Re: Splitting attachments into separate emails
On Fri, 10 Oct 2003, Johann Spies wrote:
> I administer 3 email servers which use spamassassin. We are testing
> the service with about 110 users whose email are scanned by SA.
>
> My arrangement with them is to send me either spam that scored too low
> or false positives as attachments with either "spam" or "ham" in the
> Subject-line.
>
> What I want to do now is to exctract those emails from the attachments
> and put them in a maildir which can then be used by other processes to
> feed them so sa-learn.
>
> Now my question: Are you aware of any tools that can do this? An
> example of email that I receive (as Mutt shows the attachments) looks
> like this:
>
> I 2 Apcn, all your relatives can get the sam [message/rfc822, 7bit, 4,2K]
> I 3 ><no description> [text/plain, quoted, iso-8859-1, 2,9K]
> I 4 dichotoaous rlomberg rbcvuijmbpqed [message/rfc822, 7bit, 3,3K]
> I 5 ><no description> [text/plain, quoted, iso-8859-1, 2,0K]
> I 6 Invite your friends to play live poker o [message/rfc822, 7bit, 1,7K]
> I 7 ><no description> [text/plain, quoted, iso-8859-1, 0,4K]
> I 8 Re: Vicodin 71uh [message/rfc822, 7bit, 1,4K]
> I 9 ><no description> [text/plain, quoted, iso-8859-1, 0,3K]
> I10 no more doctor to get your pharmys 8z [message/rfc822, 7bit, 1,6K]
> I11 ><no description> [text/plain, quoted, iso-8859-1, 0,4K]
>
> I want to put items 2,4,6,8 and 10 in the maildir: ~/Mail/spam as
> separate messages.
<snip>
Hi Johann,
First I was confused by your phrase 'send me .. as attachments' beacuse
there are 2 formats that various mailreader use: inline and attachment. So,
you'd have to check for both types and extract them differently. Secondly,
I was not sure if the user would 'reply' or 'forward' the mail to you.
These 4 options can be sorted out with procmail. I also realized that the
from: would be from your network and the to: would be you, also on your
network, so that would differentiate it from other mails using procmail.
Also, you can use a (maybe underused) mail filtering technique: the '+'.
You can ask that the mail be send to : admin+spam@.... or admin+ham@....
and this is easy to filter. Or create a 2 new email addresses. These are
suggestion to figure out which mails are for sa. Now once that is done,
you need to determine what to do with the 4 mail types: inline forward,
attachment forward, inline reply and attachment reply. procmail and/or
perl may be need to do this simple check. Then you send it to the 'extract
spam/ham and feed sa' script.
HTH
-Kev
Reply to: