Re: removing existing SA headers

"Chad Leigh -- Shire.Net LLC" <[email protected]> Mon, 3 May 2010 16:23:13 -0600
Newsgroups gmane.mail.exim.spamassassin
Message-ID <[email protected]>
--===============1809685219==
Content-Type: multipart/alternative; boundary=Apple-Mail-161-412933437


--Apple-Mail-161-412933437
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


On May 2, 2010, at 3:51 PM, Marc MERLIN wrote:

> On Tue, Apr 27, 2010 at 10:01:38AM -0600, Chad Leigh -- Shire.Net LLC =
wrote:
>>=20
>> I know this was discussed before on the exim list (by me in fact  =
many many moons ago), but I wanted to get clarification on what is =
supposed to happen.
>=20
> So first, that wasn't your question but I suppose it's not surprise to
> anyone here that SA-Exim is in maintenance mode at best.

Sure.

> I actually only recently noticed that the Debian SA-Exim maintainer =
fixed
> some compilation problems between SA-Exim and newer versions of Exim =
(good)
> without even reporting them back to me and giving me a chance to fix =
them
> upstream (bad).

That is not very nice.

> That said, SA-Exim just works for me still, most people have gone with
> exiscan since it's built in into Exim, and while exiscan isn't as =
powerful
> as SA-Exim in what it does spam and spammer wise, it's good enough for =
most,
> so they don't bother looking for other options like SA-Exim (can't =
blame
> them I suppose).

I have been using SA-exim since forever -- why "fix" something that =
isn't broke ;-)

I have also been using the SA-exim greylisting as well snice like =
forever

>=20
> Anyway, all this to say that I had to go back and read my old code =
since I
> just don't even quite remember it :)

You're welcome ;-)

>=20
>> A friends server that I help run is also running mailman. =20
>>=20
>> A member of one of his mail lists posts and SA thinks it is a spam =
when it first is accepted by exim and then passed to mailman, which =
resends it.  This resend is now originating from the server and so we do =
not rerun SA as we have a rule that all email that originates on the =
server do not run SA.   However, the old SA headers are still being =
picked up by rules.  I thought that sa-exim would remove the old headers
>=20
> Yep, the code says so.
>=20
> But my guess is that mailman resends your Email outside without =
filtering it
> through SA-Exim since it's local Email and therefore not spam.
> If you want to remove those SA-Exim headers, they'd have to be removed
> by Exim's remote_smtp transport before you send your mailman messages =
back out.

I will look at the stuff below and try it out or something similar.

SA-exim does seem to get run again on the resend though, since the =
headers

> x-sa-exim-connect-ip: 209.41.94.251
> x-sa-exim-mail-from: [email protected]
> x-sa-exim-scanned: No (on mail.object.com); SAEximRunCond expanded to =
false

are there from the second time.  It does not run the scanner, but =
sa-exim glue is run and it inserts the headers!  Am I understanding it =
wrong?

>=20
> remote_smtp:
>  debug_print =3D "T: remote_smtp for $local_part@$domain"
>  driver =3D smtp
>  # This deals with misocnfigurations like this one that redirect mail =
to us
>  # (i.e. 'mail' is unqualified and resolves back to us)
>  # worldclasssportfishing.net      MX      30 mail
>  dns_qualify_single =3D false
>  # This fixes a problem if TLS is enabled where a misunderstanding on =
the RFC
>  # can cause comunication failure between two hosts
>  hosts_nopass_tls =3D *
>  hosts_avoid_tls =3D +hosts_avoid_tls
>  hosts_try_auth =3D +hosts_try_auth
>  # This is generally set on messages originating from local users and =
it tells
>  # SA-Exim not to scan the message or that the message was scanned.
>  # Let's remove these headers if the message is sent remotely
>  headers_remove =3D =
"X-SA-Do-Not-Run:X-SA-Exim-Scanned:X-SA-Exim-Rcpt-From:X-SA-Exim-Rcpt-To:X=
-SA-Exim-Ver
> sion"
>=20
>=20
> Marc
> --=20
> "A mouse is a device used to point at the xterm you want to type in" - =
A.S.R.
> Microsoft is to operating systems & security ....
>                                      .... what McDonalds is to gourmet =
cooking
> Home page: http://marc.merlins.org/ =20


--Apple-Mail-161-412933437
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space; =
"><br><div><div>On May 2, 2010, at 3:51 PM, Marc MERLIN wrote:</div><br =
class=3D"Apple-interchange-newline"><blockquote type=3D"cite"><div>On =
Tue, Apr 27, 2010 at 10:01:38AM -0600, Chad Leigh -- <a =
href=3D"http://Shire.Net">Shire.Net</a> LLC wrote:<br><blockquote =
type=3D"cite"><br></blockquote><blockquote type=3D"cite">I know this was =
discussed before on the exim list (by me in fact &nbsp;many many moons =
ago), but I wanted to get clarification on what is supposed to =
happen.<br></blockquote><br>So first, that wasn't your question but I =
suppose it's not surprise to<br>anyone here that SA-Exim is in =
maintenance mode at =
best.<br></div></blockquote><div><br></div>Sure.</div><div><br><blockquote=
 type=3D"cite"><div>I actually only recently noticed that the Debian =
SA-Exim maintainer fixed<br>some compilation problems between SA-Exim =
and newer versions of Exim (good)<br>without even reporting them back to =
me and giving me a chance to fix them<br>upstream =
(bad).<br></div></blockquote><div><br></div>That is not very =
nice.</div><div><br><blockquote type=3D"cite"><div>That said, SA-Exim =
just works for me still, most people have gone with<br>exiscan since =
it's built in into Exim, and while exiscan isn't as powerful<br>as =
SA-Exim in what it does spam and spammer wise, it's good enough for =
most,<br>so they don't bother looking for other options like SA-Exim =
(can't blame<br>them I =
suppose).<br></div></blockquote><div><br></div><div>I have been using =
SA-exim since forever -- why "fix" something that isn't broke =
;-)</div><div><br></div>I have also been using the SA-exim greylisting =
as well snice like forever</div><div><br><blockquote =
type=3D"cite"><div><br>Anyway, all this to say that I had to go back and =
read my old code since I<br>just don't even quite remember it =
:)<br></div></blockquote><div><br></div>You're welcome =
;-)</div><div><br><blockquote type=3D"cite"><div><br><blockquote =
type=3D"cite">A friends server that I help run is also running mailman. =
&nbsp;<br></blockquote><blockquote =
type=3D"cite"><br></blockquote><blockquote type=3D"cite">A member of one =
of his mail lists posts and SA thinks it is a spam when it first is =
accepted by exim and then passed to mailman, which resends it. =
&nbsp;This resend is now originating from the server and so we do not =
rerun SA as we have a rule that all email that originates on the server =
do not run SA. &nbsp;&nbsp;However, the old SA headers are still being =
picked up by rules. &nbsp;I thought that sa-exim would remove the old =
headers<br></blockquote><br>Yep, the code says so.<br><br>But my guess =
is that mailman resends your Email outside without filtering =
it<br>through SA-Exim since it's local Email and therefore not =
spam.<br>If you want to remove those SA-Exim headers, they'd have to be =
removed<br>by Exim's remote_smtp transport before you send your mailman =
messages back out.<br></div></blockquote><div><br></div><div>I will look =
at the stuff below and try it out or something =
similar.</div><div><br></div><div>SA-exim does seem to get run again on =
the resend though, since the =
headers</div><div><br></div><div><blockquote type=3D"cite"><div =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><span style=3D"font-family: Helvetica; font-size: =
medium; color: rgb(0, 0, 0); =
"><b>x-sa-exim-connect-ip:&nbsp;</b></span><span style=3D"font-family: =
Helvetica; font-size: medium; ">209.41.94.251<br></span></div><div =
style=3D"margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; "><span style=3D"font-family: Helvetica; font-size: =
medium; color: rgb(0, 0, 0); =
"><b>x-sa-exim-mail-from:&nbsp;</b></span><span style=3D"font-family: =
Helvetica; font-size: medium; "><a =
href=3D"mailto:[email protected]">[email protected]</a=
><br></span></div><div style=3D"margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; "><span style=3D"font-family: =
Helvetica; font-size: medium; color: rgb(0, 0, 0); =
"><b>x-sa-exim-scanned:&nbsp;</b></span><span style=3D"font-family: =
Helvetica; font-size: medium; ">No (on&nbsp;<a =
href=3D"http://mail.object.com/">mail.object.com</a>); SAEximRunCond =
expanded to false</span></div></blockquote><br></div><div>are there from =
the second time. &nbsp;It does not run the scanner, but sa-exim glue is =
run and it inserts the headers! &nbsp;Am I understanding it =
wrong?</div><br><blockquote type=3D"cite"><div><br>remote_smtp:<br> =
&nbsp;debug_print =3D "T: remote_smtp for $local_part@$domain"<br> =
&nbsp;driver =3D smtp<br> &nbsp;# This deals with misocnfigurations like =
this one that redirect mail to us<br> &nbsp;# (i.e. 'mail' is =
unqualified and resolves back to us)<br> &nbsp;# <a =
href=3D"http://worldclasssportfishing.net">worldclasssportfishing.net</a> =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MX &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;30 =
mail<br> &nbsp;dns_qualify_single =3D false<br> &nbsp;# This fixes a =
problem if TLS is enabled where a misunderstanding on the RFC<br> =
&nbsp;# can cause comunication failure between two hosts<br> =
&nbsp;hosts_nopass_tls =3D *<br> &nbsp;hosts_avoid_tls =3D =
+hosts_avoid_tls<br> &nbsp;hosts_try_auth =3D +hosts_try_auth<br> =
&nbsp;# This is generally set on messages originating from local users =
and it tells<br> &nbsp;# SA-Exim not to scan the message or that the =
message was scanned.<br> &nbsp;# Let's remove these headers if the =
message is sent remotely<br> &nbsp;headers_remove =3D =
"X-SA-Do-Not-Run:X-SA-Exim-Scanned:X-SA-Exim-Rcpt-From:X-SA-Exim-Rcpt-To:X=
-SA-Exim-Ver<br>sion"<br><br><br>Marc<br>-- <br>"A mouse is a device =
used to point at the xterm you want to type in" - A.S.R.<br>Microsoft is =
to operating systems &amp; security ....<br> =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
.... what McDonalds is to gourmet cooking<br>Home page: <a =
href=3D"http://marc.merlins.org/">http://marc.merlins.org/</a> =
&nbsp;<br></div></blockquote></div><br></body></html>=

--Apple-Mail-161-412933437--


--===============1809685219==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
SA-Exim mailing list
[email protected]
http://lists.merlins.org/lists/listinfo/sa-exim

--===============1809685219==--