... sorry for not being able to follow-up on the main thread, but my client at home is
part of a blocked DUL network ;(
On Mar 9, 2004, at 2:58 PM, Todd Lyons wrote:
>Which of the following is better? (I do #1 in a script)
>1) While reading mail, save spam to a file. Run razor-check to see if
>it's a spam, if it is then report it with razor-report.
>2) While reading mail, save spam to a file. Just dump the file to
>razor-report.
>The reason I ask is because if I save 8 spams to a mbox file, and pipe
t>o razor-check, the exit code of razor-check is only for the first
s>pam. If the first email is already known as spam, it exits with the
">known spam" errorlevel (at which point my script deletes the file so
>NONE of the spams get submitted).
>So my question is how Razor works, does it count against me if I submit
>a spam with razor-report that is already a known spam? Does it count
>for me since I'm "verifying" someone else's submission? Does it count
>neither for no
r against me since it's already known?
>If it doesn't count against me or if it counts positively for me, I'll
>just get rid of the razor-check in my script :-/
>Regards... Todd
This begs additional questions, actually:
1. I have a honeypot, which puts on hold all emails being attempted to be relayed
through, and which has a local user account, also - never used - which happens to
receive emails once in a while. I "blindly" run a razor-report on all emails received
by this local account, based on the assumed definition/functionality of honeypot
(actually - when talking about user email - honeytoken) - i.e. everything "touching"
it is "illegal" - never thought of running it through "razor-check" - is this wrong?!?
2. The emails which are attempted to be relayed through this honeypot are in the
thousands a day. I only analyze patterns for those, but never thought of reporting
them - would it be of any help to run them through razor-report?
3. If the answer to "2" above is
"yes", then I could combine "1" with it, and then - next question - does anybody know
if I could build some sort of transport or filter in postfix (as this is what I am
using), to have all incoming emails run through razor-report, before either putting
them on hold, or delivering them to the local account? The way I achieve "1" and "2"
right now is via:
smtpd_client_restrictions =
check_recipient_access hash:/etc/postfix/client_access, <-- here is local
user is defined
static:HOLD <-- here is how I held the relay attempts
NOTE: I would be interested in an answer to "3", even regardless of "1", or "2",
actually ...
TIA,
Stef
-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Razor-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/razor-users
