Mailing List Archive

message size, mark if too large?
Some mail with attached suspect files are larger than can be processed. Looking for a way to flag such "oversize" messages as suspect even if not processed.

Is there a simple way? SpamAssassin version 3.4.2
Re: message size, mark if too large? [ In reply to ]
What glue are you using to call SA?

On Sat, Dec 26, 2020, 14:12 Joe Acquisto-j4 <joea@j4computers.com> wrote:

> Some mail with attached suspect files are larger than can be processed.
> Looking for a way to flag such "oversize" messages as suspect even if not
> processed.
>
> Is there a simple way? SpamAssassin version 3.4.2
>
>
>
Re: message size, mark if too large? [ In reply to ]
Umm, err, . . . well . . .

Just what I robotically entered in postfix master.cf

smtp inet n - n - - smtpd -o content_filter=spamassassin

Is that what you were after?

>>>
> What glue are you using to call SA?
>
> On Sat, Dec 26, 2020, 14:12 Joe Acquisto-j4 <joea@j4computers.com> wrote:
>
>> Some mail with attached suspect files are larger than can be processed.
>> Looking for a way to flag such "oversize" messages as suspect even if not
>> processed.
>>
>> Is there a simple way? SpamAssassin version 3.4.2
>>
>>
>>
Re: message size, mark if too large? [ In reply to ]
First, you might want to look into using spamd and spam instead of
SpamAssassin here. Right now you are compiling spam assassin every single
email. Spamd will demonize it waiting for a connection and spamc is that
lightweight connection glue.

Second, I would guess sieve or procmail depending on your configuration can
be used to add a header based on size.

Regards. KAM


On Sat, Dec 26, 2020, 18:47 Joe Acquisto-j4 <joea@j4computers.com> wrote:

> Umm, err, . . . well . . .
>
> Just what I robotically entered in postfix master.cf
>
> smtp inet n - n - - smtpd -o
> content_filter=spamassassin
>
> Is that what you were after?
>
> >>>
> > What glue are you using to call SA?
> >
> > On Sat, Dec 26, 2020, 14:12 Joe Acquisto-j4 <joea@j4computers.com>
> wrote:
> >
> >> Some mail with attached suspect files are larger than can be processed.
> >> Looking for a way to flag such "oversize" messages as suspect even if
> not
> >> processed.
> >>
> >> Is there a simple way? SpamAssassin version 3.4.2
> >>
> >>
> >>
>
>
Re: message size, mark if too large? [ In reply to ]
I forgot about this further down master.cf:

spamassassin unix - n n - - pipe
flags=Rq user=spamfilter argv=/usr/local/bin/spamass.sh -e /usr/sbin/sendmail -oi -f ${sender} -- ${recipient}

spamass.sh consists of:
#!/bin/bash
/usr/bin/spamc -s 750000 | /usr/sbin/sendmail -i "$@"
exit $?

It's been there all along. t sure why I did it that way.
I guess I need to re-read something as I have been changing the -s value in spamc.conf and is seems to have an effect after a restart. 00I would have thought the value in master.cf would take precedence.

joe a

>>>
> First, you might want to look into using spamd and spam instead of
> SpamAssassin here. Right now you are compiling spam assassin every single
> email. Spamd will demonize it waiting for a connection and spamc is that
> lightweight connection glue.
>
> Second, I would guess sieve or procmail depending on your configuration can
> be used to add a header based on size.
>
> Regards. KAM
>
>
> On Sat, Dec 26, 2020, 18:47 Joe Acquisto-j4 <joea@j4computers.com> wrote:
>
>> Umm, err, . . . well . . .
>>
>> Just what I robotically entered in postfix master.cf
>>
>> smtp inet n - n - - smtpd -o
>> content_filter=spamassassin
>>
>> Is that what you were after?
>>
>> >>>
>> > What glue are you using to call SA?
>> >
>> > On Sat, Dec 26, 2020, 14:12 Joe Acquisto-j4 <joea@j4computers.com>
>> wrote:
>> >
>> >> Some mail with attached suspect files are larger than can be processed.
>> >> Looking for a way to flag such "oversize" messages as suspect even if
>> not
>> >> processed.
>> >>
>> >> Is there a simple way? SpamAssassin version 3.4.2
>> >>
>> >>
>> >>
>>
>>
Re: message size, mark if too large? [ In reply to ]
Is that what you were after?
> > >
> > > > What glue are you using to call SA?
> > > >
> > > > On Sat, Dec 26, 2020, 14:12 Joe Acquisto-j4 <
> > > > joea@j4computers.com>
> > > wrote:
> > > > > Some mail with attached suspect files are larger than can be
> > > > > processed.
> > > > > Looking for a way to flag such "oversize" messages as suspect
> > > > > even if
> > > not
> > > > > processed.
> > > > >
> > > > > Is there a simple way? SpamAssassin version 3.4.2
> > > > >
> > > > >
> > > > >
Here's a procmail recipe I use to mark large files

:0 fh w
* > 100000
* ^Subject:\/.*
| formail -I "Subject: {* -BIG- *} $MATCH"

You can change the file size in the 2nd line to meet your needs.

--
Chris
31.11972; -97.90167 (Elev. 1092 ft)
08:07:17 up 14 days, 23:10, 1 user, load average: 3.29, 2.60, 1.69
Description: Ubuntu 20.04.1 LTS, kernel 5.4.0-58-generic