Exim SpamAssassin at SMTP time

What's that?

mail from: merlin@gandalf
250 OK
rcpt to: merlin@gandalf
250 Accepted
data
354 Enter message, ending with "." on a line by itself
From: merlin@gandalf
To: merlin@gandalf
Subject: $$$ Make Money Fast $$$ !!!

viagra 100% GARANTEE AMAZING FULL REFUND 
This is not spam
.
550-Heuristics guessed that this message was spam:
550 hits=14.8 required=1.0 trigger=12.0

An example of teergrub would return this instead

data
354 Enter message, ending with "." on a line by itself
(...)
body     SEE_FOR_YOURSELF       /See (?:for|it) yourself\b/i
describe SEE_FOR_YOURSELF       See for yourself

body ORDER_NOW                  /\border (?:now|soon|fast|quickly|while)\b/i
describe ORDER_NOW              Encourages you to waste no time in ordering

.
451- wait for more output (hits=28.2 required=7.0 trigger=25.0)
451- wait for more output (hits=28.2 required=7.0 trigger=25.0)
451- wait for more output (hits=28.2 required=7.0 trigger=25.0)
(... one line every 10 secs, 15 minutes elapse ...)
450 How a bout you try again later for a little more teergrub? (hits=28.2 required=7.0 trigger=25.0)
The idea here is to stall and waste the resources of the remote sender

Why?

SpamAssassin can be run inside exim after the mail has been accepted, as shown here, but if you're not going to use my patch and you just want to run SA as an exim transport, this version is recommended

Now, while this will work, we can do better, hence the reason for my code (just to make things clear, you do not want to run both my code, and dman's transports. It'd work, but you'd be scanning the message twice)

The reason why I wanted SpamAssassin in local scan is that I don't want to accept the damn spam in the first place.

Note that you can also use this code to simply run SA on all your mails (or portion thereof as configured with SAEximRunCond) without having to configure SA in your exim.conf. In other words, this code can be configured to not reject any mails.

SpamAssassin? What's that?

Ah, you need to visit this page first then

How does it work, what knobs are there?

You need to configure spamassassin to flags mails as spam after a certain threshold (7 for instance). After that, this code can be configured to

For more details, you should look at the self-documented config file and you can see some sample rejects and what you get in the logs

Ok, where's the code?

As explained in the archive, you can either copy sa-exim.c over exim's src/local_scan.c You need to copy local_scan in src in the exim source tree and rebuild it, or you can build sa-exim as a loadable module (you need to patch exim to support loadable modules though)

If you use Debian Linux, I unofficially maintain an exim4 package. See this page for details

You can also browse all my exim files here

Mailing list

You should probably subscribe to this low traffic mailing list if you download the code to keep apprised of bug fixes and enhancements

Integration with Exim 4

This code works without anything in the exim conf, but you probably want to use some knobs to disable scanning for some users (like setting X-SA-Do-Not-Rej or X-SA-Do-Not-Run in the rcpt ACL and removing those headers in the right places).
See my exim4 conf tree and more specifically the exim4.conf file

Changelog

More generally, all the files can also be found here

Feedback is appreciated

Acknowledgements

While I wrote SA-Exim after realizing that I didn't want to accept Spam in the first place, this package would not have been put together without the help and contributions of the following people:


[ms free site] SourceForge.net Logo Email
Link to Home Page

2002/05/06 (09:47): Version 1.0. Initial version
2002/05/06 (11:21): Version 1.1. Minor typos and fixes
2002/05/06 (23:52): Version 1.2. Version 1.0.1 released
2002/05/08 (01:33): Version 1.3. Version 1.1 released
2002/05/08 (23:02): Version 1.4. Version 1.1.1 released
2002/05/13 (23:49): Version 1.4. Version 1.2.1 released
2002/05/16 (10:30): Version 1.5. Made it clear that the patch is self sufficent
2002/05/19 (17:41): Version 1.6. Version 1.2.2 released
2002/05/21 (00:11): Version 1.7. Version 1.3 released
2002/06/02 (00:45): Version 1.8. Version 2.0b1 released
2002/06/14 (09:57): Version 1.9. Version 2.0 released
2002/10/14 (R10:51: Version 2.0. Version 2.1 released