Re: [exim] acl or condition to protect spam-reclassification…

Top Page
Delete this message
Reply to this message
Author: Odhiambo G. Washington
Date:  
To: exim-users
CC: spida
Subject: Re: [exim] acl or condition to protect spam-reclassification suffixes
* Timo Boettcher <spida@???> [20050208 04:07]: wrote:
> Hi,
>
> I am trying to setup exim with dspam.
> Since dspam can relearn misscalssified spam/ham if it is piped to a
> command, I want to offer that possibility via per-user suffixes like
> user-spam@foo user-ham@foo...
> My problem: how can I keep external users (spammers) from sending
> their spam first to my user-nospam@foo, and then to the user@foo
> himself?


Hi Timo,


I do use dspam, so I will answer you.

With dspam, when a mail is sent to user-spam or user-nospam,
the command that is used to run that mail through dspam is called with
extra arguments, one of which is --user:

user-spam will cause dspam to be run like this:
/path/to/dspam --class=spam --source=error --user ${lc:$local_part}

user-ham will cause dspam to be run with:
/path/to/dspam --class=innocent --source=error --user ${lc:$local_part}


The above two will NOT do anything to the user's dictionary, since dspam
will not have seen those e-mails previously! In this case you can rest
happy because dspam will log an error and exit. You can prove this by
sending an e-mail to $user-spam@??? from your Gmail account
and look at the dspam's system log. Run it with debug for more details.

However, there are routers that you can use for "training" dspam as
shown in the following HOWTO:

http://dspamwiki.woozle.org/giki.cgi?p=DspamWithEximAndSpamAssassin

The routers named dspam_clean_router and dspam_spam_corpus_router will
need that type of protection you are worried about.


This is easy! Use a condition on those two routers. That condition
should determine two situations:

1. that the mail originated from a host within your +relay_from_hosts OR
2. the sender was authenticated (if the mail is not from a host in (1))

If either of the two situations is not met, then the routers should
_NOT_ run.

Easy, yes?


> I have tried some conditions and acls, but I am not sure how to do it.


I believe you very much on the right track: Let me see if I can help
with the idea:


condition = ${if or { \
                    {eq{$authenticated_id}{$local_part@$domain}} \
                    {match {$sender_host_address}{+relay_from_hosts}} \
                    } \
                    {1}{0}}




I am not sure the {match {$sender_host_address}{+relay_from_hosts}} is
correct according to Exim, but yes, that is homework for you. Depending
on your Exim version, there is definately an expansion for that ;)

You do get the idea though, no?


> I would like to put the suffixes in variables, but even that didn't
> work the way i wanted, so I hardcoded them.


No need top hard code!


> Is there anybody who has done something like this?


I haven't done it, but I will soon, but actually the example above,
if you do get the correct expansion, should be okay. I am 100% sure.


> How can I debug such a thing (not sure if this would help, I am
> pretty much a newbie with exim and need some basic advice first)?


You can use "exim -be" for testing expansions.


> localpartlist dspam_suffix_spam = -spam
> localpartlist dspam_suffix_ham = -ham:-nospam:-notspam


This is an overkill, and the wrong way to approach it. Please
refer to the wiki above, and get the correct condition for the
two routers I have mentioned.

Once you get this working, do me a favor: Tell the GMX.de mail managers
to style up!



        cheers
       - wash 
+----------------------------------+-----------------------------------------+
Odhiambo Washington                    . WANANCHI ONLINE LTD (Nairobi, KE)  |
wash _at_ wananchi _ dot _ com        . 1ere Etage, Loita Hse, Loita St.,  |
GSM: (+254) 722 743 223            . # 10286, 00100 NAIROBI             |
GSM: (+254) 733 744 121            . (+254) 020 313 985 - 9             |
+---------------------------------+------------------------------------------+
"Oh My God! They killed init! You Bastards!"  
                         --from a /. post