Re: Reclassify --error "OK" with "properly" classified mail?
Jeff Kletsky <[email protected]> Fri, 18 Nov 2016 15:48:22 -0800
| Newsgroups | gmane.mail.spam.dspam.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============1051135029776176313== Content-Type: multipart/alternative; boundary="------------8D748A90A719E6E20914B4E1" This is a multi-part message in MIME format. --------------8D748A90A719E6E20914B4E1 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit For anyone reading this that knows, I'm still curious about the effect of multiple "--source=error" invocations of dspam for the same message/signature. Thanks LJ! The reasoning behind the "fix-up" approach is that I process the mail with dspam _before_ local address rewriting is done, so that each (virtual) user gets its own set of tokens in dspam. I was hoping that I'd only have to maintain the virtual alias table for the known-spam users and not have to replicate that elsewhere, such as an access(5) or transport(5) table. You've got me thinking though, as I do use another SMTP instance as a public-facing relay. Since it doesn't maintain its own aliases for the served domains, I should be able to do something like setting up a virtual alias for the multiple known-spam addresses to a single "[email protected]" address and then a simple transport(5) to redirect just the "[email protected]" address to another instance of smtpd running on a different port the same server as dspam. That smptd would "simply" have it delivered to dspam for innoculation. Thanks for getting me thinking in another direction! Jeff On 11/18/16 1:59 PM, L. Jankok wrote: > > Hi, > > It really boils down how you have implemented dspam with postfix. > > You can create two transports, one for learning and one for inoculation. > > Next all mails to heavily spammed e-mail address goes directly to > inoculate. > > Why should you first go to learn and then go to inoculate if your > assumption is that the mail is spam anyways? > > Regards, > > LJ > > On 18/11/2016, 22:14, "Jeff Kletsky" <[email protected] > <mailto:[email protected]>> wrote: > > Over the years I've ended up with some email addresses that are > heavily spammed and no longer in use. > > I'd like to take advantage of them as a honeypot for inoculation, with > the knowledge that they only receive spam. > > I run Postfix and use dspam as a post-queue filter, as described at > http://www.postfix.org/FILTER_README.html#advanced_filter > > As a result, all mail gets classified/before /I know the final > recipient, as local aliases haven't been evaluated yet. > > I'd like to "deliver" mail for these destinations by routing all of it > through something like > > | dspam --client --user <user> --source=error --class=spam > > without having to first determine if it was improperly classified as > non-spam. > > Reading DSPAM(1) reveals > > You should use error only when DSPAM has made an error in clas- > sifying the message, and should present the modified version of > the message with the DSPAM signature when doing so. > > Does this mean that if the message was originally classified as spam > that the token and message counts > are "blindly" incremented each time it is called, > or does dspam check to see the classification of the message ID before > incrementing the counts? > > As easy as it would be to grep for 'X-DSPAM-Result: Innocent', it > starts getting messy > since I also either need the full message or the signature (another > grep pass) to pass to dspam. > > If I can't just feed the message into the reclassify dspam call, are > there any "elegant" approaches to this? > > Thanks! > > Jeff > > ------------------------------------------------------------------------------ > _______________________________________________ Dspam-user mailing > list [email protected] > https://lists.sourceforge.net/lists/listinfo/dspam-user > > > > ------------------------------------------------------------------------------ > > > _______________________________________________ > Dspam-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/dspam-user --------------8D748A90A719E6E20914B4E1 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable <html> <head> <meta content=3D"text/html; charset=3Dwindows-1252" http-equiv=3D"Content-Type"> </head> <body bgcolor=3D"#FFFFFF" text=3D"#000000"> <p>For anyone reading this that knows, I'm still curious about the effect of multiple "--source=3Derror" invocations of dspam for the same message/signature.</p> <p>Thanks LJ!<br> </p> <p>The reasoning behind the "fix-up" approach is that I process the mail with dspam _before_ local address rewriting is done, <br> so that each (virtual) user gets its own set of tokens in dspam. I was hoping that I'd only have to maintain the virtual alias table for the known-spam users and not have to replicate that elsewhere, such as an access(5) or transport(5) table.<br> </p> <p>You've got me thinking though, as I do use another SMTP instance as a public-facing relay. Since it doesn't maintain its own aliases for the served domains, I should be able to do something like setting up a virtual alias for the multiple known-spam addresses to a single <a class=3D"moz-txt-link-rfc2396E" href=3D"ma= ilto:[email protected]">"[email protected]"</= a> address and then a simple transport(5) to redirect just the <a class=3D"moz-txt-link-rfc2396E" href=3D"mailto:known-spam@known-= spam.my.domain">"[email protected]"</a> address to another = instance of smtpd running on a different port the same server as dspam. That smptd would "simply" have it delivered to dspam for innoculation.</= p> <p>Thanks for getting me thinking in another direction!</p> <p>Jeff</p> <p><br> </p> <p><br> </p> <p><br> </p> <div class=3D"moz-cite-prefix">On 11/18/16 1:59 PM, L. Jankok wrote:<= br> </div> <blockquote cite=3D"mid:[email protected]" type=3D"cite"> <meta name=3D"Title" content=3D""> <meta name=3D"Keywords" content=3D""> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-1252"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:Arial; panose-1:2 11 6 4 2 2 2 2 2 4;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} p.MsoIndex1, li.MsoIndex1, div.MsoIndex1 {mso-style-priority:99; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:12.0pt; margin-bottom:.0001pt; text-indent:-12.0pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p {mso-style-priority:99; mso-margin-top-alt:auto; margin-right:0cm; mso-margin-bottom-alt:auto; margin-left:0cm; font-size:12.0pt; font-family:"Times New Roman";} p.Table-list, li.Table-list, div.Table-list {mso-style-name:"Table - list"; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:10.0pt; margin-bottom:.0001pt; text-indent:-10.0pt; font-size:10.0pt; font-family:Arial;} span.EmailStyle20 {mso-style-type:personal-reply; font-family:Calibri; color:windowtext;} span.msoIns {mso-style-type:export-only; mso-style-name:""; text-decoration:underline; color:teal;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:595.0pt 842.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} --></style> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">Hi,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US"><o:p>=A0</o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">It really boils down how you have implemented dspam with postfix.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">You can create two transports, one for learning and one for inoculation.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">Next all mails to heavily spammed e-mail address goes directly to inoculate.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">Why should you first go to learn and then go to inoculate if your assumption is that the mail is spam anyways?<o:p></o:p><= /span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US"><o:p>=A0</o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">Regards,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US"><o:p>=A0</o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US">LJ<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:Calibri;mso-fareast-lan= guage:EN-US"><o:p>=A0</o:p></span></p> <div> <div> <p class=3D"MsoNormal" style=3D"margin-left:36.0pt">On 18/11/2016, 22:14, "Jeff Kletsky" <<a moz-do-not-send=3D"true" href=3D"mailto:[email protected]">dspam-lists@ally= comm.com</a>> wrote:<o:p></o:p></p> </div> </div> <div> <p class=3D"MsoNormal" style=3D"margin-left:36.0pt"><o:p>=A0</o= :p></p> </div> <p style=3D"margin-left:36.0pt">Over the years I've ended up with some email addresses that are heavily spammed and no longer in use.<o:p></o:p></p> <p style=3D"margin-left:36.0pt">I'd like to take advantage of the= m as a honeypot for inoculation, with the knowledge that they only receive spam.<o:p></o:p></p> <p style=3D"margin-left:36.0pt">I run Postfix and use dspam as a post-queue filter, as described at <a moz-do-not-send=3D"true" href=3D"http://www.postfix.org/FILTER_README.html#advanced_filter">http:/= /www.postfix.org/FILTER_README.html#advanced_filter</a><o:p></o:p></p> <p style=3D"margin-left:36.0pt">As a result, all mail gets classified<i> before </i>I know the final recipient, as local aliases haven't been evaluated yet.<o:p></o:p></p> <p style=3D"margin-left:36.0pt">I'd like to "deliver" mail for these destinations by routing all of it through something like<= o:p></o:p></p> <p style=3D"margin-left:36.0pt">=A0=A0=A0=A0=A0=A0=A0 | dspam --c= lient --user <user> --source=3Derror --class=3Dspam<o:p></o:p></p> <p style=3D"margin-left:36.0pt">without having to first determine if it was improperly classified as non-spam.<o:p></o:p></p> <p style=3D"margin-left:36.0pt">Reading DSPAM(1) reveals<o:p></o:= p></p> <p style=3D"margin-left:36.0pt">=A0=A0=A0 You should use error on= ly when DSPAM has made an error in=A0 clas-<br> =A0=A0=A0 sifying=A0 the message, and should present the modifi= ed version of<br> =A0=A0=A0 the message with the DSPAM signature when doing so.<o= :p></o:p></p> <p style=3D"margin-left:36.0pt">Does this mean that if the messag= e was originally classified as spam that the token and message counts<br> are "blindly" incremented each time it is called, <br> or does dspam check to see the classification of the message ID before incrementing the counts?<o:p></o:p></p> <p style=3D"margin-left:36.0pt">As easy as it would be to grep fo= r 'X-DSPAM-Result: Innocent', it starts getting messy <br> since I also either need the full message or the signature (another grep pass) to pass to dspam.<o:p></o:p></p> <p style=3D"margin-left:36.0pt"><o:p>=A0</o:p></p> <p style=3D"margin-left:36.0pt">If I can't just feed the message into the reclassify dspam call, are there any "elegant" approaches to this?<o:p></o:p></p> <p style=3D"margin-left:36.0pt"><o:p>=A0</o:p></p> <p style=3D"margin-left:36.0pt">Thanks!<o:p></o:p></p> <p style=3D"margin-left:36.0pt"><o:p>=A0</o:p></p> <p style=3D"margin-left:36.0pt">Jeff<o:p></o:p></p> <p style=3D"margin-left:36.0pt"><o:p>=A0</o:p></p> <p class=3D"MsoNormal" style=3D"margin-left:36.0pt">-------------= ----------------------------------------------------------------- _______________________________________________ Dspam-user mailing list <a class=3D"moz-txt-link-abbreviated" href=3D"mail= to:[email protected]">[email protected]</a> <a class=3D"moz-txt-link-freetext" href=3D"https://lists.source= forge.net/lists/listinfo/dspam-user">https://lists.sourceforge.net/lists/= listinfo/dspam-user</a> <o:p></o:p></p> </div> <br> <fieldset class=3D"mimeAttachmentHeader"></fieldset> <br> <pre wrap=3D"">----------------------------------------------------= -------------------------- </pre> <br> <fieldset class=3D"mimeAttachmentHeader"></fieldset> <br> <pre wrap=3D"">_______________________________________________ Dspam-user mailing list <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:[email protected]= rceforge.net">[email protected]</a> <a class=3D"moz-txt-link-freetext" href=3D"https://lists.sourceforge.net/= lists/listinfo/dspam-user">https://lists.sourceforge.net/lists/listinfo/d= spam-user</a> </pre> </blockquote> <br> </body> </html> --------------8D748A90A719E6E20914B4E1-- --===============1051135029776176313== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ --===============1051135029776176313== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Dspam-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/dspam-user --===============1051135029776176313==--