On Thu, Jun 13, 2002 at 10:39:28AM +0200, Tor Houghton wrote:
> i've looked at
> http://www.colondot.net/mbm/mailfilter.shtml#score
> which contains a "scoring" method for validating email, and it looks
> interesting.
You probably want to use spamassassin. (hang on, what am I saying here? :-)
I wrote that stuff a good two years ago, and although it's still there
it's more there as an example of what can be done with Exim's
filter language. As I recall, Phil Hazel described it as ``disgusting'',
and probably an abuse of what the filter file was intended for :-), but
it shows how you can twist languages around.
> one thing i am wondering about, is his use of hard coded key phrases (such
> as "not spam") within the filter rule; e.g.
> if (${lc:$message_body:} matches "spam free")
> then
> add 80 to n9
> endif
> what i'd like to do is have a file called "/etc/exim/spam_score_80" or
> something similar where phrases such as these are stored. then, using
> (lsearch?) i would like to do a match on whatever is in this file.
This is actually quite difficult, and could probably be done in exim4,
where you have a ${readfile } operator, which allows you to read in,
say, lines from a file, but certainly can't be done in Exim 3. Believe
me, that if I'd found a way to do that, I would have done, because it
would have saved me lots of hassle. In fact, you might also want to note
that when I was running that filter, most of the spam came into the
blacklisted addresses, and got auto-blacklisted, and very little was
actually flagged by the scoring mechanism.
SpamAssassin (there it is again) (
http://www.spamassassin.org/) has a
score based filtering system, although I personally disagree with some
of the names and regexps for their default ruleset. I believe that
Derrick Hudson (who posts as "dman" to this list) has done some work
with writing up how to nicely integrate spamassassin and exim in many
interesting ways.
> is this feasible, and if so -- how should i go about it?
> the system is running exim 3.34.
Unlikely under exim 3. The filter language is by no means turing complete,
and not intended to be. My abuse of the log directive to write lsearch
databases is not particularly pleasant, but I was quite proud of it at the
time. :-)
You might be able to twist some of the string expansion directives to do
what you want under exim4, but that scoring system had some severe
limitations:
+ message_body_size
+ couldn't score multiple times for the same thing
+ no particular ability to set scoring rules outside the filter file
(or that I could find, anyway)
Hope this helps
MBM
--
Matthew Byng-Maddick <mbm@???> http://colondot.net/
