On Mon, Dec 11, 2006 at 09:30:48PM +1100, Robert S wrote:
I am running sendmail with procmail, which feeds the messages
to spamassassin. I do not want to run local or messages from
authenticated connections through spamassassin. What is the best
way of recognising these headers in procmail? At the moment
I'm using the "Received: from " header, but there are a lot of
different permutations and combinations of these and the best I
can do at the moment is to use the name of every sending computer
on the local network.
Is there a straightforward and robust way of doing this?
For local messages, a good way to confirm what they are is to
count Received lines. And make sure your server is in the
bottom line. We just had a mini-discussion (again) last week on this
list about counting the lines, so you might want to review the
archives for this group, searchable from the home page (see
footer to this email).
RMIN = 2 # set to your Received count for local mail; may well be 1
WS = ' ' # a space and a tab inside the single-quotes
SUSPECT = folder-for-suspicious-mail
MYSERVER = my.mail.server
:0
* $ 1^1 ^Received: from \/[^$WS]+
{
RCOUNT = $=
BOTTOMHOST = $MATCH
:0:
* $ $RCOUNT ^0
* $ -$RMIN ^0 MATCH ?? ^^$\MYSERVER^^
$SUSPECT
}
This set of recipes work using weighted scoring and should put in
$SUSPECT messages with more then the minimum Received-count or ones
that might have the minumum but don't match on "my.mail.server"
in the bottom Received line. That's a simplified test to get you
started. One can embelish it in various ways, but it's a good
start.
Dallman
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail