On Fri, 30 Jan 2004 21:26:00 +0100, Erik Moeller wrote:
Because of mydoom I strongly recommend using a procmail filter for killing attachments *before* they reach SpamAssassin. Before I did so SA literally killed my system because it hit internal file limits. The following rule works well:
:0 B
- ^ *Content-Disposition: attachment;
- filename=".*.(pif|exe|scr|zip|bat|cmd)"
virus
It kills zip files, too, but this shouldn't be a problem for the mailing list. In fact we might want to filter all mails that contain attachments - use URLs instead.
SpamAssassin is very good at killing spam, but it is not very well suited for attachment filtering because of its slowness for large mails.
Agree. The normal setup is calling spamc (the spamassassin daemon) from the system-wide /etc/procmailrc:
# spamassassin :0fw * < 256000 | spamc
#Move any email flagged as spam to the spam folder :0 * ^X-Spam-Flag: YES | $IMAP.Spam
So it's easy to add your rule before it reaches spamassassin.