<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
In any case you can check:<br>
bayes_ignore_header X-YOURDOMAIN-COM-MailScanner<br>
bayes_ignore_header X-YOURDOMAIN-COM-MailScanner-SpamCheck<br>
bayes_ignore_header X-YOURDOMAIN-COM-MailScanner-SpamScore<br>
bayes_ignore_header X-YOURDOMAIN-COM-MailScanner-Information<br>
<br>
... from /etc/mail/spamassassin/mailscanner.cf for a clue. You could
write a few lines that include your particular headers and have SA
ignore them. I don't know if bayes_ignore_header takes regexps, but you
could look at the docs for SA and see for yourself.<br>
<br>
Philipp Snizek wrote:
<blockquote cite="mid1139842494.6757.41.camel@philipp.terreactive.ch"
type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">True... More and more I find such dumbed down red boxes, doing for $10k
what can be done for a couple of dozen dollars of commodity (or even
used) hardware. Even so, the red boxes will occasionally hiccup - or
completely die on you, requiring tedious reloading of software and
rules. The sysadmins can't work up the nerve to come up to the PHB and
tell him that red box his golf buddies told him about is just an
overpriced and overmarketed piece of ... equipment that provides a
function that could have been demonstrably better performed at a lower cost.
That's one of my pet peeves. The other one that comes up a lot is the
fact that most of those same sysadmins will buy these "transparent
proxy" boxes that come with one or more forms of "antivirus", for
e-mail/web/etc. - instead of a properly configured box with MailScanner
+ squid + clamav + squidclamav + etc.. These are the same sysadmins that
call you for help 6 months later when their entire network became a
botnet after becoming infected with spyware (AV vendor says "it's not a
virus, so why do I care"), or when they find they can't send email out
because they've wound up on an RBL because their network is an unwitting
spam source, or to find where and how the keylogger got installed on the
PHB's machine, or to see if there's anything we can do to get his
ebay/bank/email password back after someone stole it because they
trusted an overpriced "commercial" offering they'd heard of instead of a
system of tools that are known to work better, faster and more efficiently.
I think I'd better go back to work; I haven't even had my first cup of
coffee and I'm already ranting... can't imagine what I'll be like around
noon after my 4th... ;)
</pre>
</blockquote>
<pre wrap=""><!---->
I of course agree with both of you. A firewall is a firewall .... a.s.o.
=> no services on it.
But thats not the question.
The question is that I have got an smtpd before a smtpd+sa+ms+av. Of
course the smtpd is protected by a transparent L3/4 paketfilter.
Generally, I can't break this setup. Still I'm looking for a solution
whether mails a) could be sent transparently through the smtpd to the
antispam gw (transparently = leaves no trace in the email's header), b)
SA can be told that it should ignore the smtpd's received:from header,
c) MailScanner can cut the particular received:from header before mails
get injected into SA or d) ...your idea...
Many people use a smtp proxy to protect their SA box. I want to make
sure that the SA box doesn't learn that the smtp proxy sometimes sends
crap. That's why the received:from header must be ignored, cut,
whatever.
Thanks so far for your answers
Philipp
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Alex Neuman van der Hans
N&K Technology Consultants
Tel. +507 214-9002 - <a class="moz-txt-link-freetext" href="http://nkpanama.com/">http://nkpanama.com/</a></pre>
</body>
</html>