Ok I see allot of other talking about procmail but not many talking about
maildrop. I'm not here to say which one is better I dont really care but I
prefer the syntax to maildrop and have put much time into a set of filters.
To this end i figure others may also gain some help from seeing my .mailfilter
so without further ado here you all go.
This implements and uses spamc, anomy-sanitizer and clamscan. I also have a
set of rpm's that will prime your bayes db and get this all running with a
minimal amount of fuss on a new system.
There is also a getmaild script for almost a getmail deamon mode for those
interested.
The main advantage to all this is that it can be used on a regular dial up
account and you don't have to install a mailserver to use it. I do have a
pop3/impa server to use with it if you want but it's not really needed.
This works out of the box also with those wishing to use postfix with maildrop
as their default delievery agent.
If you are missing any of the rpm's to use this let me know. I'll put them all
up for everybody to get at.
#####################################
# log to a file
#####################################
LOGS = 1
#####################################
# Use anomy sanitizer
# Anomy is a good way to prescan for a virus.
# it should also be able ot repalce your virus scanner
#####################################
SANITIZE = 1
#####################################
# for debugging make a copy of meial before sanitizing
# this is also helpfull for learning missed spam
# anomy will alter your emails and as such you dont want
# to learn emails as spam that have been "sanitized" by anomy
#####################################
CCSANITIZE = 1
#####################################
# for debugging make a copy of mail before spam filtering
#####################################
CCDEBUG = 1
#####################################
# not working yet
# Run virus scanning on emails
#####################################
VSCAN = 1
#####################################
# Turn on spam filtering.
#####################################
SPAMFILTER = 1
#####################################
# What point level to have spamassassin learn as spam
#####################################
SPAMLEARN = 25
#####################################
# What point level to have spamassassin delete message
# NOTE: if this number is higher than the autolearn number
# then you will see no effect from it since spamlearn will
# delete the message itself.
#####################################
SPAMDELETE = 35
#####################################
# To send a message in reply to html-mail (Content-Type: text/html)
# set HTML_AUTO_REPLY=1
# Html-mail is diverted to folder 'HTML'. It requires a file
# $HOME/htmlmail.msg containing something like "I'm not a browser".
# Note: This only drops HTML-only messages, so the multipart ones are O.K.
#####################################
HTML_AUTO_REPLY = 0
#####################################
# to send a vacation message in reply to mail that is not spam or bulk mail,
# set VACATION_AUTO_REPLY=1
# It requires a file $HOME/.vacation.msg, containing the body of the auto reply
#####################################
VACATION_AUTO_REPLY = 0
#####################################
# Default directories used by maildrop to deliver your email
#####################################
LMB="Maildir"
DEBUG="Maildir/.Debug"
DEBUGSPAM="Maildir/.Debug.Spam"
SPAM="Maildir/.Spam"
VIRUS="Maildir/.Virus"
UNSANITIZED="Maildir/.Unsanitized"
SANITIZED="Maildir/.Sanitized"
SENDMAIL=/usr/sbin/sendmail
#####################################
# Deafult variable needed for anomy don't delete.
#####################################
ANOMY=/usr/lib/perl5/vendor_perl/5.8.1/
#####################################
# If external filter commands are used, via "xfilter", be sure that this
# user account has a valid shell such as /bin/bash in its /etc/passwd entry.
#
# If Maildrop exits with an error code, then a line with:
# "Unable to filter message." will appear in /var/log/maillog .
#
# If an external program run via "xfilter" fails, then there may be an
# error message returned to Maildrop which Postfix will write to
# /var/log/maillog . To debug such things, use "log We are now doing . . . "
# lines in this .mailfilter file, because Maildrop will not be writing
# to its log file if it fails in some way, and only by scrutinising the
# log lines can I determine how far it got.
#
# Postfix will try periodically to send deferred messages, and this can have
# undesired consequences if the mailfiltering system writes the message somewhere,
# or sends it somewhere, but still does not complete without errors.
#
# To see what is deferred, use the command "mailq".
#
# The "postsuper" command can manage messages in the queue.
#
# To force Postfix to try to process all the deferred messages:
#
# postfix flush
#
#
# Define where I want copies (tagged for deletion) of sorted list messages to go
# in addition to them being sent to their own mailbox. I normally want them
# to be sent to the Inbox ("Maildir") but if I am away from home, and so
# am accessing my email infrequently and probably by the Postman web-mail
# system, or for some other reason, don't want my Inbox cluttered with
# mailing list messages, I can send those copies to a mailbox I named
# "0-Inbox-lists". This "0" puts it up the top of the mailboxes in the left
# pane of Netscape Messenger.
#####################################
`test -d $LMB`
if( $RETURNCODE == 1)
{
`maildirmake++ $LMB`
}
if($LOGS)
{
logfile "$HOME/.maildrop.log"
log "========"
}
#####################################
#
# Checking for duplicates
#
#####################################
`reformail -D 8000 .duplicate.cache`
if ( $RETURNCODE == 0 )
{
if ($LOGS)
{
log "-------------------------------------------------------------
Killed dupe."
}
to "/dev/null"
}
#####################################
#
# If this has already been checked upstream for spam then
# send it to the spam pit right away
#
#####################################
if (/^X-Spam-Flag: YES/)
{
if( $LOGS == 1)
{
log "-------------------------------------------------------------
Spam general. "
}
to "$SPAM"
}
#if (/^X-Virus-Scanned: by amavisd-new/)
#{
#xfilter "subjadd ~~~[NOTSPAM]"
#cc "$SANITIZED"
#SPAMFILTER=0
#}
#####################################
#
# Check to see if message came from local source
# edit to match your local IPs
#
#####################################
/^Received: from .* \(HELO .*\) \(!.*!\)/:h
if ( $MATCH2 =~ /192\.168\.[01]\./ )
{
# This means it is local mail so skip spamfilter
SPAMFILTER=0
}
#
# Now look for mail originating from our Webmail
if (/^X-Mailer: CertaintyTech Webmail .*/:h)
{
# This means it is local Webmail so skip spamfilter
cc "$SANITIZED"
SPAMFILTER=0
}
#####################################
#
# HTML auto reply
#
#####################################
if ( $HTML_AUTO_REPLY )
{
if (/^Content-Type:.*text\/html/ && !/^Precedence: (bulk|list|junk)/)
{ cc "$DEFAULT/.HTML"
xfilter "reformail -r -t"
to "| ( cat - ; echo ""; cat htmlmail.msg) | $SENDMAIL"
}
}
#####################################
#
# Vacation auto reply
#
#####################################
if ( $VACATION_AUTO_REPLY )
{
if (!/^Precedence: (bulk|list|junk)/)
{
cc $DEFAULT
xfilter "reformail -r -t"
/^To:.*/
getaddr($MATCH) =~ /^.*/;
MATCH=tolower($MATCH)
flock ".vacation.lock" {
current_time=time;
if (gdbmopen(".vacation.dat", "C") == 0)
{
if ( (prev_time=gdbmfetch($MATCH)) ne "" && \
$prev_time >= $current_time - 60 * 60 * 24 * 7)
{
exit
}
gdbmstore($MATCH, $current_time)
gdbmclose
}
}
to "| ( cat - ; echo ''; cat .vacation.msg) | $SENDMAIL"
}
}
######################################
# This section copied from the main non-spam ordinary message
# section below.
#
# Copy to account on another machine, in case I accidentally delete
# something from my Inbox, or mistakenly move it somewhere and then
# not know were I put it.
# cc "! [EMAIL PROTECTED]"
# Also copy to a mailbox so I can see them easily.
# But I don't intend to keep this mailbox's contents
# for long.
# cc "Maildir/.0-Inbox-Old.Post-Filter-Inbox"
# Deliver to the Inbox.
# log "------------------------------------------------------------- Saved from
filtering "
# to "Maildir"
######################################
#####################################
#
# First we use amavisd to scan for virii
# If it is virii send it to the virus folder
# dont use this till further debuging
# it will for some reason send all messages to /dev/null
# you have been warned. Anybody knowing how to fix
# this please contact me. Thanks.
#
#####################################
if ($VSCAN)
{
if ($LOGS)
{
log "-------------------------------------------------------------
Clam avscan."
}
# If it isn't Spam, then we scan for Virus
# if it is smaller than 2MB in size...
# anything larger... they are on their own
if($SIZE < 2000000)
{
xfilter "clamscan.sh"
}
if ((/^X-Virus-Status:.*INFECTED/))
{
`test -d $VIRUS`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Virus $LMB`
to "$VIRUS"
}
exception {
to "$VIRUS"
}
}
}
#####################################
#
# Some debugging lines and a place to save things when
# I am tweaking settings.
#
#####################################
if($CCDEBUG)
{
if($LOGS)
{
log "-------------------------------------------------------------
Save debug."
}
`test -d $DEBUG`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Debug $LMB`
cc "$DEBUG"
}
exception {
# Only uncomment this if you mail program can handle it.
#DELTAG=1
cc "$DEBUG"
}
`test -d $DEBUGSPAM`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Debug.Spam $LMB`
}
}
#####################################
#
# Running Spamassassin
# This only works if SPAMFILTER=1 above
# there are also some checks to turn
# off spamfiltering for local delivery
#
# Pipe through SpamAssassin and if it is deemed
# to be spam, dump it in the spam pit and send a
# copy, tagged for deletion, to the Inbox, with
# [SPAM] added to the Subject line.
#
# If it is not deemed to be spam, then send it
# through Anomy Sanitizer to defang it and
# to drop any executable (ie. probably a virus)
# attachments.
#
#####################################
if ($SPAMFILTER)
{
#
# If Spamfilter is enabled then run spamc.
#if ( $SIZE < 250000 && $SPAMFILTER =~ /YES/ )
if ( $SIZE < 250000 && $SPAMFILTER )
{
xfilter "spamc -f"
# Watch out for header line added by Spamassassin.
if ( /^X-Spam-Flag: YES/ )
{
if( $LOGS == 1)
{
log
"------------------------------------------------------------- Spam general. "
}
# Take potential spam and strip out the html
# Feed the beast :-)
# Auto learn email with a score over 25
# My filters are set kind of high and I have allot of them
# you may want to lower this number.
# This will help us to learn emails that the autolearn from
# spamassassin does not normaly learn by itself
/^X-Spam-Status: Yes, hits=![:digit:]+\.?[:digit:]*/
if ($MATCH2>$SPAMLEARN)
{
if( $LOGS == 1)
{
log
"------------------------------------------------------------- Learning spam. "
}
if ($MATCH2>$SPAMDELETE)
{
xfilter "sa-learn --spam"
if( $LOGS == 1)
{
log
"------------------------------------------------------------- Spam added to bayes. "
}
# this will send a report of what was learned
to the mailbox listed
# change this to
# to "/dev/null"
# if you don't want to get these notices
# it is normal to get a message saying
# Learned from 0 message(s) (1 message(s)
examined).
# this is bacause spamassassin has already
learned this message
# so it wont learn it a second time.
if($CCDEBUG)
{
xfilter "reformail -I'From: sa-learn'"
xfilter "reformail -I'Subject: Learn
threshhold $SPAMLEARN exceeded ($MATCH2 total hits) '"
xfilter "reformail -I'MIME-Version:
1.0'"
xfilter "reformail -I'X-SPAM-DELETED:
Deleted at $SPAMDELETE points'"
xfilter "reformail
-I'Content-Disposition: inline'"
xfilter "reformail -I'Content-Type:
Text/Plain;'"
xfilter "reformail -I'Message-ID:'"
xfilter "reformail -I'X-UID:'"
to "$DEBUGSPAM"
}
exception {
if( $LOGS == 1)
{
log
"------------------------------------------------------------- Spam deleted at
$SPAMDELETE points"
}
to "/dev/null"
}
}
exception {
`test -d $SPAM`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Spam $LMB`
if($LOGS)
{
log
"------------------------------------------------------------- Send to Anomy"
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>~/.maildrop.log | cat"
log
"------------------------------------------------------------- Anomy done."
}
exception {
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>/dev/null"
}
cc "$SPAM"
}
exception {
if($LOGS)
{
log
"------------------------------------------------------------- Send to Anomy"
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>~/.maildrop.log | cat"
log
"------------------------------------------------------------- Anomy done."
}
exception {
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>/dev/null"
}
cc "$SPAM"
}
}
if($CCDEBUG)
{
cc "$DEBUGSPAM"
}
xfilter "sa-learn --spam"
if( $LOGS == 1)
{
log
"------------------------------------------------------------- Spam added to bayes. "
}
# this will send a report of what was learned to the
mailbox listed
# change this to
# to "/dev/null"
# if you don't want to get these notices
# it is normal to get a message saying
# Learned from 0 message(s) (1 message(s) examined).
# this is bacause spamassassin has already learned
this message
# so it wont learn it a second time.
if($CCDEBUG)
{
xfilter "reformail -I'From: sa-learn'"
xfilter "reformail -I'Subject: Learn
threshhold $SPAMLEARN exceeded ($MATCH2 total hits) '"
xfilter "reformail -I'MIME-Version: 1.0'"
xfilter "reformail -I'Content-Disposition:
inline'"
xfilter "reformail -I'Content-Type:
Text/Plain;'"
xfilter "reformail -I'Message-ID:'"
xfilter "reformail -I'X-UID:'"
to "$DEBUGSPAM"
}
exception {
to "/dev/null"
}
}
if ($MATCH2>$SPAMDELETE)
{
if( $LOGS == 1)
{
log
"------------------------------------------------------------- Spam deleted at
$SPAMDELETE points"
}
to "/dev/null"
}
exception {
# To make it not go to the Inbox, this "cc" into a "to"
# and comment out the next three lines.
#cc "Maildir/.SPAM"
#DELTAG=1
#xfilter "subjadd ~~~[SPAM]"
`test -d $SPAM`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Spam $LMB`
if($LOGS)
{
log
"------------------------------------------------------------- Send to Anomy"
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>~/.maildrop.log | cat"
log
"------------------------------------------------------------- Anomy done."
}
exception {
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>/dev/null"
}
to "$SPAM"
}
exception {
if($LOGS)
{
log
"------------------------------------------------------------- Send to Anomy"
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>~/.maildrop.log | cat"
log
"------------------------------------------------------------- Anomy done."
}
exception {
xfilter "/usr/bin/sanitizer.pl
/etc/anomy-sanitizer.conf 2>>/dev/null"
}
to "$SPAM"
}
}
}
}
}
#####################################
#
# Running Anomy-sanitizer
# This only works if SANITIZE=1 above
#
#####################################
if($SANITIZE)
{
#####################################
#
# Some debugging lines and a place to save things when
# I am tweaking Anomy Sanitizer.
#
#####################################
if($CCSANITIZE)
{
if($LOGS)
{
log
"------------------------------------------------------------- Save unsanitized."
}
`test -d $UNSANITIZED`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Unsanitized $LMB`
cc "$UNSANITIZED"
}
exception {
# Only uncomment this if you mail program can handle it.
#DELTAG=1
cc "$UNSANITIZED"
}
}
# Set up the environment variable ANOMY to keep Anomy happy.
#
# Filter the message via stdin to Anomy, with the config
# file specified, logging output being appended to the
# Maildrop log file and then the output being piped to
# cat so cat's stdout sends it back to Maildrop. The use
# of "2>>" for appending stderr with the log material means
# we need the "| cat".
#
# If Anomy's conf file has:
#
# feat_log_inline = 0
# feat_log_stderr = 1
#
# Then a report of Anomy's progress in working on the message
# will be appended to the Maildrop log file. This seems to
# work fine, so presumably each "log" line for Maildrop
# means it opens and closes the log file.
if($LOGS)
{
log "-------------------------------------------------------------
Send to Anomy"
xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf
2>>~/.maildrop.log | cat"
log "-------------------------------------------------------------
Anomy done."
}
exception {
xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf 2>>/dev/null"
}
# Watch out for text added to body by Anomy Sanitizer
# when it *drops* a file, not just when it renames
# or in some other way defangs one. This is a part
# of the drop message I added.
# ":b" means look in the body, rather then the headers.
if ( /^*** Attached file dropped ***/:b)
{
if($LOGS)
{
log
"------------------------------------------------------------- VIRUS. "
}
# To make it not go to the Inbox, this "cc" into a "to"
# and comment out the next three lines.
#cc "Maildir/.Virus"
#DELTAG=1
xfilter "subjadd -----[VIRUS]----- "
`test -d $SANITIZED`
if( $RETURNCODE == 1)
{
`maildirmake++ -f Sanitized $LMB`
to "$SANITIZED"
}
exception {
to "$SANITIZED"
}
}
}
#####################################
#
# Adding missing headers for PGP/MIME
#
#####################################
BPM="-----BEGIN PGP MESSAGE-----"
EPM="-----END PGP MESSAGE-----"
BPS="-----BEGIN PGP SIGNATURE-----"
EPS="-----END PGP SIGNATURE-----"
if (!/^Content-Type: message/ && !/^Content-Type: multipart/ \
&& !/^Content-Type: application\/pgp/)
{
if (/^$BPM/:b && /^$EPM/:b)
{
xfilter "reformail -A 'Content-Type: application/pgp; format=text; \
x-action=encrypt'"
if ( $LOGS ==1)
{
log
"------------------------------------------------------------- Fixed pgp message."
}
}
if (/^$BPS/:b && /^$EPS/:b)
{
xfilter "reformail -A 'Content-Type: application/pgp; format=text; \
x-action=sign'"
if ( $LOGS ==1)
{
log
"------------------------------------------------------------- Fixed pgp signature."
}
}
}
###################################
#
# Correcting wrong signature dashes
#
###################################
if (/^--$/:b)
{
xfilter "sed -e 's/^--$/-- /'"
if ($LOGS)
{
log "------------------------------------------------------------- Sig
Dashes corrected."
}
}
####################################################################### Misc mailing
list stuff.
#if ( ( /.m9ndfukc/ ) \
# || ( /.www.god-emil.dk/ ) \
# )
#{
# log "------------------------------------------------------------- Antiorp etc. "
# cc "Maildir/.0-SPAM-etc.Antiorp-crap"
# DELTAG=1
# xfilter "subjadd [Antiorp]"
# to "$LMB"
#}
# This gets rid of messages from a pesky person or bot who writes gibberish to some
lists - before I search for the list
# messages themselves. The "to" command to Maildrop means this is the end of the
filtering process, so if the if()
# statement is true, then the rest of the tests are irrelevant.
#if ( /^Return-Path: <bugtraq-return/ )
#{
# log "------------------------------------------------------------- Linux-bugtraq "
# cc "Maildir/.Lists.Linux-bugtraq"
# DELTAG=1
# xfilter "subjadd [BugTraq]"
# to "$LMB"
#}
#if ( /^X-Loop: anomy-list/ )
#{
# log "-------------------------------------------------------------
Mail-Anomy-Sanitizer "
# cc "Maildir/.Lists.Mail-Anomy"
# DELTAG=1
# to "$LMB"
#}
#if ( /^Return-Path: <courier-users-admin/ )
#{
# log "-------------------------------------------------------------
Mail-Courier-users "
# cc "Maildir/.Lists.Mail-Courier-users"
# DELTAG=1
# to "Maildir"
#}
# EPIC
# <[EMAIL PROTECTED]> Censorware proj. http://www.spectacle.org/freespch/slaclist.html
# <[EMAIL PROTECTED]> Privacy Forum
#if ( ( /^Return-Path: <epic-news/ ) \
# || ( /^Return-Path: <[EMAIL PROTECTED]/ ) \
# || ( /^Return-Path: <[EMAIL PROTECTED]/ ) \
# )
#{
# log "-------------------------------------------------------------
Privacy-various-lists"
# cc "Maildir/.Lists.Privacy-various-lists"
# DELTAG=1
# to "$LMB"
#}
#if ( ( /[EMAIL PROTECTED]/)\ # Watch the headers for any mention of one of the
# || ( /[EMAIL PROTECTED]/)\ # generic email accounts which RFC 2142 says we
# || ( /[EMAIL PROTECTED]/)\ # should receive mail on, and which Postfix by
# || ( /[EMAIL PROTECTED]/)\ # default aliases to root.
# )
#{
# log "------------------------------------------------------------- Spam generic
address. "
# cc "Maildir/.-SPAM" # Make this "cc" for copy or "to" to not send it
to Inbox.
# DELTAG=1
# xfilter "subjadd ~~~[SPAM]"
# to "$LMB"
#}
######################################
# Look for messages addressed to an old account
# at an ISP, where the messages are automatically
# forwarded to here. This is almost certainly
# spam. I will label it in the Inbox in a
# distinctive way and toss it into its very
# own spam pit.
######################################
#if ( (/[EMAIL PROTECTED]/ ) \
# )
#{
# log "------------------------------------------------------------- [EMAIL
PROTECTED] probable spam "
# cc "Maildir/.0-SPAM-etc.00spam-ozemail"
# DELTAG=1
# xfilter "subjadd ~~~[SPAM-OzEm]"
# to "$LMB"
#}
######################################
# Look for messages from specific people which I don't want
# to subject to spam filtering, because, for instance,
# they have sent HTML emails or some other messages which
# have been falsely identified as spam in the past.
######################################
#if ( (/friend-a/ ) \
# || (/friend-b/ ) \
# || (/business-associate-1/ ) \
# || (/business-associate-2/ ) \
# )
#{
if($LOGS)
{
log "- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - No match."
}
###################################
# This section is functionally the same as the section above
# where I handle particular messages which I accept without
# spam or virus filtering.
#
# Copy to account on another machine, in case I accidentally delete
# something from my Inbox, or mistakenly move it somewhere and then
# not know were I put it.
# cc "! [EMAIL PROTECTED]"
# Also copy to a mailbox so I can see them easily.
# But I don't intend to keep this mailbox's contents
# for long.
# cc "Maildir/.0-Inbox-Old.Post-Filter-Inbox"
###################################
# Deliver to the Inbox.
to "$LMB"
