Re: [exim] help with spamassassin size limit check

Top Page
Delete this message
Reply to this message
Author: Brian
Date:  
To: Jerry Bell
CC: exim-users
Subject: Re: [exim] help with spamassassin size limit check
Jerry Bell wrote:

> I'm trying to limit the size of emails that Exim passes to SA to a
> reasonable size.  I've looked through the mail archives and found
> basically two proposed solutions:
> Changing the spam= line to:
> spam=${if <{$message_size}{50k}{'nobody:true'}{0}}
> and
> condition      = ${if <{$message_size}{50k}{1}{0}}

>
> But, they don't work.  I'm running 4.44 on FreeBSD 5.3 with the latest
> exiscan (4.44-28)
> I change my ACL's as follows:
> # Drop messages over database defined threshold
> deny   message = This message scored $spam_score spam points.
>        condition      = ${if <{$message_size}{50k}{1}{0}}
>        condition = ${if >= {$spam_score_int}{${lookup mysql{select
> spam_reject_threshold from domain where domain_name = '${acl_m
> 0}'}{$value}fail}}{1}{0}}
>        spam=${if <{$message_size}{50k}{'nobody:true'}{0}}
>        sender_domains = !+whitelist_from_domains
>        logwrite = Message rejected as spam. $recipients $spam_score_int

>
> # Flag messages over database defined threshold
> warn  message = X-New-Subject: *SPAM* $h_Subject
>       condition      = ${if <{$message_size}{50k}{1}{0}}
>       condition = ${if >= {$spam_score_int}{${lookup mysql{select
> spam_flag_threshold from domain where domain_name = '${acl_m0}'
> }{$value}fail}}{1}{0}}
>       sender_domains = !+whitelist_from_domains
>       spam=${if <{$message_size}{50k}{'nobody:true'}{0}}
>       logwrite = Message tagged as spam. $recipients $spam_score_int

>
> After making this change and restarting exim, I send a 1MB file through,
> and SA is sent to grind on it for a minute or two.
>
> Any help would be greatly appreciated.
>
> Jerry
> http://www.syslog.org
>
>

For what it's worth..

Spam assassin is the last thing we do. So by the time it hits the
scanner its done all the other tests.. and so..

acl_check_data:

...

warn message    = :spf_received:$spf_received


accept
  condition      = ${if >={$message_size}{200k}{1}{0}}


drop message    = ** Attention **\n \
        This message has been rejected!\n \
        This message has a SPAM score of: $spam_score points.\n \
        Please call xxx.yyy.zzz if you feel this message is in error.\n \
        [$sender_address from $sender_host_address at $tod_bsdinbox]
  spam           = spamd
  condition      = ${if >{$spam_score_int}{100}{1}{0}}
  log_message    = [SA Reject] $spam_score


warn message    = X-New-Subject: [SPAM] $h_subject:
  spam           = spamd
  log_message    = [SPAM] $spam_score


warn message    = X-Spam-Info: Spam detection software, provided by 
{Company name here}
warn message    = X-Spam-Info: Has scanned this message. If this is 
believed to be spam
warn message    = X-Spam-Info: A tag has been added to the subject for 
you own filtering purposes.
warn message    = X-Spam-Info: Please call us at: xxx.yyy.zzz if you 
have any questions.


warn message    = X-Spam-Score: $spam_score ($spam_bar)


warn message    = X-Spam-Report: $spam_report


accept

# End

This part is at the end, after the demime for malware and demime_error
level things we put this.

Let me know if this helps.

- Brian