[CentOS] filter unwanted email

[Robert Heller]

At Thu, 3 Feb 2011 10:38:31 -0500 CentOS mailing list <centos at centos.org> wrote:

> 
> 
> 
> I am new to CentOS. How do I set a rule to so that any email coming from @
> linkedin.com (and other abused locations), going to an application RT (setup
> on the system), will get rejected or dropped silently.

Install spamassassin (yum install spamassassin).

Create a special user account called 'rtspam'.  In this account's home
directory create a directory .spamassassin, and copy
/usr/share/spamassassin/user_prefs.template into this directroy, naming
it user_prefs.

Create a file named .procmailrc, that looks something like this:

MAILDIR=/home/rtspam/Mail      #you'd better make sure it exists
DEFAULT=$ORGMAIL   #completely optional
LOGFILE=$MAILDIR/from   #recommended
METAMAIL_TMPDIR=$MAILDIR/Attachments
MAILCAPS=$HOME/.mailcap.pr
KEYIGNHEADS=Content-Type:Content-Transfer-Encoding:Content-Transfer-Encoding:Content-Disposition:Content-Id


:0fw
| /usr/bin/spamassassin -p /home/rtspam/.spamassassin/user_prefs

# catch anything tagged by spamassassin as spam
:0:
*^X-Spam-Warning: This message may be SPAM.*
spam/.

# catch anything with a spam score of 5 or more
:0:
*^X-Spam-Level: \*\*\*\*\*.*
spam/.

:0 c
backup/.

:0 ic
| cd /home/rtspam/Mail/backup && rm -f dummy `ls -t * | sed -e 1,32d`

:0 ic
| cd /home/rtspam/Mail/spam && rm -f dummy `ls -t * | sed -e 1,200d`


# Special aliases -- will go to RT once it is set up.

:0
* ^TOrt@
|/var/www/rt3/bin/rt-mailgate --queue general --action correspond --url http://rt.deepsoft.com:8080/

:0
* ^TOrt-comment@
|/var/www/rt3/bin/rt-mailgate --queue general --action comment --url http://rt.deepsoft.com:8080/

#Billing and sales

:0
* ^TObilling@
|/var/www/rt3/bin/rt-mailgate --queue sales --action correspond --url http://rt.deepsoft.com:8080/

:0
* ^TOwholesale@
|/var/www/rt3/bin/rt-mailgate --queue sales --action correspond --url http://rt.deepsoft.com:8080/

:0
* ^TOpromos@
|/var/www/rt3/bin/rt-mailgate --queue sales --action correspond --url http://rt.deepsoft.com:8080/

:0
* ^TOsales@
|/var/www/rt3/bin/rt-mailgate --queue sales --action correspond --url http://rt.deepsoft.com:8080/

etc...

End the file with:

:0
* ^FROM_MAILER
! heller at deepsoft.com

:0
* ^From:.*MAILER-DAEMON
! heller at deepsoft.com

:0
|/var/www/rt3/bin/rt-mailgate --queue general --action correspond --url http://rt.deepsoft.com:8080/


(change the ^TO patterns, the path to rt-mailgate, the --queue and --url
options, etc. to suit your configuration.)

In your /etc/aliases set up your RT addresses like this:

rt: rtspam
rt-comment: rtspam
billing: rtspam
wholesale: rtspam
promos: rtspam
sales: rtspam

etc.

(Again change the names to suit your configuration.)

You can then add whitelist_from and blacklist_from addresses to
~rtspam/.spamassassin/user_prefs, as well as any special SpamAssassin
rules you need.  This is what I use and it works quite well.  You will
want to check the spam and backup mail folders from time to time to
check for false positives (in the spam mail folder) and spam leaks (in
the backup mail folder) and adjust things as needed.


-- 
Robert Heller             -- 978-544-6933 / heller at deepsoft.com
Deepwoods Software        -- http://www.deepsoft.com/
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments