-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Sunday 11 January 2004 11:30 am, Robin Lynn Frank wrote:

I'm going to include my mailfilter it has lots of examples so you can look though there and pick pout what you want.

in your case you want something like

if ( /^X-Loop: anomy-list/ ) { to "$LMB" }

if ( $SIZE < 50000 ) { xfilter "/usr/bin/spamc -f"

import SENDER import RECIPIENT import EXTENSION

to "| /usr/bin/tmda-filter" }

This will look for your mailing list first and if it finds it then it will deliver it to in this case $LMB which I have set further up as the location of my mailbox.

Let me know how this goes for you. - -- -~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~- Brook Humphrey Mobile PC Medic, 420 1st, Cheney, WA 99004, 509-235-9107 http://www.webmedic.net, ba...@webmedic.net, ba...@linux-mandrake.com Holiness unto the Lord -~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~-~`'~- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAAaq/nT1TkA6FgPgRAgbcAJ43nME3ZysQ4ai86TRsx2/tEubJbgCfUe4F U238sMqbmKXb5//Fktvdsng= =W8rJ -----END PGP SIGNATURE-----

##################################### # log to a file # 0 = off / 1 = on #####################################

LOGS = 1

##################################### # Use anomy sanitizer # Anomy is a good way to prescan for a virus. # it should also be able ot repalce your virus scanner # NOTE: Sanitizer is applied to anything tagged as spam # Even is this setting is set to off # 0 = off / 1 = on #####################################

SANITIZE = 0

##################################### # for debugging make a copy of mail before sanitizing # this is also helpfull for learning missed spam # anomy will alter your emails and as such you dont want # to learn emails as spam that have been "sanitized" by anomy # 0 = off / 1 = on #####################################

CCSANITIZE = 1

##################################### # for debugging make a copy of mail before spam filtering # 0 = off / 1 = on #####################################

CCDEBUG = 1

##################################### # not working yet # Run virus scanning on emails # 0 = off / 1 = on #####################################

VSCAN = 1

##################################### # Turn on spam filtering. # and ham learn # 0 = off / 1 = on # NOTE: Ham learn is not working yet #####################################

SPAMFILTER = 1

HAMLEARN = 0

##################################### # What point level to have spamassassin learn as spam # 0 = off / any other number = number of points to learn at #####################################

SPAMLEARN = 35

##################################### # What point level to have spamassassin delete message # NOTE: if this number is higher than the autolearn number # then you will see no effect from it since spamlearn will # delete the message itself. # 0 = off / any other number = number of points to learn at #####################################

SPAMDELETE = 45

##################################### # To send a message in reply to html-mail (Content-Type: text/html) # set HTML_AUTO_REPLY=1 # Html-mail is diverted to folder 'HTML'. It requires a file # $HOME/htmlmail.msg containing something like "I'm not a browser". # Note: This only drops HTML-only messages, so the multipart ones are O.K. # 0 = off / 1 = on #####################################

HTML_AUTO_REPLY = 0

##################################### # to send a vacation message in reply to mail that is not spam or bulk mail, # set VACATION_AUTO_REPLY=1 # It requires a file $HOME/.vacation.msg, containing the body of the auto reply # 0 = off / 1 = on #####################################

VACATION_AUTO_REPLY = 0

##################################### # Default directories used by maildrop to deliver your email #####################################

LMB = "Maildir"

SPAM = "$LMB/.Spam"

VIRUS = "$LMB/.Virus"

SANITIZED = "$LMB/.Sanitized"

DEBUG = "$LMB/.Debug"

DEBUGINBOX = "$LMB/.Debug.Inbox"

DEBUGSPAM = "$LMB/.Debug.Spam"

DEBUGSALEARN = "$LMB/.Debug.Salearn"

UNSANITIZED = "$LMB/.Debug.Unsanitized"

SENDMAIL = /usr/sbin/sendmail

##################################### # Deafult variable needed for anomy don't delete. #####################################

ANOMY=/usr/lib/perl5/vendor_perl/5.8.1/

##################################### # If external filter commands are used, via "xfilter", be sure that this # user account has a valid shell such as /bin/bash in its /etc/passwd entry. # # If Maildrop exits with an error code, then a line with: # "Unable to filter message." will appear in /var/log/maillog . # # If an external program run via "xfilter" fails, then there may be an # error message returned to Maildrop which Postfix will write to # /var/log/maillog . To debug such things, use "log We are now doing . . . " # lines in this .mailfilter file, because Maildrop will not be writing # to its log file if it fails in some way, and only by scrutinising the # log lines can I determine how far it got. # # Postfix will try periodically to send deferred messages, and this can have # undesired consequences if the mailfiltering system writes the message
somewhere, # or sends it somewhere, but still does not complete without errors. # # To see what is deferred, use the command "mailq". # # The "postsuper" command can manage messages in the queue. # # To force Postfix to try to process all the deferred messages: # # postfix flush # # # Define where I want copies (tagged for deletion) of sorted list messages to go # in addition to them being sent to their own mailbox. I normally want them # to be sent to the Inbox ("Maildir") but if I am away from home, and so # am accessing my email infrequently and probably by the Postman web-mail # system, or for some other reason, don't want my Inbox cluttered with # mailing list messages, I can send those copies to a mailbox I named # "0-Inbox-lists". This "0" puts it up the top of the mailboxes in the left # pane of Netscape Messenger. #####################################

`test -d $LMB` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Mialdir." } `maildirmake++ $LMB` }

`test -d $SPAM` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making Spam
dir." } `maildirmake++ -f Spam $LMB` }

`test -d $VIRUS` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Virus dir." } `maildirmake++ -f Virus $LMB` }

`test -d $SANITIZED` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Sanitized dir." } `maildirmake++ -f Sanitized $LMB` }

##################################### # # Some debugging lines and a place to save things when # I am tweaking settings. # ##################################### if($CCDEBUG) { if ($LOGS) { log "------------------------------------------------------------- Debugging
on." log "------------------------------------------------------------- Logging
on." if ($SANITIZE) { log "-------------------------------------------------------------Sanitizer
on." } if ($VSCAN) { log "------------------------------------------------------------- Virus
scanning on." } if ($CCDEBUG) { log "------------------------------------------------------------- CC Debug
on." } if ($SPAMFILTER) { log "-------------------------------------------------------------
Spamfiltering on." } if ($SPAMLEARN) { log "------------------------------------------------------------- Spamlearn
set at $SPAMLEARN." } if ($SPAMDELETE) { log "------------------------------------------------------------- Spamdelete
set at $SPAMDELETE." } } `test -d $DEBUG` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Debug dir." } `maildirmake++ -f Debug $LMB` }

`test -d $DEBUGSPAM` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Debug Spam dir." } `maildirmake++ -f Debug.Spam $LMB` }

`test -d $DEBUGSALEARN` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Debug Salearn dir." } `maildirmake++ -f Debug.Salearn $LMB` }

`test -d $UNSANITIZED` if( $RETURNCODE == 1) { if ($LOGS) { log "------------------------------------------------------------- Making
Debug Unsanitized dir." } `maildirmake++ -f Debug.Unsanitized $LMB` }

}

if($LOGS) { logfile "$HOME/.maildrop.log"

log "========" }

##################################### # # Checking for duplicates # #####################################

`reformail -D 8000 .duplicate.cache` if ( $RETURNCODE == 0 ) { if ($LOGS) { log "------------------------------------------------------------- Killed
dupe." } to "/dev/null"

}

##################################### # # If this has already been checked upstream for spam then # send it to the spam pit right away # #####################################

if (/^X-Spam-Flag: YES/) { if( $LOGS == 1) { log "------------------------------------------------------------- Spam
general. " } to "$SPAM" }

#if (/^X-Virus-Scanned: by amavisd-new/) #{ #xfilter "subjadd ~~~[NOTSPAM]" #cc "$SANITIZED" #SPAMFILTER=0 #}

##################################### # # Check to see if message came from local source # edit to match your local IPs # #####################################

/^Received: from .* \(HELO .*\) \(!.*!\)/:h if ( $MATCH2 =~ /192\.168\.[01]\./ ) { # This means it is local mail so skip spamfilter SPAMFILTER=0 }

# # Now look for mail originating from our Webmail if (/^X-Mailer: CertaintyTech Webmail .*/:h) { # This means it is local Webmail so skip spamfilter cc "$SANITIZED" SPAMFILTER=0 }

##################################### # # HTML auto reply # ##################################### if ( $HTML_AUTO_REPLY ) { if (/^Content-Type:.*text\/html/ && !/^Precedence: (bulk|list|junk)/) { cc "$DEFAULT/.HTML" xfilter "reformail -r -t" to "| ( cat - ; echo ""; cat htmlmail.msg) | $SENDMAIL" } }

##################################### # # Vacation auto reply # #####################################

if ( $VACATION_AUTO_REPLY ) { if (!/^Precedence: (bulk|list|junk)/) { cc $DEFAULT xfilter "reformail -r -t" /^To:.*/ getaddr($MATCH) =~ /^.*/; MATCH=tolower($MATCH) flock ".vacation.lock" { current_time=time; if (gdbmopen(".vacation.dat", "C") == 0) { if ( (prev_time=gdbmfetch($MATCH)) ne "" && \ $prev_time >= $current_time - 60 * 60 * 24 * 7) { exit } gdbmstore($MATCH, $current_time) gdbmclose } } to "| ( cat - ; echo ''; cat .vacation.msg) | $SENDMAIL" } }

###################################### # This section copied from the main non-spam ordinary message # section below. # # Copy to account on another machine, in case I accidentally delete # something from my Inbox, or mistakenly move it somewhere and then # not know were I put it. # cc "! blah...@blah.blah" # Also copy to a mailbox so I can see them easily. # But I don't intend to keep this mailbox's contents # for long. # cc "Maildir/.0-Inbox-Old.Post-Filter-Inbox" # Deliver to the Inbox. # log "------------------------------------------------------------- Saved
from filtering " # to "Maildir" ######################################

##################################### # # First we use amavisd to scan for virii # If it is virii send it to the virus folder # dont use this till further debuging # it will for some reason send all messages to /dev/null # you have been warned. Anybody knowing how to fix # this please contact me. Thanks. # #####################################

if ($VSCAN) { if ($LOGS) { log "------------------------------------------------------------- Clam
avscan." } # If it isn't Spam, then we scan for Virus # if it is smaller than 2MB in size... # anything larger... they are on their own if($SIZE < 2000000) { xfilter "clamscan.sh" } if ((/^X-Virus-Status:.*INFECTED/)) { to "$VIRUS" } }

##################################### # # Running Spamassassin # This only works if SPAMFILTER=1 above # there are also some checks to turn # off spamfiltering for local delivery # # Pipe through SpamAssassin and if it is deemed # to be spam, dump it in the spam pit and send a # copy, tagged for deletion, to the Inbox, with # [SPAM] added to the Subject line. # # If it is not deemed to be spam, then send it # through Anomy Sanitizer to defang it and # to drop any executable (ie. probably a virus) # attachments. # #####################################

if ($SPAMFILTER) { # # If Spamfilter is enabled then run spamc. #if ( $SIZE < 250000 && $SPAMFILTER =~ /YES/ ) if ( $SIZE < 250000 && $SPAMFILTER ) { xfilter "spamc -f" # Watch out for header line added by Spamassassin. if ( /^X-Spam-Flag: YES/ ) { if( $LOGS == 1) { log "------------------------------------------------------------- Spam
general. " } if($CCDEBUG) { if($LOGS) { log "------------------------------------------------------------- Save
debug." } cc "$DEBUGSPAM" } # Take potential spam and strip out the html # Feed the beast :-) # Auto learn email with a score over 25 # My filters are set kind of high and I have allot of them # you may want to lower this number. # This will help us to learn emails that the autolearn from # spamassassin does not normaly learn by itself /^X-Spam-Status: Yes, hits=![:digit:]+\.?[:digit:]*/ if ($MATCH2>$SPAMLEARN) { if( $LOGS == 1) { log "------------------------------------------------------------- Learning
spam. " } if ($MATCH2>$SPAMDELETE) { xfilter "sa-learn --spam" if( $LOGS == 1) { log "------------------------------------------------------------- Spam
added to bayes. " }

# this will send a report of what was learned to the mailbox listed # change this to # to "/dev/null" # if you don't want to get these notices # it is normal to get a message saying # Learned from 0 message(s) (1 message(s) examined). # this is bacause spamassassin has already learned this message # so it wont learn it a second time. if($CCDEBUG) { xfilter "reformail -I'From: sa-learn'" xfilter "reformail -I'Subject: Learn SPAM threshhold $SPAMLEARN exceeded
($MATCH2 total hits) '" xfilter "reformail -I'MIME-Version: 1.0'" xfilter "reformail -I'X-SPAM-DELETED: Deleted at $SPAMDELETE points'" xfilter "reformail -I'Content-Disposition: inline'" xfilter "reformail -I'Content-Type: Text/Plain;'" xfilter "reformail -I'Message-ID:'" xfilter "reformail -I'X-UID:'" to "$DEBUGSALEARN" } exception {

if( $LOGS == 1) { log "------------------------------------------------------------- Spam
deleted at $SPAMDELETE points" } to "/dev/null" } } exception { if($LOGS) { log "------------------------------------------------------------- Send to
Anomy" xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf
2>>~/.maildrop.log | cat" log "------------------------------------------------------------- Anomy
done." } exception { xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf 2>>/dev/null" } cc "$SPAM" } xfilter "sa-learn --spam" if( $LOGS == 1) { log "------------------------------------------------------------- Spam
added to bayes. " } # this will send a report of what was learned to the mailbox listed # change this to # to "/dev/null" # if you don't want to get these notices # it is normal to get a message saying # Learned from 0 message(s) (1 message(s) examined). # this is bacause spamassassin has already learned this message # so it wont learn it a second time. if($CCDEBUG) { xfilter "reformail -I'From: sa-learn'" xfilter "reformail -I'Subject: Learn SPAM threshhold $SPAMLEARN exceeded
($MATCH2 total hits) '" xfilter "reformail -I'MIME-Version: 1.0'" xfilter "reformail -I'Content-Disposition: inline'" xfilter "reformail -I'Content-Type: Text/Plain;'" xfilter "reformail -I'Message-ID:'" xfilter "reformail -I'X-UID:'" to "$DEBUGSALEARN" } exception { to "/dev/null" } } if ($MATCH2>$SPAMDELETE) { if( $LOGS == 1) { log "------------------------------------------------------------- Spam
deleted at $SPAMDELETE points" } if($CCDEBUG) { to "$DEBUGSPAM" } exception { to "/dev/null" } } exception { # To make it not go to the Inbox, this "cc" into a "to" # and comment out the next three lines. #cc "Maildir/.SPAM" #DELTAG=1 #xfilter "subjadd ~~~[SPAM]" if($LOGS) { log "------------------------------------------------------------- Send to
Anomy" xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf 2>>~/.maildrop.log
| cat" log "------------------------------------------------------------- Anomy
done." } exception { xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf 2>>/dev/null" } to "$SPAM" } } } }

##################################### # # Running Anomy-sanitizer # This only works if SANITIZE=1 above # #####################################

if($SANITIZE) { ##################################### # # Some debugging lines and a place to save things when # I am tweaking Anomy Sanitizer. # ##################################### if($CCSANITIZE) { if($LOGS) { log "------------------------------------------------------------- Save
unsanitized." } cc "$UNSANITIZED" }

# Set up the environment variable ANOMY to keep Anomy happy. # # Filter the message via stdin to Anomy, with the config # file specified, logging output being appended to the # Maildrop log file and then the output being piped to # cat so cat's stdout sends it back to Maildrop. The use # of "2>>" for appending stderr with the log material means # we need the "| cat". # # If Anomy's conf file has: # # feat_log_inline = 0 # feat_log_stderr = 1 # # Then a report of Anomy's progress in working on the message # will be appended to the Maildrop log file. This seems to # work fine, so presumably each "log" line for Maildrop # means it opens and closes the log file.

if($LOGS) { log "------------------------------------------------------------- Send to
Anomy" xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf 2>>~/.maildrop.log |
cat" log "------------------------------------------------------------- Anomy
done." } exception { xfilter "/usr/bin/sanitizer.pl /etc/anomy-sanitizer.conf 2>>/dev/null" }

# Watch out for text added to body by Anomy Sanitizer # when it *drops* a file, not just when it renames # or in some other way defangs one. This is a part # of the drop message I added. # ":b" means look in the body, rather then the headers.

if ( /^*** Attached file dropped ***/:b) { if($LOGS) { log "------------------------------------------------------------- VIRUS. " } # To make it not go to the Inbox, this "cc" into a "to" # and comment out the next three lines. #cc "Maildir/.Virus" #DELTAG=1 xfilter "subjadd -----[VIRUS]----- " to "$SANITIZED" } }

##################################### # # Adding missing headers for PGP/MIME # #####################################

BPM="-----BEGIN PGP MESSAGE-----" EPM="-----END PGP MESSAGE-----" BPS="-----BEGIN PGP SIGNATURE-----" EPS="-----END PGP SIGNATURE-----"

if (!/^Content-Type: message/ && !/^Content-Type: multipart/ \ && !/^Content-Type: application\/pgp/) { if (/^$BPM/:b && /^$EPM/:b) { xfilter "reformail -A 'Content-Type: application/pgp; format=text; \ x-action=encrypt'" if ( $LOGS ==1) { log "------------------------------------------------------------- Fixed pgp
message." } } if (/^$BPS/:b && /^$EPS/:b) { xfilter "reformail -A 'Content-Type: application/pgp; format=text; \ x-action=sign'" if ( $LOGS ==1) { log "------------------------------------------------------------- Fixed pgp
signature." } } }

################################### # # Correcting wrong signature dashes # ###################################

if (/^--$/:b) { xfilter "sed -e 's/^--$/-- /'" if ($LOGS) { log "------------------------------------------------------------- Sig Dashes
corrected." } }

####################################################################### Misc
mailing list stuff.

#if ( ( /.m9ndfukc/ ) \ # || ( /.www.god-emil.dk/ ) \ # ) #{ # log "------------------------------------------------------------- Antiorp
etc. " # cc "Maildir/.0-SPAM-etc.Antiorp-crap" # DELTAG=1 # xfilter "subjadd [Antiorp]" # to "$LMB" #}

# This gets rid of messages from a pesky person or bot who writes gibberish to
some lists - before I search for the list # messages themselves. The "to" command to Maildrop means this is the end of
the filtering process, so if the if() # statement is true, then the rest of the tests are irrelevant.

#if ( /^Return-Path: <bugtraq-return/ ) #{ # log "-------------------------------------------------------------
Linux-bugtraq " # cc "Maildir/.Lists.Linux-bugtraq" # DELTAG=1 # xfilter "subjadd [BugTraq]" # to "$LMB" #}

#if ( /^X-Loop: anomy-list/ ) #{ # log "-------------------------------------------------------------
Mail-Anomy-Sanitizer " # cc "Maildir/.Lists.Mail-Anomy" # DELTAG=1 # to "$LMB" #}

#if ( /^Return-Path: <courier-users-admin/ ) #{ # log "-------------------------------------------------------------
Mail-Courier-users " # cc "Maildir/.Lists.Mail-Courier-users" # DELTAG=1 # to "Maildir" #}

# EPIC # <jw...@bway.net> Censorware proj. http://www.spectacle.org/freespch/slaclist.html # <priv...@vortex.com> Privacy Forum

#if ( ( /^Return-Path: <epic-news/ ) \ # || ( /^Return-Path: <jw@bway/ ) \ # || ( /^Return-Path: <privacy@vortex/ ) \ # ) #{ # log "-------------------------------------------------------------
Privacy-various-lists" # cc "Maildir/.Lists.Privacy-various-lists" # DELTAG=1 # to "$LMB" #}

#if ( ( /in...@firstpr.com.au/)\ # Watch the headers for any mention of
one of the # || ( /mark...@firstpr.com.au/)\ # generic email accounts which RFC 2142
says we # || ( /sal...@firstpr.com.au/)\ # should receive mail on, and which
Postfix by # || ( /supp...@firstpr.com.au/)\ # default aliases to root. # ) #{ # log "------------------------------------------------------------- Spam
generic address. " # cc "Maildir/.-SPAM" # Make this "cc" for copy or "to" to not
send it to Inbox. # DELTAG=1 # xfilter "subjadd ~~~[SPAM]" # to "$LMB" #}

###################################### # Look for messages addressed to an old account # at an ISP, where the messages are automatically # forwarded to here. This is almost certainly # spam. I will label it in the Inbox in a # distinctive way and toss it into its very # own spam pit. ######################################

#if ( (/blah...@ozemail.com.au/ ) \ # ) #{ # log "-------------------------------------------------------------
blah...@ozemail.com.au probable spam " # cc "Maildir/.0-SPAM-etc.00spam-ozemail" # DELTAG=1 # xfilter "subjadd ~~~[SPAM-OzEm]" # to "$LMB" #}

###################################### # Look for messages from specific people which I don't want # to subject to spam filtering, because, for instance, # they have sent HTML emails or some other messages which # have been falsely identified as spam in the past. ######################################

#if ( (/friend-a/ ) \ # || (/friend-b/ ) \ # || (/business-associate-1/ ) \ # || (/business-associate-2/ ) \ # ) #{

if($LOGS) { log "- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - No
match." }

################################### # This section is functionally the same as the section above # where I handle particular messages which I accept without # spam or virus filtering. # # Copy to account on another machine, in case I accidentally delete # something from my Inbox, or mistakenly move it somewhere and then # not know were I put it. # cc "! blah...@blah.balh" # Also copy to a mailbox so I can see them easily. # But I don't intend to keep this mailbox's contents # for long. # cc "Maildir/.0-Inbox-Old.Post-Filter-Inbox" ###################################

# Deliver to the Inbox. if($SANITIZE) { to "$LMB" } exception { if ($HAMLEARN) { /^X-Spam-Status: Yes, hits=![:digit:]+\.?[:digit:]*/ if ($MATCH1<$HAMLEARN) { cc "$LMB" xfilter "sa-learn --ham" if( $LOGS == 1) { log "------------------------------------------------------------- Ham added
to bayes. " } # this will send a report of what was learned to the mailbox listed # change this to # to "/dev/null" # if you don't want to get these notices # it is normal to get a message saying # Learned from 0 message(s) (1 message(s) examined). # this is bacause spamassassin has already learned this message # so it wont learn it a second time. if($CCDEBUG) { xfilter "reformail -I'From: sa-learn'" xfilter "reformail -I'Subject: Learn HAM threshhold $HAMLEARN exceeded
($MATCH1 total hits) '" xfilter "reformail -I'MIME-Version: 1.0'" xfilter "reformail -I'Content-Disposition: inline'" xfilter "reformail -I'Content-Type: Text/Plain;'" xfilter "reformail -I'Message-ID:'" xfilter "reformail -I'X-UID:'" to "$DEBUGSALEARN" } exception { to "/dev/null" }

} } exception { to "$LMB" } }