Re: Reclassify --error "OK" with "properly" classified mail?
"L. Jankok" <[email protected]> Fri, 18 Nov 2016 22:59:37 +0100
| Newsgroups | gmane.mail.spam.dspam.user |
|---|---|
| Message-ID | <[email protected]> |
> This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1939108679323971102== Content-type: multipart/alternative; boundary="B_3562354785_1453423140" > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3562354785_1453423140 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: 7bit Hi, It really boils down how you have implemented dspam with postfix. You can create two transports, one for learning and one for inoculation. Next all mails to heavily spammed e-mail address goes directly to inoculate. Why should you first go to learn and then go to inoculate if your assumption is that the mail is spam anyways? Regards, LJ On 18/11/2016, 22:14, "Jeff Kletsky" <[email protected]> wrote: Over the years I've ended up with some email addresses that are heavily spammed and no longer in use. I'd like to take advantage of them as a honeypot for inoculation, with the knowledge that they only receive spam. I run Postfix and use dspam as a post-queue filter, as described at http://www.postfix.org/FILTER_README.html#advanced_filter As a result, all mail gets classified before I know the final recipient, as local aliases haven't been evaluated yet. I'd like to "deliver" mail for these destinations by routing all of it through something like | dspam --client --user <user> --source=error --class=spam without having to first determine if it was improperly classified as non-spam. Reading DSPAM(1) reveals You should use error only when DSPAM has made an error in clas- sifying the message, and should present the modified version of the message with the DSPAM signature when doing so. Does this mean that if the message was originally classified as spam that the token and message counts are "blindly" incremented each time it is called, or does dspam check to see the classification of the message ID before incrementing the counts? As easy as it would be to grep for 'X-DSPAM-Result: Innocent', it starts getting messy since I also either need the full message or the signature (another grep pass) to pass to dspam. If I can't just feed the message into the reclassify dspam call, are there any "elegant" approaches to this? Thanks! Jeff ------------------------------------------------------------------------------ _______________________________________________ Dspam-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/dspam-user --B_3562354785_1453423140 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:schema= s-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/office/20= 04/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta name=3DTitle c= ontent=3D""><meta name=3DKeywords content=3D""><meta http-equiv=3DContent-Type conte= nt=3D"text/html; charset=3Dutf-8"><meta name=3DGenerator content=3D"Microsoft Word 1= 5 (filtered medium)"><style><!-- /* Font Definitions */ @font-face {font-family:Arial; panose-1:2 11 6 4 2 2 2 2 2 4;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} p.MsoIndex1, li.MsoIndex1, div.MsoIndex1 {mso-style-priority:99; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:12.0pt; margin-bottom:.0001pt; text-indent:-12.0pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p {mso-style-priority:99; mso-margin-top-alt:auto; margin-right:0cm; mso-margin-bottom-alt:auto; margin-left:0cm; font-size:12.0pt; font-family:"Times New Roman";} p.Table-list, li.Table-list, div.Table-list {mso-style-name:"Table - list"; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:10.0pt; margin-bottom:.0001pt; text-indent:-10.0pt; font-size:10.0pt; font-family:Arial;} span.EmailStyle20 {mso-style-type:personal-reply; font-family:Calibri; color:windowtext;} span.msoIns {mso-style-type:export-only; mso-style-name:""; text-decoration:underline; color:teal;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:595.0pt 842.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} --></style></head><body bgcolor=3Dwhite lang=3DEN-GB link=3Dblue vlink=3Dpurple><di= v class=3DWordSection1><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-f= amily:Calibri;mso-fareast-language:EN-US'>Hi,<o:p></o:p></span></p><p class=3D= MsoNormal><span style=3D'font-size:11.0pt;font-family:Calibri;mso-fareast-lang= uage:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span style=3D'font= -size:11.0pt;font-family:Calibri;mso-fareast-language:EN-US'>It really boils= down how you have implemented dspam with postfix.<o:p></o:p></span></p><p c= lass=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:Calibri;mso-fareast= -language:EN-US'>You can create two transports, one for learning and one for= inoculation.<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size= :11.0pt;font-family:Calibri;mso-fareast-language:EN-US'>Next all mails to he= avily spammed e-mail address goes directly to inoculate.<o:p></o:p></span></= p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:Calibri;mso-f= areast-language:EN-US'>Why should you first go to learn and then go to inocu= late if your assumption is that the mail is spam anyways?<o:p></o:p></span><= /p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:Calibri;mso-= fareast-language:EN-US'><o:p> </o:p></span></p><p class=3DMsoNormal><span= style=3D'font-size:11.0pt;font-family:Calibri;mso-fareast-language:EN-US'>Reg= ards,<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D'font-size:11.0pt;= font-family:Calibri;mso-fareast-language:EN-US'><o:p> </o:p></span></p>= <p class=3DMsoNormal><span style=3D'font-size:11.0pt;font-family:Calibri;mso-far= east-language:EN-US'>LJ<o:p></o:p></span></p><p class=3DMsoNormal><span style=3D= 'font-size:11.0pt;font-family:Calibri;mso-fareast-language:EN-US'><o:p> = ;</o:p></span></p><div><div><p class=3DMsoNormal style=3D'margin-left:36.0pt'>On= 18/11/2016, 22:14, "Jeff Kletsky" <<a href=3D"mailto:dspam-lists= @allycomm.com">[email protected]</a>> wrote:<o:p></o:p></p></div><= /div><div><p class=3DMsoNormal style=3D'margin-left:36.0pt'><o:p> </o:p></p= ></div><p style=3D'margin-left:36.0pt'>Over the years I've ended up with some = email addresses that are heavily spammed and no longer in use.<o:p></o:p></p= ><p style=3D'margin-left:36.0pt'>I'd like to take advantage of them as a honey= pot for inoculation, with the knowledge that they only receive spam.<o:p></o= :p></p><p style=3D'margin-left:36.0pt'>I run Postfix and use dspam as a post-q= ueue filter, as described at <a href=3D"http://www.postfix.org/FILTER_README.h= tml#advanced_filter">http://www.postfix.org/FILTER_README.html#advanced_filt= er</a><o:p></o:p></p><p style=3D'margin-left:36.0pt'>As a result, all mail get= s classified<i> before </i>I know the final recipient, as local aliases have= n't been evaluated yet.<o:p></o:p></p><p style=3D'margin-left:36.0pt'>I'd like= to "deliver" mail for these destinations by routing all of it thr= ough something like<o:p></o:p></p><p style=3D'margin-left:36.0pt'> = | dspam --client --user <user> --source= =3Derror --class=3Dspam<o:p></o:p></p><p style=3D'margin-left:36.0pt'>without havi= ng to first determine if it was improperly classified as non-spam.<o:p></o:p= ></p><p style=3D'margin-left:36.0pt'>Reading DSPAM(1) reveals<o:p></o:p></p><p= style=3D'margin-left:36.0pt'> You should use error only whe= n DSPAM has made an error in clas-<br> sifying = the message, and should present the modified version of<br> &nbs= p; the message with the DSPAM signature when doing so.<o:p></o:p></p><p styl= e=3D'margin-left:36.0pt'>Does this mean that if the message was originally cla= ssified as spam that the token and message counts<br>are "blindly"= incremented each time it is called, <br>or does dspam check to see the clas= sification of the message ID before incrementing the counts?<o:p></o:p></p><= p style=3D'margin-left:36.0pt'>As easy as it would be to grep for 'X-DSPAM-Res= ult: Innocent', it starts getting messy <br>since I also either need the ful= l message or the signature (another grep pass) to pass to dspam.<o:p></o:p><= /p><p style=3D'margin-left:36.0pt'><o:p> </o:p></p><p style=3D'margin-left:= 36.0pt'>If I can't just feed the message into the reclassify dspam call, are= there any "elegant" approaches to this?<o:p></o:p></p><p style=3D'm= argin-left:36.0pt'><o:p> </o:p></p><p style=3D'margin-left:36.0pt'>Thanks= !<o:p></o:p></p><p style=3D'margin-left:36.0pt'><o:p> </o:p></p><p style=3D= 'margin-left:36.0pt'>Jeff<o:p></o:p></p><p style=3D'margin-left:36.0pt'><o:p>&= nbsp;</o:p></p><p class=3DMsoNormal style=3D'margin-left:36.0pt'>---------------= --------------------------------------------------------------- ____________= ___________________________________ Dspam-user mailing list Dspam-user@lists= .sourceforge.net https://lists.sourceforge.net/lists/listinfo/dspam-user <o:= p></o:p></p></div></body></html> --B_3562354785_1453423140-- --===============1939108679323971102== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ --===============1939108679323971102== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Dspam-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/dspam-user --===============1939108679323971102==--