mail filtering issue

[Trey Nolen]

We've got a weird issue going on and I think it is tied to the Sqwebmail
Maildrop filtering rules. I have had a few people who have mail filtering
turned on get 10's of thousands of messages overnight. They are all the same
message, and *SHOULD* be matching one of the rules (although the rule is not
taking effect). When spam detection is turned off in Qmailadmin (thereby
stopping Maildrop), they messages stop. We are using Qmailadmin 1.2.3 with
Vpopmail 5.4.10. Enabling spam detection puts the following line in our
.qmail files:
|preline /usr/local/bin/maildrop /etc/mailfilter


Our /etc/mailfilter file is:
VHOME=`/home/vpopmail/bin/vuserinfo -d $EXT@$HOST`
VPOP="| /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox"

exception {
include $VHOME/.mailfilter
}

exception {
to "$VHOME/Maildir/."
}

to "$VPOP"


We are using Spamassassin to tag messages with *****SPAM***** on the subject
line and are instructing users to use Sqwebmail to generate rules to
automatically move those to a Junk folder or delete the messages. To
delete the messages, we have users forward them to a special email address
which goes to null.
The rule being generated by Sqwebmail and put in the .mailfilter file
follows:

#MFMAILDROP=2
#
# DO NOT EDIT THIS FILE. This is an automatically generated filter.

FROM='***@mail'
import SENDER
if ($SENDER eq "")
{
SENDER=$FROM
}

##Op:contains
##Header:From
##Value:***@3dmania.it
##Folder:!***@internetpro.net
##From:
##PlainString
##Name:spam2


if ((/^From:.*lqarjvgwdk\@3dmania\.it/))
{
to "| $SENDMAIL -f " '"$SENDER"' " ***@internetpro.net"
}

##Op:startswith
##Header:subject
##Value:*****SPAM*****
##Folder:!***@internetpro.net
##From:
##PlainString
##Name:spam


if ((/^subject: *\*\*\*\*\*SPAM\*\*\*\*\*/))
{
to "| $SENDMAIL -f " '"$SENDER"' " ***@internetpro.net"
}

to "$VHOME/Maildir/."





Most of the time, these rules seem to work OK, but there have been a few
instances where the problem mentioned above happens. It often results in
delivery of 1 to 4 GB of mail. As I stated before, turning off the mail
filter seems to stop it, so I was wondering if there is any way that the
above rules could somehow be perpetuating the delivery of certain emails.
The emails that are being repeatedly delivered are tagged with
*****SPAM***** in the subject (and the subject STARTS WITH that tag), so
these messages should be getting forwarded to ***@internetpro.net.
Any help would be appreciated.

Trey Nolen

[Kurt Bigler]

This list is dead: the new list is courier-***@lists.sourceforge.net
http://sourceforge.net/mail/?group_id=5404

Post by Trey Nolen
We've got a weird issue going on and I think it is tied to the Sqwebmail
Maildrop filtering rules. I have had a few people who have mail filtering
turned on get 10's of thousands of messages overnight. They are all the same
message, and *SHOULD* be matching one of the rules (although the rule is not
taking effect). When spam detection is turned off in Qmailadmin (thereby
stopping Maildrop), they messages stop. We are using Qmailadmin 1.2.3 with
Vpopmail 5.4.10. Enabling spam detection puts the following line in our
|preline /usr/local/bin/maildrop /etc/mailfilter
VPOP="| /home/vpopmail/bin/vdelivermail '' bounce-no-mailbox"
exception {
include $VHOME/.mailfilter
}
exception {
to "$VHOME/Maildir/."
}
to "$VPOP"
We are using Spamassassin to tag messages with *****SPAM***** on the subject
line and are instructing users to use Sqwebmail to generate rules to
automatically move those to a Junk folder or delete the messages. To
delete the messages, we have users forward them to a special email address
which goes to null.
The rule being generated by Sqwebmail and put in the .mailfilter file
#MFMAILDROP=2
#
# DO NOT EDIT THIS FILE. This is an automatically generated filter.
import SENDER
if ($SENDER eq "")
{
SENDER=$FROM
}
##Op:contains
##Header:From
##PlainString
##Name:spam2
{
}
##Op:startswith
##Header:subject
##Value:*****SPAM*****
##PlainString
##Name:spam
if ((/^subject: *\*\*\*\*\*SPAM\*\*\*\*\*/))
{
}
to "$VHOME/Maildir/."
Most of the time, these rules seem to work OK, but there have been a few
instances where the problem mentioned above happens. It often results in
delivery of 1 to 4 GB of mail. As I stated before, turning off the mail
filter seems to stop it, so I was wondering if there is any way that the
above rules could somehow be perpetuating the delivery of certain emails.
The emails that are being repeatedly delivered are tagged with
*****SPAM***** in the subject (and the subject STARTS WITH that tag), so
Any help would be appreciated.
Trey Nolen