My own antispam recipes

Dear list's friend,

First, I'm new in procmail. I've mailserver running Sendmail + Procmail +
SpamAssassin. I tried to write my own recipes for procmail. They work, but
there is a lot of things to tune-up. They are really unefective, slow, i
send a copy of mail to each recipe because I do not understand the procmail
logic... What is the correct way to redirect mail comming to
user1(_at_)domain(_dot_)com to user2(_at_)domain(_dot_)com ? I can not find it 
in examples, as all
redirects go to mailqueue/ folder and not "mailboxes". Off course, I
searched the archive for access, db, etc. but got no useful results.

Please can anyone help me to tune these rules up ?

Curently I'm checking From: header, but I'd check Received header (the
envelope-from part) - I have written some stupid regexp to search for
"envelope-from" (see variable ENV_FROM). How to use it in the procmail
recipe in place of FROM ? I have some archived mails without the
envelope-from part in the first Received header, in such case I would like
to use From header to suck spammer domain from.
E__MAIL contains recipient's e-mail. It can be in 4 formats: "Your name"
<your(_at_)mail(_dot_)here>, Your name <your(_at_)mail(_dot_)here>, 
<your(_at_)mail(_dot_)here>,
your(_at_)mail(_dot_)here(_dot_)
DOMAIN should contain the domain, which is the mail originating from.
The addspam shell script is used to write into access db and send mail
containing newly added domain to postmaster.
I've created spam_lover user with correct mailbox here, and he would receive
all spams by these recipes.

Please, help me. Any suggestions are VERY welcome.

Peter Rosa



Here are my (newbie) rules:
######################################################################
SHELL=/bin/sh
VERBOSE=yes
ACCESS=/etc/mail/access
FREEMAILS=/etc/mail/freemails.txt

AWK=/usr/bin/awk
TEST=/bin/test
EGREP=/usr/bin/egrep
FMAIL=/usr/local/bin/formail

TO_HEAD=`${FMAIL} -x "To:"`
ENV_FROM=`formail -x "Received:" | ${AWK} -F "envelope-from" '{ print $2 }'
| ${AWK} -F ")" '{ print $1 }'`
E__MAIL=`${FMAIL} -x "To:" | ${AWK} -F '<' '{ if ($2=="") print $1; else
print $2; }' | ${AWK} -F '>' '{ print $1 }'`
FROM_HEAD=`${FMAIL} -x "From:"`
SUBJ_HEAD=`${FMAIL} -x "Subject:"`

DOMAIN=`${FMAIL} -x "From:" | ${AWK} -F@ '{ print $2 }' | ${AWK} -F '>' '{
print $1 }'`
IS_FREEMAIL=`${EGREP} -i ${DOMAIN} ${FREEMAILS} | wc -l`
IS_IN_ACCESS=`${EGREP} -i ${DOMAIN} ${ACCESS} | wc -l`

# skore 15+: add to access db, send notification, delete mail
:0 Wc: access.lock
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
* !^X-Loop: NOTIFY
* ? ${TEST} ${IS_FREEMAIL} -lt 1
* ? ${TEST} ${IS_IN_ACCESS} -lt 1
| /etc/mail/addspam spam ${DOMAIN};
:0 Whc: notify.lock
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
* !^X-Loop: NOTIFY
| (echo "Subject: Deleted *****SPAM*****"; \
   echo "X-Loop: NOTIFY"; \
   echo ""; \
   echo "There was a mail from ${FROM_HEAD},"; \
   echo "Subject: ${SUBJ_HEAD}"; \
   echo "marked as  ***** S P A M *****   and deleted"; \
  $SENDMAIL -oi ${E__MAIL}
:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
* !X-Loop: NOTIFY
/dev/null

# skore 10-14: add to access db, redirect mail
:0 Whc: access.lock
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
* !^X-Loop: NOTIFIKACIA
* ? ${TEST} ${IS_FREEMAIL} -lt 1
* ? ${TEST} ${IS_IN_ACCESS} -lt 1
| /etc/mail/addspam spam ${DOMAIN};

# skore 6-14: redirect mail to spam_lover
:0 Wc: spam_lover.lock
* ^X-Spam-Level: \*\*\*\*\*\*
* !^X-Loop: spam_lover(_at_)pro(_dot_)sk
* !^X-Loop: NOTIFIKACIA
| $FMAIL -A "X-Loop: spam_lover(_at_)pro(_dot_)sk" | \
  $SENDMAIL -oi spam_lover(_at_)pro(_dot_)sk
:0 Whc: notify.lock
* ^X-Spam-Level: \*\*\*\*\*\*
* !^X-Loop: spam_lover(_at_)pro(_dot_)sk
* !^X-Loop: NOTIFY
| (echo "X-Loop: NOTIFY"; \
   echo "Subject: Redirected *****SPAM*****"; \
   echo ""; \
   echo "There is a mail from  ${FROM_HEAD,"; \
   echo "Subject: ${SUBJ_HEAD}"; \
   echo "marked as  ***** S P A M *****   and redirected to
spam_lover(_at_)pro(_dot_)sk"; \
  $SENDMAIL -oi ${E__MAIL}
:0
* ^X-Spam-Level: \*\*\*\*\*\*
* !^X-Loop: spam_lover(_at_)pro(_dot_)sk
* !^X-Loop: NOTIFIKACIA
/dev/null


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail