OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: FILTER_README suggestions

From: Jorey Bump (listjoreybump.com)
Date: Fri Sep 01 2006 - 18:45:37 CDT


Wietse Venema wrote:

> - Have the filter insert a "badness" indicator in a message header,
> and dispose of bad mail with Postfix HOLD/DISCARD actions, maildrop
> rules, cyrus sieves, or procmail filters?

I tag, then reject/hold/deliver based on the score in a message header
(rejecting only in a before-queue content filter). I prefer not to alter
anything normally visible to the user (like the subject), but they are
able to act on the header information of anything that gets through.

I use header_checks for filtering, selectively uncommenting and
adjusting the following:

# HOLD messages marked as spam by SpamAssassin, for later inspection
#/^X-Spam-Flag: YES/ HOLD Identified as spam by SpamAssassin.

# REJECT messages marked as spam by SpamAssassin
# Use this with a before-queue content filter, only!
#/^X-Spam-Flag: YES/ REJECT Identified as spam by SpamAssassin.

# REJECT only high scores
# Use this with a before-queue content filter, only!
/X-Spam-Level: \*{7,}/ REJECT Identified as spam by SpamAssassin.

# HOLD messages with score in specified range for inspection
/X-Spam-Level: \*{5,6}$/ HOLD Identified as spam by SpamAssassin.

Only the HOLD rules are relevant to FILTER_README, but I include the
rest because I will typically set up an after-queue filter first, then
configure the before-queue filter. This way, I can easily switch back to
the after-queue filter if there are any problems.