Gabriel-
On Fri, 30 Jan 2004 09:41:54 -0500, Poor, Edmund W wrote:
Can we install Spam Assassin software on the wikien-l mailing list? How about other mailing lists?
Anthere and I have gotten tired of reading and deleting up to 30 daily spam, spam, spam, ham, eggs and spam (hasn't got MUCH spam in it) every day -- the joke gets old after a while.
Ed Poor Wikien-l Admin Emeritus
I have to add that spamassassin uses a bit of cpu for its processing, but at the rather low volume of mails processed by the mailing lists this shouldn't be a problem.
Because of mydoom I strongly recommend using a procmail filter for killing attachments *before* they reach SpamAssassin. Before I did so SA literally killed my system because it hit internal file limits. The following rule works well:
:0 B * ^ *Content-Disposition: attachment; * filename=".*.(pif|exe|scr|zip|bat|cmd)" virus
It kills zip files, too, but this shouldn't be a problem for the mailing list. In fact we might want to filter all mails that contain attachments - use URLs instead.
SpamAssassin is very good at killing spam, but it is not very well suited for attachment filtering because of its slowness for large mails.
Regards,
Erik
On Fri, 30 Jan 2004 21:26:00 +0100, Erik Moeller wrote:
Because of mydoom I strongly recommend using a procmail filter for killing attachments *before* they reach SpamAssassin. Before I did so SA literally killed my system because it hit internal file limits. The following rule works well:
:0 B
- ^ *Content-Disposition: attachment;
- filename=".*.(pif|exe|scr|zip|bat|cmd)"
virus
It kills zip files, too, but this shouldn't be a problem for the mailing list. In fact we might want to filter all mails that contain attachments - use URLs instead.
SpamAssassin is very good at killing spam, but it is not very well suited for attachment filtering because of its slowness for large mails.
Agree. The normal setup is calling spamc (the spamassassin daemon) from the system-wide /etc/procmailrc:
# spamassassin :0fw * < 256000 | spamc
#Move any email flagged as spam to the spam folder :0 * ^X-Spam-Flag: YES | $IMAP.Spam
So it's easy to add your rule before it reaches spamassassin.
Erik Moeller wrote:
Because of mydoom I strongly recommend using a procmail filter for killing attachments *before* they reach SpamAssassin. Before I did so SA literally killed my system because it hit internal file limits. The following rule works well:
:0 B
- ^ *Content-Disposition: attachment;
- filename=".*.(pif|exe|scr|zip|bat|cmd)"
virus
It kills zip files, too, but this shouldn't be a problem for the mailing list. In fact we might want to filter all mails that contain attachments - use URLs instead.
I suggest adding .com files, too so the rule would look like this:
:0 B * ^ *Content-Disposition: attachment; * filename=".*.(pif|exe|com|scr|zip|bat|cmd)" virus
Regards
Thomas
On Sat, Jan 31, 2004 at 12:54:19AM +0100, Thomas Luft wrote:
Erik Moeller wrote:
Because of mydoom I strongly recommend using a procmail filter for killing attachments *before* they reach SpamAssassin. Before I did so SA literally killed my system because it hit internal file limits. The following rule works well:
:0 B
- ^ *Content-Disposition: attachment;
- filename=".*.(pif|exe|scr|zip|bat|cmd)"
virus
It kills zip files, too, but this shouldn't be a problem for the mailing list. In fact we might want to filter all mails that contain attachments - use URLs instead.
I suggest adding .com files, too so the rule would look like this:
:0 B
- ^ *Content-Disposition: attachment;
- filename=".*.(pif|exe|com|scr|zip|bat|cmd)"
virus
And another one, no failure for months
:0 B: * -9^0 * 100^0 ^Content-Type: application/x-msdownload; name=" * 100^0 ^Content-Type: audio/x-midi; name=" * 100^0 ^Content-Type: audio/x-wav; name=" * 100^0 ^Content-Type.*name=.*.(exe|com|bat|vbs|js|scr|pif|lnk|zip|doc) virus
wikitech-l@lists.wikimedia.org