How to kill spam when spamassassin marks it spam

[kpimichael]

I have looked all over the internet...trying to find procmail recipie that will simply? drop any mail marked ***SPAM*** with spam assassain to the floor or write it to a new mailbox. So far, i have found nothing that is straight forward at least to me as a newbie. I myself would like to do it on a domain wide basis most often....write to a domain wide spam mailbox and let people decide what is really not spam on a weekly basis by just going to the spam account.

Thanks for considering.

[transops.net]

Please include O/S, distro, MTA, etc.

[falko]

You could use a procmail recipe like this:

# SpamAssassin sample procmailrc
#
# Pipe the mail through spamassassin (replace 'spamassassin' with 'spamc'
# if you use the spamc/spamd combination)
# The condition line ensures that only messages smaller than 250 kB
# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam
# isn't bigger than a few k and working with big messages can bring
# SpamAssassin to its knees.
:0fw
* < 256000
| /path/to/spamassassin --prefs-file=/path/to/.user_prefs

# Mails with a score of 15 or higher are almost certainly spam (with 0.05%
# false positives according to rules/STATISTICS.txt). Let's put them in a
# different mbox. (This one is optional.)
#:0:
#* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
#/dev/null

# All mail tagged as spam (eg. with a score higher than the set threshold)
# is moved to "/dev/null".
:0:
* ^X-Spam-Status: Yes
/dev/null

# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0
* ^^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "

:0 fhw
| sed -e '1s/^/F/'
}

[kpimichael]

I think maybe a lot of my problem is that i am running a server on unix with Plesk and it inserts itself in everything changing paths and such. So if you are not really familiar with what you are doing you get lost quickly. Here is my environment... Thanks again for taking your valuable time and trying to help..... Regards,

PLESK 7.53
psa 7.5.3-fc2.build75050506.13
httpd 2.0.51-2.9.1.swsoft
bind 9.2.3-13
courier-imap 3.0.8-fc2.build75050506.13
mailman 2.1.5-10.fc2
mysql 3.23.58-16.FC2.1
webalizer 2.01_10-22
php 4.3.10-2.4.1.swsoft
mod_python 3.1.3-1.fc2.2
SSHTerm 0.2.2-fc2.build75050506.13
spamassassin 2.63-8
psa-qmail 1.03-fc2.build75050506.13
psa-qmail-rblsmtpd 0.70-fc2.build75050506.13
psa-proftpd 1.2.10-fc2.build75050506.13
psa-logrotate 3.7-fc2.build75050506.13
psa-spamassassin 7.5.3-fc2.build75050506.13
mod_perl 1.99_12-2.1
perl-Apache-ASP 2.57-fc2.build75050506.13
drweb 4.32.2-rh7_psa
drweb-qmail 4.32-fc2.build75050506.13

[falko]

Did the above procmail recipe help?:confused:

[kpimichael]

Yes...the script is right...i am sure. I am still working on where to put it in Plesk. The procmail.rc at the server level does not seem to be working. Nothing happens that i can tell. I see nothing in the logs. I think it is because that Plesk keeps things in a differerent place than normal. I am still working on it. Again thank you for your help. REGARDS

[falko]

Normally the procmail recipes go into each user's home directory.

[faraday G]

Im a bit of a noob I think. I would like to know how to use this recipe.

I want to place it into the "/root/ispconfig/isp/conf/customised_templates" folder so that its active globally.

I want to move all emailes marked ***SPAM*** to a nospam@ email address.

I see this /dev/null and have no idea what it means.

Any help would be appreciated.

[falko]

Place the script in /root/ispconfig/isp/conf/customised_templates and name it spamassassin.rc.master.
Replace /dev/null (which is the null device, which means everything sent to /dev/null gets deleted) with your nospam email address.

[faraday G]

Yay! Finally enough info to make sense. Thank you Falko!

[faraday G]

One last thing to be absolutely sure I know how to do it.

I replaced /dev/null with: /var/www/web2/user/web2_spam/Maildir

does that look ok?

[falko]

If it was an mbox file it would be ok, but this doesn't work with Maildir because in Maildir all messages are stored as seperate files. But you can use that user's email address instead in the procmail recipe.

[faraday G]

I cant figure out why it wont work. Here is the file located inside the customized templates folder. I also went into ispconfig and change all the users settings to mark mail as spam and keep. It was previously set to discard.

# SpamAssassin sample procmailrc
#
# Pipe the mail through spamassassin (replace 'spamassassin' with 'spamc'
# if you use the spamc/spamd combination)
# The condition line ensures that only messages smaller than 250 kB
# (250 * 1024 = 256000 bytes) are processed by SpamAssassin. Most spam
# isn't bigger than a few k and working with big messages can bring
# SpamAssassin to its knees.
:0fw
* < 256000
| /path/to/spamassassin --prefs-file=/path/to/.user_prefs

# Mails with a score of 15 or higher are almost certainly spam (with 0.05%
# false positives according to rules/STATISTICS.txt). Let's put them in a
# different mbox. (This one is optional.)
#:0:
#* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
#/dev/null

# All mail tagged as spam (eg. with a score higher than the set threshold)
# is moved to "/dev/null".
:0:
* ^X-Spam-Status: Yes
spam@******group.com

# Work around procmail bug: any output on stderr will cause the "F" in "From"
# to be dropped. This will re-add it.
:0
* ^^rom[ ]
{
LOG="*** Dropped F off From_ header! Fixing up. "

:0 fhw
| sed -e '1s/^/F/'
}

From what I gather, thats all I should need to do but it doesnt seem to work. Maybe I need to point ispconfig to look for this file?

[falko]

What's the output of ls -la /root/ispconfig/isp/conf/customized_templates?

Did you change anything in ISPConfig's web interface so that the procmail recipes get rewritten?

[faraday G]

drwxr-xr-x 2 root root 4096 Aug 1 14:00 .
drwxr-xr-x 3 root root 4096 Jul 31 09:18 ..
-rw-r--r-- 1 root root 459 Jun 6 11:15 procmailrc.master
-rw-r--r-- 1 root root 1090 Aug 2 08:19 spamassassin.rc.master


I changed nothing.

[falko]

I changed nothing.
Do so now. Go to each user in ISPConfig and change something for the user so that the procmail recipes get rewritten. Afterwards, you can undo the changes in the ISPConfig web interface.