How reject spam at high score in exim.conf

X

xemaps

Verified User
Joined
Apr 13, 2006
Messages
385
Location
Europe
For use in exim 4.63/FC3
edit exim.conf

#########################################
# ACL that is used after the DATA command
#########################################
check_message:
...

# test reject spam at high scores (> 15)
# place before accept from acl_check_data
drop message = This message is denied by policy : $spam_score spam points
spam = nobody:true
condition = ${if >{$spam_score_int}{150}{1}{0}}

...
accept
###################

This would reject spam more than 15 spamassassin points.
 
What are you using to run email through spamassassin before the data ACL?

Jeff
 
Sure :) .

What are you doing to run incoming email through spamd before the data ACL?

Jeff
 
i don't know what you mean

conf FC3/exim/clamav
i use my acl AFTER DATA (read top of post) then score is known
sa check on my config 3000 chars

It's very cool to reject high spam score !

sample stats (i reject at 15):

>CURRENT WEEK---
spam:223
ham:1293
rejected:3075
>DETAIL Rejected
>>virus:8
>>rbl blacklist:404
>>invalid HELO:1146
>>forged HELO:55
>>high score spam:25
>>faked mail:21

and some connexions are blocked by APF, so doesn't appears here.
 
Last edited:
Seems like nobody is interested into filter spam here !

I fight against spam since years with my friends like spamcop, dshields, sans , aso...

incredible.
 
Ok, I guess reject could be taken as delete.

By the way, tried it, works!

thanks!!
 
Looks great!

condition = ${if >{$spam_score_int}{150}{1}{0}}

Where i can change the spamcore?
Is it the {150} that stands for 15 points?

By the way, how do you get the statistics?

I like to know that :)
 
Pascal said:
Looks great!

condition = ${if >{$spam_score_int}{150}{1}{0}}

Where i can change the spamcore?
Is it the {150} that stands for 15 points?

By the way, how do you get the statistics?

I like to know that :)
Click to expand...

Yes, that is for >15 points. You can cat the logs, grep and count information ( cat /var/log/exim/mainlog | grep "denied by policy" | wc -l ). Also you can code your own perl script which can show email statistics.
 
Another way to check what the server is rejecting, is:

As Admin, in "Admin Tools", Log Viewer, Exim rejectlog
 
jlasman said:
Sure :) .

What are you doing to run incoming email through spamd before the data ACL?

Jeff
Click to expand...

Good question as this doesn't work.

xemaps - Where is the variable $spam_score_int being defined? I cannot find it in the exim.conf file anywhere...please elaborate.

Thanks.
 
Dark_Wizard said:
Good question as this doesn't work.

xemaps - Where is the variable $spam_score_int being defined? I cannot find it in the exim.conf file anywhere...please elaborate.

Thanks.
Click to expand...

Have you spamassassin installed and running ?

This variable is the result spam score calculated by spamassassin

For special situation try to replace
$spam_score_int with 0$spam_score_int
notice the leading zero to force decimal

Have a look here http://www.exim.org/eximwiki/ExiscanExamples?highlight=(spam_score_int)

Exiscan is integrated in SA since version 4.50, no need to patch exim with exiscan patch.
 
I may be wrong but I think the real question is still where do you implement the SA check?

Can you post the portion of your exim.conf file that actually checks the incoming email through SA?

Otherwise checking for the spam score is useless.

Thanks.

Jeff
 
jlasman said:
I may be wrong but I think the real question is still where do you implement the SA check?

Can you post the portion of your exim.conf file that actually checks the incoming email through SA?

Otherwise checking for the spam score is useless.

Thanks.

Jeff
Click to expand...

Agreed...
 
xemaps said:
Have you spamassassin installed and running ?

This variable is the result spam score calculated by spamassassin

For special situation try to replace
$spam_score_int with 0$spam_score_int
notice the leading zero to force decimal

Have a look here http://www.exim.org/eximwiki/ExiscanExamples?highlight=(spam_score_int)

Exiscan is integrated in SA since version 4.50, no need to patch exim with exiscan patch.
Click to expand...

Yes, spamassassin is installed and running well but I fail to see how this works as you have posted when sa is not checking at this point in the exim.conf file unless I am seriously missing something.
 
You must log in or register to reply here.
Back
Top