[Mailman-Users] Preventing spam to list owners

[Gary Spivey]

Well - thanks all for the input, and Robert for your sample files - I
have spent the spare moments of the last few days implementing procmail
and spam assassin. I then changed my alias file as listed below

listname-owner: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
owner listname"

only for the listname-owner lines of the various lists ...

Now, I don't get SPAM - this is great - I tried training spamassassin
with some SPAM and with the ham of all of the mailman list archives to
improve the selection. It seemed unclear to me, but apparently each user
has their own training, so I trained as both root and as the mailman
user - somebody can clue me in please on what is/was proper there ...

ALMOST THERE!!!!!

Now, my trouble is that when I send legitimately to a list - say a mail
that is too large and needs moderation, then mailman sends an e-mail to
listname-owner to moderate the e-mail. However, my beautiful SPAM filter
is snagging it ... sigh ... I hate SPAM. I am perfectly satisfied with
the size of ... well ... anyway ...

Any futher help on how to train spamassassin to allow the legitimate
e-mails to listname-owner and reject the others? Is there some way to
make it so that e-mails from mailman to listname-owner get through but
the others don't? 

Hmmm ... maybe procmail?!!? Can I filter on the from line to see if it
is coming from my own mailman address? I am off to try that - any other
thoughts would certainly be appreciated. I have had a couple days worth
of education going here (like smrsh - who knew that would be
restricted?!?!) 

-Gary



-----Original Message-----
From: mailman-users-bounces+gspivey=georgefox.edu at python.org
[mailto:mailman-users-bounces+gspivey=georgefox.edu at python.org] On
Behalf Of Robert Braver
Sent: Sunday, September 30, 2007 10:54 AM
To: mailman-users at python.org
Subject: Re: [Mailman-Users] Preventing spam to list owners

On Sunday, September 30, 2007, 12:30:44 AM, Gary Spivey wrote:

GS> My lists are locked down to only allow posts from members, so my
GS> members are not getting any [spam]. However, as list owner, every
GS> one of my lists is getting a large amount of [spam] - generally
GS> sent to the listname-owner or to mailman-owner.

I run only a small handful of lists, with anywhere from 20 to 200
members each, and filter out at least 200 spams to the various list
addresses daily by running everything through SpamAssassin via a
small bit of procmail.

I've been doing this for about a year now, and very few spams get
through, resulting in very few messages for a moderator and uncaught
bounce notifications.  Legitimate bounces (e.g. a user submitting
a message from a recently changed email addresses) still occur as
expected & desired.

Wholesale bouncing of list mail to non-subscribers is totally
unacceptable due to the amount of outscatter this will cause. (see
http://en.wikipedia.org/wiki/Backscatter#Backscatter_of_email_spam )

It only took one list member from one of the smaller lists (which is
private and not listed anywhere) who had their address book
harvested by a trojan to cause about 50 spam emails a day to that
list alone on an ongoing basis... so hiding the list addresses
doesn't guarantee that they won't eventually leak out and get on the
spam lists.

Aliases file entries and procmail script is below.  I'm currently
tagging list filtered spam and shunting it to a specific folder
which I periodically review and flush, but it could just as easily
be sent to /dev/null.

>From the aliases file:

## listname mailing list
listname: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc post
listname"
listname-admin: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
admin listname"
listname-bounces: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
bounces listname"
listname-confirm: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
confirm listname"
listname-join: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc join
listname"
listname-leave: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
leave listname"
listname-owner: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
owner listname"
listname-request: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
request listname"
listname-subscribe: "| /usr/bin/procmail -m /etc/procmailrcs/mailman.rc
subscribe
listname"
listname-unsubscribe: "| /usr/bin/procmail -m
/etc/procmailrcs/mailman.rc unsubscribe
listname"


The mailman.rc file is:

VERBOSE=yes
LOGFILE=/var/log/mailman-procmail.log

MMCOMMAND=$1
MMLIST=$2

:0fw
* < 256000
|/usr/bin/spamc

# Send on to Mailman if not marked as spam
:0 H
* !^X-Spam-Status: Yes
|/var/mailman/mail/mailman $MMCOMMAND $MMLIST

# Otherwise add tag and send to abuse mailbox
:0
* ^Subject:[    ]*\/[^  ].*
{
        SUBJECT=$MATCH
}

# create the new subject token
SUBJECT="[$MMLIST Filtered] $MATCH"

# insert it into the headers
:0hf
| formail -I "Subject: $SUBJECT"

# and forward

:0
! spam






-- 
Best regards,
 Robert Braver
 rbraver at ohww.norman.ok.us

------------------------------------------------------
Mailman-Users mailing list
Mailman-Users at python.org
http://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives:
http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe:
http://mail.python.org/mailman/options/mailman-users/gspivey%40georgefox
.edu

Security Policy:
http://www.python.org/cgi-bin/faqw-mm.py?req=show&amp;file=faq01.027.htp