Moving large messages to spam folder

[Chris]

Anything bigger than 100k has the subject appended as below. Lately
I've been getting messages from yahoo accounts that run about 630k give
or take that I know are spam and I'd like to have them moved with
procmail to my spam folder automatically. I found the 2nd formail
recipe below by doing some googling and put it into my .procmailrc.
Instead of using the sender IP I've been putting the CIDR into the
badips file - 98.136.192.0/18 for example. I don't want to filter out
all of yahoo because I have a few yahoo mailing lists I'm on. Does this
make sense or is there a much easier way to do this?

:0 fh w
* > 100000
* ^Subject:\/.*
| formail -I "Subject: {* -BIG- *} $MATCH"

:0
* ? formail -x"From:" -x"Sender:" \
    -x"Reply-To:" -x"Return-Path:" \
    | egrep -is -f /home/chris/badips
$JUNKMAIL

Thanks for any assistance
Chris

[@lbutlr]

Post by Chris
Anything bigger than 100k has the subject appended as below. Lately
I've been getting messages from yahoo accounts that run about 630k give
or take that I know are spam and I'd like to have them moved with
procmail to my spam folder automatically. I found the 2nd formail
recipe below by doing some googling and put it into my .procmailrc.
Instead of using the sender IP I've been putting the CIDR into the
badips file - 98.136.192.0/18 for example. I don't want to filter out
all of yahoo because I have a few yahoo mailing lists I'm on. Does this
make sense or is there a much easier way to do this?
:0 fh w
* > 100000
* ^Subject:\/.*
| formail -I "Subject: {* -BIG- *} $MATCH"
:0
* ? formail -x"From:" -x"Sender:" \
-x"Reply-To:" -x"Return-Path:" \
| egrep -is -f /home/chris/badips
$JUNKMAIL

I would do the following:

:0 fh w
* > 100000
{
:0fw # Need to wait for filter to complete
* ^Subject:\/.*
| formail -I "Subject: {* -BIG- *} $MATCH"

:0
* ? formail -x"From:" -x"Sender:" \
-x"Reply-To:" -x"Return-Path:" \
| egrep -is -f /home/chris/badips
$JUNKMAIL
}

(This assumes the formail works as you expect)

This way the only messages that are checked for badips are ones that are larger than 100,000 bytes.

Personally, Yahoo is dead to me now. All messages are rejected with a message about pathological lack of security. It forced two of my family members to stop using Yahoo as they could no longer email the rest of the family that is on my mail server. :)

I wouldn’t trust any email from yahoo, but that’s just me.

[Chris]

Post by Chris

Post by Chris
Anything bigger than 100k has the subject appended as below. Lately
I've been getting messages from yahoo accounts that run about 630k give
or take that I know are spam and I'd like to have them moved with
procmail to my spam folder automatically. I found the 2nd formail
recipe below by doing some googling and put it into my .procmailrc.
Instead of using the sender IP I've been putting the CIDR into the
badips file - 98.136.192.0/18 for example. I don't want to filter out
all of yahoo because I have a few yahoo mailing lists I'm on. Does this
make sense or is there a much easier way to do this?
:0 fh w
* > 100000
* ^Subject:\/.*

Post by Chris
formail -I "Subject: {* -BIG- *} $MATCH"

:0
* ? formail -x"From:" -x"Sender:" \
    -x"Reply-To:" -x"Return-Path:" \
    | egrep -is -f /home/chris/badips
$JUNKMAIL

:0 fh w
* > 100000
{
  :0fw # Need to wait for filter to complete
  * ^Subject:\/.*
  | formail -I "Subject: {* -BIG- *} $MATCH"
  :0
  * ? formail -x"From:" -x"Sender:" \
    -x"Reply-To:" -x"Return-Path:" \
    | egrep -is -f /home/chris/badips
    $JUNKMAIL
}
(This assumes the formail works as you expect)
This way the only messages that are checked for badips are ones that
are larger than 100,000 bytes.
Personally, Yahoo is dead to me now. All messages are rejected with a
message about pathological lack of security. It forced two of my
family members to stop using Yahoo as they could no longer email the
rest of the family that is on my mail server. :)
I wouldn’t trust any email from yahoo, but that’s just me.

Actually I thought of a better way:

:0 fh w
* > 625000
* ^From:.*@yahoo.com
$JUNKMAIL

and as I leave any yahoo lists I'm on I can remove the size modifier
from the recipe and just leave it as from yahoo.

[@lbutlr]

Post by Chris
:0 fh w
* > 625000
$JUNKMAIL
and as I leave any yahoo lists I'm on I can remove the size modifier
from the recipe and just leave it as from yahoo.

Are you honestly getting messages that large from a mailing list? That’s more than 10 times the size of the largest mailing list message I could find on my machine (57K) in a few seconds of searching.

[Chris]

Post by @lbutlr

Post by Chris
:0 fh w
* > 625000
$JUNKMAIL
and as I leave any yahoo lists I'm on I can remove the size
modifier
from the recipe and just leave it as from yahoo.

Are you honestly getting messages that large from a mailing list?
That’s more than 10 times the size of the largest mailing list
message I could find on my machine (57K) in a few seconds of
searching.

No, these aren't mailing list. Coming in with subjects like

{* -BIG- *}  Discover (munged)  Cell (munged)  Phones & Plans for
(munged) Seniors

With from addresses such as
Cell(munged)Phones(munged)For(munged)SeniorsSite <daviderist-at-yahoo.c
om>

That is 632k which is the norm for these. Hopefully all the (munged)
will let this through. I really don't want to run them through SA
because of the size. I've noticed that I'm not getting anything from
yahoo groups anymore so I can safely just throw everything from yahoo
now into $JUNKMAIL.

[@lbutlr]

Post by Chris

Post by @lbutlr

Post by Chris
:0 fh w
* > 625000
$JUNKMAIL
and as I leave any yahoo lists I'm on I can remove the size
modifier
from the recipe and just leave it as from yahoo.

Are you honestly getting messages that large from a mailing list?
That’s more than 10 times the size of the largest mailing list
message I could find on my machine (57K) in a few seconds of
searching.

No, these aren't mailing list. Coming in with subjects like
{* -BIG- *} Discover (munged) Cell (munged) Phones & Plans for
(munged) Seniors

Then i don't understand why you are setting the threshold so high. I would probably set it at 100K or so if I didn't simply trash all messages from yahoo.com at the mail server.

helo_checks.pcre:
/.*\yahoo\.com/ 550 Yahoo is not allowed here, use gmail or someone who hasn't leaked over a billion passwords

And yes, I know that will trap anything coming from any address with "yahoo.com" in it, anywhere. That is the point.

Post by Chris
That is 632k which is the norm for these. Hopefully all the (munged)
will let this through. I really don't want to run them through SA
because of the size.

SA defaults (or used to) to not processing any message over 256K.

[Chris]

Post by @lbutlr
 
Then i don't understand why you are setting the threshold so high. I
would probably set it at 100K or so if I didn't simply trash all
messages from yahoo.com at the mail server.
/.*\yahoo\.com/ 550 Yahoo is not allowed here, use gmail or someone
who hasn't leaked over a billion passwords
And yes, I know that will trap anything coming from any address with
"yahoo.com" in it, anywhere. That is the point.
SA defaults (or used to) to not processing any message over 256K.

I've now got all of @yahoo going direct to my spam folder.