Mailscanner/Spam Assassin support for MicrosoftIMF/SCLSpamscoring?

Wed Oct 4 16:25:09 IST 2006

I spoke to soon.  I looked through all the MS documentation on IMF and custom rules and you can only act on Body and Subject line phrases.

It does not support acting on message headers!?  We don't modify subjects incase there is a false positive.

So it looks like IMF cannot move MailScanner/Spam Assassin scored messages to a users Junk Mail folder unless you do modify subject or body.

I guess I will need to used something 3rd party.

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Duncan, Brian M.
Sent: Wednesday, October 04, 2006 9:27 AM
To: MailScanner discussion
Subject: RE: Mailscanner/Spam Assassin support for MicrosoftIMF/SCLSpamscoring?

Thanks Christian for the example of using IMF with MailScanner/SpamAssassin.

It looks like as soon as the Exchange admins get IMF installed we can accomplish this today without changing anything.

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Christian Rasmussen
Sent: Tuesday, October 03, 2006 11:52 AM
To: MailScanner discussion
Subject: RE: Mailscanner/Spam Assassin support for Microsoft IMF/SCLSpamscoring?

I've been using the exchange features to assign a SCL score to any message that has the tag added by the mailscanner server.

You can set it up so that all of those tagged messages go automatically to the exchange user's junk email folder. I haven't had any complaints about it and it allows for easier cleanup of those messages later.

If anyone is interested, check out the following page http://www.msexchange.org/tutorials/Intelligent-Message-Filter-version-2-IMF-v2.html

Once you have it enabled, just create a rule in your MSExchange.UceContentFilter.xml with something similar to:

<?xml version="1.0" encoding="UTF-16"?>
<CustomWeightEntries xmlns="http://schemas.microsoft.com/2005/CustomWeight">
<CustomWeightEntry Type="SUBJECT" Change="8" Text="*****JUNK MAIL*****"/> </CustomWeightEntries>

To tag it with any score you've set above your junk level (in the above example 8)

Cheers,

-Christian

________________________________________
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Duncan, Brian M.
Sent: Tuesday, October 03, 2006 6:43 AM
To: mailscanner at lists.mailscanner.info
Subject: Mailscanner/Spam Assassin support for Microsoft IMF/SCL Spamscoring?

For those of us that are environments that support MS Exchange and Outlook 2003+ at the desktop, the capability to support MS IMF (MS Exchange Intelligent Message Filter scoring) from the network edge is very beneficial.

 Most organizations that have SpamAssassin/Mailscanner at the edge of their network rely on custom created rules on clients to move the SpamAssassin tagged messages into their local "Junk-Mail" folder or Spam folder - Or delete them right away.

This leads to support issues in large organizations.  Creating custom exceptions etc, usually in most companies these  local users cannot manage the rules efficiently.

MS in the last year has released a free add-on for Exchange that works very similarly to SpamAssassin it assigns a Score to a message that looks to be in the headers.  Exchange will then automatically put messages based on the local Outlook clients preference level into their local Junk Mail folder. The great thing with this is that users can just right click on messages and add to their "white list" or do complete domains.  No custom scripts to create,  much easier to support in a large environment.

If SpamAssassin/Mailscanner could support adding the IMF headers at the edge, then those that would still like to leverage a SpamAssassin (or any product for that matter, as long as it used the IMF score header) solution at the edge of their network they could do so easily.  You could tune your MS Exchange servers to not be reactive and the SpamAssasin edge products would dictate what was Spam and what was not.

Microsoft with Exchange 12 is pushing  companies into  putting Exchange at the edge of a network . I have already had this discussion in my environment and that I do not think it makes sense given that Sendmail + Mailscanner + SpamAssassin is almost rock solid.    

At the end of this is a previous message to this mailing list that is asking for the same thing that I am.

Does anyone have anything to add to this or is this request really not that worthwhile.

Just the capability of being able to add a generic header to all Spam detected messages would be a great start:

X-MS-Exchange-Organization-SCL: 6.5

(I have already tested this, all headers that are added by Mailscanner seems to include additional information added to the same line)

Thanks

Brian Duncan

brian.duncan at kattenlaw.com

P.S.

There is already a product that can sit on an Exchange server that will convert SpamAssassin scores to equivalent MS IMF Scores.  It would be great if we could handle it from the Unix/Linux side transparently. (It's called Assassin2Exchange filter)

http://www.smtptracker.com/

Previous message that went unanswered to this list:

>Exchange 2003 SP2 has added a "Intelligent Mail Filter" to allow it to deal with spam messages identified by systems like MailScanner or other appliance based solutions.

>Basically, it looks for the following header(s):

>X-MS-Exchange-Organization-PCL: (Phishing Confidence Level)
>X-MS-Exchange-Organization-SCL: (Spam Confidence Level)

>More details can be found at:

>http://www.microsoft.com/technet/prodtechnol/exchange/E2k7Help/28d3a5c2
>-8509-4b25-9876-763536e77c27.mspx?mfr=true

>So, my question is -- can I add this header with MailScanner, inserting the appropriate spam score after the header, e.g.:

>X-MS-Exchange-Organization-SCL:5

>The trick is, I don't want to mess with my existing header adds, I want to add this in addition to my normal ones (X-Spam-Score: XX).  I see where I can add additional headers in the:

>Spam Actions = deliver header "X-Spam-Status: Yes"

>However, it is unclear how to insert the spam score "value" in the "value" area that it needs to be in.  It is also unclear from the Microsoft docs if the "score" can be anything other than whole numbers (e.g. can't be 5.5 but 5 is OK).  So, a way to "round" the score would be helpful.

>Any pointers?

>--

>-----------------------------------------
>Mike Bacher / listacct at tulsaconnect.com TCIS - TulsaConnect Internet

>Services http://www.tulsaconnect.com
>-----------------------------------------
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

===========================================================
CIRCULAR 230 DISCLOSURE: Pursuant to Regulations Governing Practice Before the Internal Revenue Service, any tax advice contained herein is not intended or written to be used and cannot be used by a taxpayer for the purpose of avoiding tax penalties that may be imposed on the taxpayer.
===========================================================
CONFIDENTIALITY NOTICE:
This electronic mail message and any attached files contain information intended for the exclusive use of the individual or entity to whom it is addressed and may contain information that is proprietary, privileged, confidential and/or exempt from disclosure under applicable law.  If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information may be subject to legal restriction or sanction.  Please notify the sender, by electronic mail or telephone, of any unintended recipients and delete the original message without making any copies.
===========================================================
NOTIFICATION:  Katten Muchin Rosenman LLP is an Illinois limited liability partnership that has elected to be governed by the Illinois Uniform Partnership Act (1997).
===========================================================
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 