Re: [Exim] Spam Filtering Question

Top Page
Delete this message
Reply to this message
Author: Tor Slettnes
Date:  
To: Adam Bown
CC: exim-users
Subject: Re: [Exim] Spam Filtering Question
--

On Mar 8, 2004, at 11:10, Adam Bown wrote:
> Thanks for such a thorough answer. I now have both exiscan and SA-Exim
> compiled into my version of exim. Both are working well because I'm
> bouncing viruses with Exiscan and ClamAV and scoring (but not bouncing
> yet)
> spam with SA-Exim.
>
> However, what I really want to do is get the spam delivered to a
> mailbox on
> a per-user basis. That is, spam sent to john@??? goes to johns
> spam
> folder and spam sent to bob@??? goes to bob's spam folder.
> That way
> both users can take control of their own spam management as they see
> fit
> without having to install client-side filters.
>
> Is this possible or am I dreaming?


Certainly it is possible -- that's what I do. Based on the header
"X-Spam-Report:" generated by the Exiscan-ACL configuration in my
previous message, you can sort mail into e.g. a user's main inbox or
their junk folder.

I guess that you are using SA-Exim due to its "teergrubing" facility.
The problem is, it gets a bit difficult to keep a copy of incoming mail
for delivery if you reject it (temp, perm, teergrube). When you "keep"
a copy of rejected mail in the SA-Exim realm, it simply saves a copy in
its own Maildir folder, which is probably not what you want if you want
to filter it into a separate folder for each user. In short, I would
simply use Exiscan-ACL - things will get a bit easier that way.

Also, "Folders" as such is not really a function of the Mail Transport
Agent (Exim). It is more a concept that is used by the mail client
software, whether via the IMAP protocol or directly via the local file
system (e.g. command-line mail readers).

Note that I did not say POP3, because the POP3 protocol does not have a
concept of folders either. If you want to split mail into folders, you
really want to use the IMAP protocol to access the mail.

For instance, if you use the Cyrus IMAP suite, you probably deliver
your mail through an LMTP socket, or through the command "cyrdeliver".
In this case, you will probably also want to use the Cyrus "Sieve"
facility (RFC3028, see: http://www.cyrusoft.com/sieve/). Here is a
snippet from my own "sieve" filter (you'd want to set up something
similar for all your users, and/or give them (local or remote) access
to the "sieveshell" command for editing their own filter).

> require "fileinto";
>
> if header :matches "X-Spam-Report" "Yes*"
>     { fileinto "INBOX.Junk"; }

>
> elsif address :localpart :is [ "To", "Cc" ] [ "postmaster", "abuse",
> "root" ]
>     { fileinto "INBOX.Admin"; }

>
> elsif address :localpart :is [ "To", "Cc" ] "noc"
>     { fileinto "INBOX.InterNic"; }

>
> elsif address :domain :contains "From" "eff.org"
>     { fileinto "INBOX.EFF"; }

>
> elsif address :domain :is "Sender" "lists.merlins.org"
>     { fileinto "INBOX.SA-Exim"; }

>
> elsif address :localpart :is "Sender" "exim-users-admin"
>     { fileinto "INBOX.Exim-Users"; }

>
> elsif address :localpart :is "Sender" "exim-announce-admin"
>     { fileinto "INBOX.Exim-Announce"; }

>
> elsif address :is "Resent-From" "debian-private@???"
>     { fileinto "INBOX.Debian-private"; }

>
> elsif address :is "Resent-From" "debian-www@???"
>     { fileinto "INBOX.Debian-www"; }

>
> elsif address :is [ "To", "Cc" ] "tor@???"
>     { fileinto "INBOX.Debian"; }

>
> elsif header :contains "Received" "debian.org"
>     { fileinto "INBOX.Debian-misc"; }

>
> elsif address :is :localpart [ "To", "Cc" ] "tor"
>     { keep; }

>
> else
>     { fileinto "INBOX.Bulk"; }



Conversely, if you use the Courier IMAP, are probably putting mail into
the recipient's "Maildir" box in their home directory. In this case,
you can either create an Exim filter (see 'filter.txt.gz' in the Exim
distribution), an Exim Sieve (RFC3028) filter, a Procmail recipe, or
similar filters in the user's home directory. In Exim's default
configuration, it will read either ".forward" or ".procmailrc" (if
Procmail is installed) in a user's home directory before delivering
mail. If the ".forward" file contains either "# Exim filter" or "#
Sieve filter" on the first line, it is treated accordingly.

Perhaps you can even setup an Exim system filter to perform this
operation for _all_ users.

If you use the plain-old "uw-imap" daemon, then your inbox is your BSD
mailspool file (e.g. /var/mail/$user), and other folders are usually
stored in a "Mail" or "mail" directory inside your home directory.
Again, you want to create a filter (Exim, Sieve, Procmail...) to
perform this operation as mail is being delivered.

Good luck, let me know if you need help to clarify any of these
concepts (or anything else).

-tor


--
[ smime.p7s of type application/pkcs7-signature deleted ]
--