<br><font size=2 face="sans-serif">Andrew,</font>
<br>
<br><font size=2 face="sans-serif">I had a little dig around and came up with a few things.</font>
<br>
<br><font size=2 face="sans-serif">1. I think sendmail.pl is the place to play with support for spamassasin.</font>
<br><font size=2 face="sans-serif">2. it looks as though someone has already had a plug at some other "Spam Killer" - to a search for Kill in sendmail.pl</font>
<br><font size=2 face="sans-serif">3. all we need to do is send the entire email to stdin of spamc, and read it back from stdout</font>
<br><font size=2 face="sans-serif">4. parse the subject and look for *****SPAM*****</font>
<br><font size=2 face="sans-serif">5. copy over the header X-Spam-Status if spam detected (see 4 above).</font>
<br>
<br><font size=2 face="sans-serif">spamc is a nice little proggy that will read from stdin, talk to a daemon (spamd), which checks for spam, writes in the subject and body and headers, and returns to spamc, and spamc spits the email back to stdout.</font>
<br>
<br><font size=2 face="sans-serif">I think I'll go pick up a copy of O'Reilly learning perl or something, and make a proper attempt at some of this.</font>
<br>
<br><font size=2 face="sans-serif">not wanting to teach anyone to suck eggs, but I got as far as:</font>
<br><font size=2 face="sans-serif">http://cpan.perl.org/doc/manual/html/pod/perlipc.html#Bidirectional_Communication_with</font>
<br><font size=2 face="sans-serif">which has an example to read and write to stdin,stdout.</font>
<br>
<br><font size=2 face="sans-serif">I would rather spamassasin not scribble so much in the email, but rather return flags, and let mailscanner follow its rules. So basically I think we parse the email coming back from spamc, and discard it, and makes decisions in mailscanner. So we might need to reprocess the output of spamc, and look for *****SPAM***** in the subject, and use that as the key from output from spamc to tell mailscanner it is spam, I think the header: X-Spam-Status would be good to keep/process as well, its output looks something like this:</font>
<br>
<br><font size=2 face="sans-serif">X-Spam-Status: Yes, hits=10 required=5 tests=FORGED_RCVD_FOUND,NO_REAL_NAM</font>
<br><font size=2 face="sans-serif"> E,UNDISC_RECIPS,INVALID_DATE,MSGID_HAS_NO_AT,REMOVE_SUBJ</font>
<br>
<br><font size=2 face="sans-serif">which shows which rules were broken , leading to the spam decision.</font>
<br>
<br><font size=2 face="sans-serif">this is the stuff it adds to the body of the email:</font>
<br>
<br><font size=2 face="sans-serif">SPAM: -------------------- Start SpamAssassin results ----------------------</font>
<br><font size=2 face="sans-serif">SPAM: This mail is probably spam. The original message has been altered</font>
<br><font size=2 face="sans-serif">SPAM: so you can recognise or block similar unwanted mail in future, using</font>
<br><font size=2 face="sans-serif">SPAM: the built-in mail filtering support in your mail reader.</font>
<br><font size=2 face="sans-serif">SPAM:</font>
<br><font size=2 face="sans-serif">SPAM: Content analysis details: (10 hits, 5 required)</font>
<br><font size=2 face="sans-serif">SPAM: Hit! (0.1 points) Possibly-forged 'Received:' header found</font>
<br><font size=2 face="sans-serif">SPAM: Hit! (3.2 points) From: does not include a real name</font>
<br><font size=2 face="sans-serif">SPAM: Hit! (1.4 points) Valid-looking To "undisclosed-recipients"</font>
<br><font size=2 face="sans-serif">SPAM: Hit! (3.3 points) Invalid Date: header (has AM/PM)</font>
<br><font size=2 face="sans-serif">SPAM: Hit! (0.3 points) Message-Id has no @ sign</font>
<br><font size=2 face="sans-serif">SPAM: Hit! (1.7 points) BODY: /remove.*subject/i</font>
<br><font size=2 face="sans-serif">SPAM:</font>
<br><font size=2 face="sans-serif">SPAM: -------------------- End of SpamAssassin results ---------------------</font>
<br>
<br><font size=2 face="sans-serif">I don't think we can do much with that - I dont think that much is allowed in headers, and I think it is "over the top" for the mail body.</font>
<br><font size=2 face="sans-serif"><br>
regards<br>
Scott Farrell <br>
<br>
http://www.icconsulting.com.au<br>
ic Consulting - the people that make eBusiness happen.<br>
We offer e-business consulting and perform services. We deliver high impact consulting, and fast turn around projects for our clients.<br>
Ask us about Web Content Management, Web Self Service, or working closer with your customers or suppliers.<br>
<br>
0412 927 156, 02 9411 3622 mailto:sfarrell@icconsulting.com.au</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>Andrew Hoying <andrewh@CQG.COM></b></font>
<br><font size=1 face="sans-serif">Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK></font>
<p><font size=1 face="sans-serif">31/10/2001 04:22 AM</font>
<br><font size=1 face="sans-serif">Please respond to MailScanner mailing list</font>
<br>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To: MAILSCANNER@JISCMAIL.AC.UK</font>
<br><font size=1 face="sans-serif"> cc: </font>
<br><font size=1 face="sans-serif"> Subject: Re: Subject Line control (SPAM CONTROL)</font></table>
<br><font size=2 face="Courier New">I've been using spam-assassin, http://spamassassin.taint.org/, along with<br>
mailscanner. Spam-assassin catches about 95% of the spam sent to the company<br>
I work for, up significantly from what mailscanner can catch, but it doesn't<br>
do virus scanning so I have to use both products on my mail gateway. I would<br>
love to see these to products combined into one. I may have a chance to<br>
start some work in that direction in the comming days, but if someone else<br>
would like to look at this, that would be great.<br>
<br>
Andrew Hoying<br>
<br>
<br>
> -----Original Message-----<br>
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On<br>
> Behalf Of Julian Field<br>
> Sent: Tuesday, October 30, 2001 2:19 AM<br>
> To: MAILSCANNER@JISCMAIL.AC.UK<br>
> Subject: Re: Subject Line control (SPAM CONTROL)<br>
><br>
><br>
> At 21:21 29/10/2001, you wrote:<br>
> >I am new to mailscanner, so I apologies if this is answered<br>
> somewhere else.<br>
> >Is there a way to scan for word expressions in the Subject line<br>
> to identify<br>
> >Spam mail? It seems to only catch 20% of the Spam coming through my mail<br>
> >server using MAPS.<br>
><br>
> No there aren't, I'm afraid. Have you looked at using ORDB, ORBZ and/or<br>
> ORBL as well?<br>
> --<br>
> Julian Field Teaching Systems Manager<br>
> jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science<br>
> Tel. 023 8059 2817 University of Southampton<br>
> Southampton SO17 1BJ<br>
</font>
<br>
<br>