Topic: whitelisting on sending e-mail

[magwm]

hi Kevin,

i say this helped much! I just told my users they had to reply to false positives, and so they did.. I discovered a few malformed email addresses in the list (with ' and /) but for the rest it seems to work..

it's just that I can't test it as I don't know how to make a false positive..

ciao, Michel

[elmarconi]

<blush> Oops, you're right....

uniq -i would also filter out upper/lowercase writing typo's...

So I would replace:

Code: [Select]

cat userwhitelist.tmp | sort -u > $DB/userwhitelist
with:

Code: [Select]

cat userwhitelist.tmp | sort | uniq -i > $DB/userwhitelist
Other than that it seems OK! Feed it with old qmail logs:

Code: [Select]

cat /var/log/qmail/*.s | tai64nlocal | grep -i "to remote" | awk '{ print $10 }' | sort -u | grep -v `domainname`

[slacker]

just as a possible alternative.. I believe ASSP has auto-whitelisting for sent emails

[Knuddi]

Please pay attention to the fact that if one of you client PCs gets infected via a BOT then all the email addresses it sends to will be whitelisted. Therefore always track the amount of emails sent out and make sure to enable SMTP proxy on your email server.

A smarter way to incorporate whitelisting would be do do this as a plugin to qpsmtpd the same way as SpamAssassin is today.

Rgds,
Jesper

[magwm]

Well I believe Spamassassin is part of Sme isn't it? How would i have to implement such a plugin?

ciao, Michel

[Knuddi]

yes, SpamAssassin is part of SME.

See that is where you have to work All the plugins are located in /usr/share/qpsmtpd/plugins, so here you will have to find one you can start from.

[magwm]

Hello Knuddi,

first of all, let me say that in any case I don't like whitelisting at all.

Actually what I really needed was an easy way to make my users handle the false positives that spamassassin regretfully generated. It must be an easy way, and replying is as easy as it can get..

so maybe it would be more correct to whitelist only mails that get answered and have ***SPAM*** in the subject. but I wouldn't know how to do that.

alternatively it would be possible to make a thisisnotspam@domain.it account and make them forward to it. but i would not know where to go from there.

but. shouldn't bayesian learning learn from outgoing mails and score the messages so that mails that get answered would pass even if they weren't in the whitelist?

Anyway thanks for the info, however I wouldn't be able to make a new plugin. and moreover, if we were infected by a virus it wouls use email addresses from our address books wouldn't it?

well now back to my users.. ciaociao, Michel