337.popserver.pop.net
     proto pop3
     user mail00337
     password XXXX wants mda "/usr/bin/procmail -d %T"
     fetchall

---------------- cut here ----------------

   That mail is then redirected into the "mickey" user's mailbox on the linux 
box. I *think* this is where
spambouncer's confusion is coming from, but I am too inexperienced to be able 
to properly interpret the log.
Here is what comes out of the verbose log entry:

--------------- cut here -----------------

procmail: Executing "/usr/bin/formail,-AX-SBClass: OK"
procmail: Assigning "LINEBUF=4096"
procmail: No match on "yes"
procmail: Executing " test -f ${MYEMAIL} && \
    (${FORMAIL} -zxFrom: -zxReply-To: |\
    fgrep -i -f ${MYEMAIL})"
procmail: Non-zero exitcode (1) from " test -f ${MYEMAIL} && \
    (${FORMAIL} -zxFrom: -zxReply-To: |\
    fgrep -i -f ${MYEMAIL})"
procmail: No match on " test -f ${MYEMAIL} && \
    (${FORMAIL} -zxFrom: -zxReply-To: |\
    fgrep -i -f ${MYEMAIL})"
procmail: Bypassed locking "/var/spool/mail/mickey.lock"
procmail: Executing " ${FORMAIL} -A"X-Folder: Bulk" >>${BULKFOLDER}"
procmail: Assigning "LASTFOLDER= ${FORMAIL} -A"X-Folder: Bulk" >>${BULKFOLDER}"
procmail: Notified comsat: "mickey@:/home/mickey/Mail/ ${FORMAIL} -A"X-Folder: 
Bulk" >>${BULKFOLDER}"
From crow-feather(_at_)msn(_dot_)com  Wed Apr 17 00:45:14 2002
 Subject: Fw: Quote of the Year
  Folder:  ${FORMAIL} -A"X-Folder: Bulk" >>${BULKFOLDER}                   3088

--------------- cut here -----------------

   I note the procmail Non-zero exit code while checking my .myemail file 
(where there are lots of username(_at_)ita(_dot_)org
addresses). Here are the headers from this particular message

--------------- cut here -----------------

From mickey  Wed Apr 17 00:45:14 2002
Received: from mail00337.popserver.pop.net [199.171.54.231]
        by localhost with POP3 (fetchmail-5.9.11)
        for mickey(_at_)localhost (single-drop); Wed, 17 Apr 2002 00:45:14 
-0400 (EDT)
Received: from mr4.ash.ops.us.uu.net by ps2.ash.ops.us.uu.net with ESMTP 
        (peer crosschecked as: mr4.ash.ops.us.uu.net [198.5.241.89])
        id QQmkxv15397
        for <mail00337(_at_)vpop4(_dot_)pop(_dot_)net>; Wed, 17 Apr 2002 
04:46:46 GMT
Received: from cpimssmtpu05.email.msn.com by mr4.ash.ops.us.uu.net with ESMTP 
        (peer crosschecked as: cpimssmtpu05.email.msn.com [207.46.181.81])
        id QQmkxv26369
        for <RBerg(_at_)ITA(_dot_)org>; Wed, 17 Apr 2002 04:46:45 GMT
Received: from hppav ([67.227.173.111]) by cpimssmtpu05.email.msn.com with 
Microsoft SMTPSVC(5.0.2195.4617);
         Tue, 16 Apr 2002 21:46:43 -0700
Message-ID: <001401c1e5ca$dc99b560$6fade343(_at_)hppav>
From: "crow-feather" <crow-feather(_at_)msn(_dot_)com>
To: "Anne Atchley" <aatchley(_at_)hubwest(_dot_)com>, "B52Bob" 
<B52Bob(_at_)prodigy(_dot_)net>,
        <Bergberger(_at_)aol(_dot_)com>, "Brian Tousley" 
<Btousley(_at_)fretel(_dot_)com>,
        "Greg Griffel" <GGriffel(_at_)fretel(_dot_)com>,
        "Letha Whitmore" <letha(_at_)fretel(_dot_)com>, "Robert Berg" 
<RBerg(_at_)ITA(_dot_)org>
Subject: Fw: Quote of the Year
Date: Tue, 16 Apr 2002 22:46:35 -0600
MIME-Version: 1.0
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

--------------------- cut here ------------------

   See that very first line, where is it says 'From mickey'? I think that's 
something being entered there
by fetchmail, although I can't see how or why. Perhaps that is what is being 
triggered against my .myemail
file? None of the addresses in the To: line are in my .myemail file at all. Nor 
is "Crow Feather" in my
.nobounce.

   I think that's all the information I can provide. I will attach my 
.procmailrc at the bottom of this
for review (but below all this content so you can skip it if you want :> ).

   I appreciate input or comments on how to resolve this and why it's happening 
so I can learn to troubleshoot
it in the future.


   Thanks.

Mick


















--------------------- .forward -----------------------


"|IFS=' '&&exec /usr/bin/procmail -f-||exit 75 #mickey"

--------------------- .procmailrc --------------------


# A SAMPLE .PROCMAILRC FILE FOR NOVICES
# Written by Catherine Hampton <ariel(_at_)tempest(_dot_)boxmail(_dot_)com>
# Version 1.3
# Updated 4/18/00
#
# Released to the Public Domain.
#
#
# SET VARIABLES

# Internal Variables

SHELL=/bin/sh               #Shell used to run procmail.  Be sure this points to
                            #your system's copy of sh.  DO NOT substitute a
                            #different shell unless you really know UNIX

LINEBUF=4096                #Needed to keep Procmail from choking on long
                            #"recipes", or instructions on what to do with
                            #particular kinds of email.

PATH=$HOME/bin:/bin:/usr/bin:/usr/local/bin
                            #Path for your programs -- this is probably best
                            #left alone.

VERBOSE=off                  #Change this to "on" when you try a new recipe
                            #so that Procmail will log literally every step
                            #it takes.  DO NOT LEAVE IT ON, though, because
                            #it creates huge logfiles.

# Default Program & file locations

MAILDIR=${HOME}/Mail          #you'd better make sure this directory exists

DEFAULT=/var/spool/mail/mickey
                            #default incoming mailbox for shell2-5 users
                            #on Best Internet.  Substitute the correct
                            #setting for your system.

ADMINFOLDER=${DEFAULT}  #for bounced mail, mail from root,
                        #postmaster, abuse, etc. Change this to
                        #${DEFAULT} if you use
                        #Eudora, Pegasus Mail, Netscape, Internet
                        #Explorer, or another Windows- or Mac-based
                        #POP email program.

BULKFOLDER=${DEFAULT}    #for bulk mail which appears legitimate, such
                         #as mail from mailing lists or mail sent using
                         #Bcc:  Change this to ${DEFAULT} if you use
                         #Eudora, Pegasus Mail, Netscape, Internet
                         #Explorer, or another Windows- or Mac-based
                         #POP email program.

LOGFILE=${MAILDIR}/log      #Logs message disposition.  Recommended -- otherwise
                            #errors are emailed to you. :/

MYEMAIL=${HOME}/.myemail       #Tells Procmail where your MYEMAIL
                               #file is located, a text file containing all the
                               #email addresses you use.

FORMAIL=/usr/bin/formail #useful for autoreply recipes.  If you
                         #are not on Best Internet, modify this to
                         #your system's copy of formail.

SENDMAIL=/usr/sbin/sendmail    #useful for autoreply recipes.  If you are
                               #not on Best Internet, modify this to point
                               #to your system's copy of sendmail.

# SpamBouncer settings
#
# You can ignore these if you aren't installing the Spam Bouncer.
# If you are installing the Spam Bouncer, PLEASE BE SURE TO READ
# the installation instructions at <http://www.spambouncer.org/>.

ALTFROM=XXXXXXXXXXXXX     #An alternate email address which doesn't
                                 #show your normal email address, so that
                                 #spammers don't get your usual email address
                                 #from complaints.  Set this to a real email
                                 #address, but not one you use for private
                                 #email, preferably.

BLOCKFOLDER=${DEFAULT}  #for suspicious mail, but possibly not spam

BLOCKREPLY=SILENT                 #SILENT tells the SpamBouncer to just filter
                                  #blocked email, and not reply to it.
                                  #NOTIFY tells the SpamBouncer to tell the
                                  #sender that his/her email was blocked, and
                                  #tells them how to bypass the filter if their
                                  #email is legitimate.

BYPASSWD=XXXXXXXXX                #Password that allows people who send you
                                  #legitimate email, but whose email is
                                  #blocked for some reason by the Spam Bouncer,
                                  #to bypass the Spam Bouncer.  Change this
                                  #frequently.

FREEMAIL=${HOME}/spam_bouncer/freemail  #Tells the Spam Bouncer whether to 
filter
                                        #email from sites which offer free email
                                        #addresses, and which list to use.

MYEMAIL=${HOME}/.myemail     #Tells the Spam Bouncer all email addresses that
                             #belong to you.  Useful for distinguishing personal
                             #from bulk email.

NOBOUNCE=${HOME}/.nobounce   #Tells the Spam Bouncer where your NOBOUNCE
                             #file is located.

NOLOOP=${ALTFROM}            #Setting for email address used in X-Loop:
                             #header, a header which should prevent
                             #mailing loops.  Leave this alone unless
                             #you know what you're doing.

PATTERNMATCHING=SILENT       #Enables the Spam Bouncer's Pattern Matching
                             #filter.  NONE disables the filter; SILENT
                             #causes it to filter out suspected spam
                             #but not notify the senders; NOTIFY causes it
                             #to both filter out suspected spam and notify
                             #the sender exactly as for other blocked email.

SBDIR=${HOME}/spam_bouncer       #Directory where SpamBouncer program files
                                 #are located.  Edit this to point to that
                                 #directory on your system.

SPAMFOLDER=${HOME}/Mail/spam     #change this to SPAMFOLDER=/dev/null
                                 #to delete spam entirely.

SPAMREPLY=SILENT               #SILENT tells the Spam Bouncer to filter spam,
                               #but not attempt to autocomplain about it.
                               #BOUNCE tells the Spam Bouncer to send a
                               #"MAILER-DAEMON" bounce message to the spammer.
                               #COMPLAIN tells the Spam Bouncer to send an
                               #autocomplaint to the spammer's postmaster and
                               #upstream sites.  BOTH tells the Spam Bouncer to
                               #send both a bounce to the sender and complain
                               #to the spammer's postmaster.

############# Other Spambouncer Variables ############################

     CHINESE=no
     DATE=date
     DEBUG=no
     DORKSLCHECK=yes
     DULCHECK=no
     FILTER=no
     FREEMAIL=INTERNAL
     GARBLEDCHARSET=yes
     GLOBALNOBOUNCE=NONE
     GREP=fgrep
     JAPANESE=no
     KOREAN=no
     LEAN=yes
     LEGITLISTS=NONE
     MYEMAIL=$HOME/.myemail
     NOBOUNCE=${HOME}/.nobounce
     NSLOOKUP=nslookup
     ORBLCHECK=no
     ORBZINCHECK=no
     ORBZOUTCHECK=no
     ORDBCHECK=no
     OSDIALCHECK=no
     OSSPAMCHECK=yes
     PROXYSOCKS=no
     RBLCHECK=no
     RM=rm
     RSSCHECK=yes
     RUSSIAN=no
     SPAMHAUSORGCHECK=yes
     SPAMREPLY=SILENT
     TEST=test
     THISISP=${HOST}
     TURKISH=no
     VIRUSFOLDER=${SPAMFOLDER}

################### End Spambouncer Variables #########################


# BEGIN RECIPES

# Create a backup cache of 100 most recent messages in case of mistakes
:0 c
backup

  :0 ic
  | cd backup && rm -f dummy `ls -t msg.* | sed -e 1,100d`

# Regenerate "From" lines to make sure they are valid
:0 fhw
| formail -I "From " -a "From "


# MAILING LISTS

# Filter out mail from all mailing lists you are on =before= spam
# filtering.  I included two I subscribe to and recommend highly, but
# your list will doubtless be different.  Just duplicate the recipe
# for each mailing list you are on, and put the correct address for
# the list in the condition statement.  (The "* ^TO" part.)  If you
# read mail on shell, you may find it easier to deliver this mail
# to separate folders, especially for busy lists.  I do. :)


# Procmail list (Wonderful for new Procmail users!)
:0:
* ^TOprocmail(_at_)Informatik(_dot_)RWTH-Aachen(_dot_)DE
| ${FORMAIL} -A"X-Folder: Bulk" >>${BULKFOLDER}


# Call the Spam Bouncer to filter remaining mail for spam.
INCLUDERC=${SBDIR}/sb.rc


# Sort out mail that really is to you from mail Bcc'd to you, or mail
# which doesn't have any of your email addresses on the To: or Cc: line.
# For this to work properly, you must create a text file named .myemail
# in your home directory and enter all email addresses that belong to
# you in it, one per line, just as you do with your .nobounce file. 
#
# This does =wonders= in keeping spam from appearing in your personal
# mail. :)
#
# Substitute your shell account email address, custom domain, and any other 
email
# address you may have for the entries below.
:0:
* ? test -f ${MYEMAIL} && \
    (${FORMAIL} -zxFrom: -zxReply-To: |\
    fgrep -i -f ${MYEMAIL})
| ${FORMAIL} -A"X-Folder: Default" >>${DEFAULT}

# Deliver email which passed spam filtering, but which wasn't sent to
# a recognizable personal email address of yours, to your "bulk mail"
# folder, for reading on a less-urgent basis.
:0:
| ${FORMAIL} -A"X-Folder: Bulk" >>${BULKFOLDER}

# Done :)
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>
  • Procmail, Spambouncer, and some weird behavior, Mickey <=