Skip scan for viruses

[Dustin Baer]

Peter Bonivart wrote:
>
> Dustin Baer wrote:
> > Then the admin who released it is at fault.  I release spam everyday,
> > but put it back through MailScanner, AFTER adding a specific header
> > (X-SpamRequested-Email) that will subract 100 points from SpamAssassin.
> > The -100 score was added 1.5 years ago, when I did release infected
> > message into mqueue.  I sure as hell didn't blame MailScanner, or Julian
> > for my stupidity.  Luckily, Norton caught it on our Lotus Notes server,
> > before any problems were caused.
>
> Could you post how you add the extra header and the SA rule that gives
> it -100? I'm sure many would be interested in using that approach.
>
> --
> /Peter Bonivart

Of course.

If you want the full script(s), I can give you that too, but the short
version of piece you are asking about is (for Sendmail):

#!/bin/ksh

sed 's/^.$/H??X-SpamRequested-Email: Requested\
./' qf$emailID > qf$emailID.$$ && mv qf$emailID.$$ qf$emailID

cp *$emailID /var/spool/mqueue.in

The SpamAssassin rule is:

header   SPAM_REQUESTED X-SpamRequested-Email =~ /Requested/
describe SPAM_REQUESTED Email requested from the MailScanner quarantine
directory
score    SPAM_REQUESTED -100

What I do is send out an overnight HTML email notifying individuals of
what was quarantined.  They can click on a link that will send the email
ID, email address and quarantined date to an email address that calls a
longer version of the above script.  The longer version will check to
see if there is more than one recipient.  If so, it will then modify the
qf file to only send to that person.

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836