here's the script I currently use; mailbox handling is still quite bad but, hey it works for me. New in this version: it'll print a warning with the sender address of each email that DOESN'T contain a forwarded message, so you can easily tell the users: "Please forward as an ATTACHMENT, don't use normal forwarding". This seems necessary, I've hat lots of users try to submit spam via normal forward which doesnt't work at all (headers changed, sender/recipient mixed up....).
I took an earlier version of Martin's script, and with some procmail handling determined whether to feed it into the script, or try to handle in another method. At my site, some people use a client that can forward as an attachment, and some use one that can only redirect. On the theory that the redirected messages while not great are better than nothing, I feed those through too (although a flag for learning from body only for sa-learn would be nice). My method is far from perfect, especially since it assumes that anything with a rfc822 attachment has the spam in the attachment, and the modified perl code I took from Martin is fairly badly hacked by me. (Notably, the one change I really made to the code was to make it not have to dump to a file before being learned, it's just sent into sa-learn).
The perl code for convert2.pl could undoubtably be cleaned up significantly more than I have it, I just never got around to it. The .procmailrc could also be used to filter out messages that don't have attached spam simply by removing the last two rules (again, it does assume that any attached message is spam, which might not be true).
.procmailrc:
:0 cB: processing
* Content-Type: message/rfc822;
| /usr/bin/perl /home/strap/convert2.pl | /usr/local/bin/sa-learn --spam --single
:0 A: /home/strap/rfc822spam
:0c: processing | /usr/local/bin/sa-learn --spam --single
:0: /home/strap/modifiedspam
---------------------- convert2.pl: #!/usr/bin/perl
# Durchschauen einer mailbox nach message/rfc822 attachments use Mail::Util qw(read_mbox); use MIME::Parser; use IO::Lines;
# set to 1 to enable debugging my $debug = 0;
# set to 1 if running under cron (disables output) my $cron = 0;
my $mailbox="/home/strap/learned-spam"; my $tempdir = "/home/strap/tmp"; my $learndir = "/home/strap/learned";
@msgs = read_mbox("/dev/stdin");
#unlink ($mailbox);$cnt = 0;
foreach (@msgs) {
$debug && print ("Message $cnt\n");
my $parser = new MIME::Parser;
$parser->output_dir($tempdir);
$parser->extract_nested_messages(0); $AH = new IO::Lines;
$AH->open($_);
$entity = $parser->parse($AH);$num_parts = $entity->parts;
$debug && print (" Parts: $num_parts\n");
for ($i=0;$i<$num_parts;$i++) {
$part = $entity->parts($i);
if ($part->effective_type eq "message/rfc822") {
$debug && print (" File:
".$part->bodyhandle->path."\n");
@args = ("cp", $part->bodyhandle->path, "/dev/stdout");
system (@args);
}
}
$parser->filer->purge;
#$entity->dump_skeleton;
$cnt++; }
Gary Schrock [EMAIL PROTECTED]
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
