Keep your photos clean

Well it made me laugh - from a spam that sneaked though the filter:

My name is Lubov. To me of 27 years. I to live in Russia in small small town but to name Medvedevo! I send you a photo in this letter. I to think washing a photo will like you. I the free girl, I to not have children! I already more than 3 years the lonely girl!

How big?!

I use mailfilter to remove unwanted email from my POP servers so that I don't have to download the really spammy stuff, just now I was looking for recent large files and I spotted this

-rw-r--r-- 1 robert robert 110036290 Feb 23 14:16 /home/robert/logs/.mailfilter.log

100 meg!? I periodically compress and rename the old one - this log file was only started in January this year. I've hastily moved this one out of the way!

vexim (waves clove of garlic)

We run vexim at work with spamassassin to handle the email. Yesterday I realised - not before time(!) that at smtp time, exim scores incoming email using spamassassin, if it

• scores more than 12, it gets rejected straight away, and a copy of the email is retained


• score more than 9, it gets a temp rejection - waiting to see if the other end attempts to redeliver, and a copy of the email is retained


• otherwise it gets handed over to [v]exim which does things like distribution lists and vacation messages and also (depending on the user) decides to deliver the email depending on the spam score - if it doesn't deliver, no copy is retained.

So the borderline spam disappears into a black hole (ditch_spam), whereas the really spammy stuff is carefully kept!? Is this what is really meant to happen? So I spent a fun few hours yesterday going back though the email logs as far as they went, looking for possible non-spam that had been ditched and warning the non-recipients!
I've now modified the exim configuration along these lines to set up a separate transport for the borderline spam stuff(apologies for the wiki spam at the top of that link!)
Some time since I had an IT posting...

Fountains of smtp

Following on from this, I've had a sudden need to go up to Newcastle (upon T) tomorrow as there's a mailbot loose somewhere on the network spewing spam everywhere and my job is to find and exterminate it! I hope it isn't reading this... as it has caused our email server to be blacklisted thus stopping outgoing mail from leaving the server - the server inspects the email discovers it's from a blacklisted site - itself! - and won't proceed further!