Mark
asked on
spamassassin check for large body messages
I'd like a rule to check for message bodies greater than a certain size, not including attachments. I'm finding that some spammers pad their messages with up to 1MB of garbage probably just to bypass the size-limit on spam checking. I see not legit messages that have 1MB sizes.
How do I do this?
How do I do this?
It depends on the implementation of SA you're using. The size limit is usually implemented in the MTA integration you're using and not by SA itself.
E.g. If you're using mailscanner, the size limit is in the mailscanner config and mailscanner will not pass any messages to SA if messages are larger than this limit.
So tell us about your SA implementation.
E.g. If you're using mailscanner, the size limit is in the mailscanner config and mailscanner will not pass any messages to SA if messages are larger than this limit.
So tell us about your SA implementation.
ASKER
Sorry, didn't realize I had a response. For some reason I am not getting notified when a response is posted, only when the message is "abandoned".
I'm using sendmail 8.14.4, spamassassin 3.3.2 on Linux Slackware distro 13.37.0, kernel 2.6.37.6. I am running spamass-milter 0.3.1 as a milter in sendmail.
sendmail has no size limit set.
/etc/mail/spamassassin/spa
Here's my issue. Spammers apparently know about Spamassassin size limits. I receive spam messages that are just over this 800K-ish limit. These messages fall into two categories: 1) messages with large attachments. For example I have several spam messages with 800+K .jpg attachments. 2) I have several messages with no attachment, but 800+K of gobbledygook, random words, Bible quotes, encyclopedia entries, blog fragments, etc. Of course, these are in there simply to blow past spam check size limits.
In the first case, I would like spamassassin to ignore the size of the attachment and scan the message body (and not the attachment). There are plenty of spam cues in the body to get it trapped.
In the second case, I'd simply like to trap on the message size. No one legitimately sends an 800K email without making an attachment.
What I'd like:
1. Make my spamc.conf messages size essentially unlimited (or very large)
2. In local.cf, make a rule to look at the message body size, excluding attachments, and if the body size is greater than some value, award a high spam-core.
I know how to do #1. Need help with #2.
Also, will spamd skip examination of attachments? Is there a way to make it do that?
I'm using sendmail 8.14.4, spamassassin 3.3.2 on Linux Slackware distro 13.37.0, kernel 2.6.37.6. I am running spamass-milter 0.3.1 as a milter in sendmail.
sendmail has no size limit set.
/etc/mail/spamassassin/spa
Here's my issue. Spammers apparently know about Spamassassin size limits. I receive spam messages that are just over this 800K-ish limit. These messages fall into two categories: 1) messages with large attachments. For example I have several spam messages with 800+K .jpg attachments. 2) I have several messages with no attachment, but 800+K of gobbledygook, random words, Bible quotes, encyclopedia entries, blog fragments, etc. Of course, these are in there simply to blow past spam check size limits.
In the first case, I would like spamassassin to ignore the size of the attachment and scan the message body (and not the attachment). There are plenty of spam cues in the body to get it trapped.
In the second case, I'd simply like to trap on the message size. No one legitimately sends an 800K email without making an attachment.
What I'd like:
1. Make my spamc.conf messages size essentially unlimited (or very large)
2. In local.cf, make a rule to look at the message body size, excluding attachments, and if the body size is greater than some value, award a high spam-core.
I know how to do #1. Need help with #2.
Also, will spamd skip examination of attachments? Is there a way to make it do that?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
robocat: > Unfortunately, SA has no concept of attachments. An e-mail is just text and attachments are treated as text. This is the reason why large messages are not scanned: it would require too much CPU.
Hmmm, that sucks. And of course that's why clever spammers send a 1M+ of garbage attachment - to blow right past spamassassin.
Ok, I think I'll increase from 800K to 1.1M - that's the largest bloat-spam I've seen. I am running Clamav, but these message don't contain viruses, so they get passed on.
Does Bayes train on attachment content? If so, I'd probably want to somehow exclude these large attachments before handing to sa-learn.
Hmmm, that sucks. And of course that's why clever spammers send a 1M+ of garbage attachment - to blow right past spamassassin.
Ok, I think I'll increase from 800K to 1.1M - that's the largest bloat-spam I've seen. I am running Clamav, but these message don't contain viruses, so they get passed on.
Does Bayes train on attachment content? If so, I'd probably want to somehow exclude these large attachments before handing to sa-learn.
Sanesecurity is an extra set of signatures for ClamAV and instead of virusses, these recognize certain types of SPAM. Clam does look into attachments for these signatures. When blocked here, they will not be passed to SA.
I'm not sure about attachments having a negative impact on Bayes.
I'm not sure about attachments having a negative impact on Bayes.
ASKER
Thanks! I'll check out sanesecurity
ASKER