Re: Procmail question/puzzle

[Michelle Konzack]

Hello Paul E Condon,

Am 2011-04-24 14:13:26, hacktest Du folgendes herunter:
> ## 'unreadable' mail
> :0:
> * 1^0 
> ^\/Subject:.*=\?(.*big5|iso-2022-jp|ISO-2022-KR|euc-kr|gb2312|ks_c_5601-1987|windows-1251|windows-1256)\?
> * 1^0 
> ^\/Content-Type:.*charset="(.*big5|iso-2022-jp|ISO-2022-KR|euc-kr|gb2312|ks_c_5601-1987|windows-1251|windows-1256)
> unreadable_

To let this work, you have to give  them  a  NEGATIVE  score  first  and
escape the "-" like

:0:
* -1^0
*  1^1 
^Subject:.*=\?(.*big5|iso\-2022-jp|ISO\-2022-KR|euc\-kr|gb2312|ks_c_5601\-1987|windows\-1251|windows\-1256)\?
*  1^1 
^Content-Type:.*charset="(.*big5|iso-2022\-jp|ISO\-2022-KR|euc\-kr|gb2312|ks_c_5601\-1987|windows\-1251|windows\-1256)
unreadable_

> ## bogofilter spam filtering:
> :0fw
> | /usr/bin/bogofilter -eplu

But "bogofilter" mark the message slike spamassassin...  You have now to
filter out thie crap.  Since I do not know bogofilter and the header  it
sets, I can not help you here.  Maybe you can send the full headers of a
scanned SPAM message here?

Thanks, Greetings and nice Day/Evening
Michelle Konzack

-- 
# Debian GNU/Linux Consultant ##
   Development of Intranet and Embedded Systems with Debian GNU/Linux

itsystems@tdnet France EURL   itsystems@tdnet UG (limited liability)
Owner Michelle KonzackOwner Michelle Konzack

Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France   77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix

  
 

Jabber linux4miche...@jabber.ccc.de
ICQ#328449886

Linux-User #280138 with the Linux Counter, http://counter.li.org/


signature.pgp
Description: Digital signature

Re: procmail question

[kmark]

>
> So tell you what: show us the rule that you've created to try to perform
> the above filtering and tell us how you know it's not working.  Then
> maybe we can tell you the flaw in your approach.
>
> "Teach a man to fish ..."
> --
> monique
>
Since I'm learning procmail, my first procmail rules is to create a
'backup copy' so in case any rule puts it in the wrong place or deletes
it, I have a spare copy.
-K
--
PATH=/usr/local/bin:/usr/bin:/bin
MAILDIR=$HOME/mail  #you'd better make sure it exists
DEFAULT=$HOME/mbox   #completely optional
LOGFILE=$MAILDIR/from   #recommended
# make backup
:0 c
$MAILDIR/backup
...
more rules here


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Monique Y. Herman]

On Sun, 28 Sep 2003 23:31:21 +0200, LeVA <[EMAIL PROTECTED]> penned:
> Hello!
> 
> Here is a bit harder question :).
> I have a few email addresses, and I want to ensure that I get just those 
> messages which were posted to me.
> So I want a rule (or more, I don't know) which filters all mails, if 
> they has a To or Cc or Bcc line in the header, which is followed by one 
> of my email addressess.
> 
> Hope it is possible to do with procmail :)
> 
> Thanks for the help!
> 

I'm 99.9% sure you can't filter on bcc: on the receiving end.

If you could, though, the example from the previous post, along with the
pointers to the documentation (and you did read the documentation,
right?), ought to be enough to give you an idea how to do it.

So tell you what: show us the rule that you've created to try to perform
the above filtering and tell us how you know it's not working.  Then
maybe we can tell you the flaw in your approach.

"Teach a man to fish ..."
-- 
monique


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Michael Schulz]

leva,

On Sun, 2003-09-28 at 23:31, LeVA wrote:

> I have a few email addresses, and I want to ensure that I get just those 
> messages which were posted to me.
> So I want a rule (or more, I don't know) which filters all mails, if 
> they has a To or Cc or Bcc line in the header, which is followed by one 
> of my email addressess.

as I said before "man procmailex" gives you some examples for that. 
You can use regular expressions in .procmailrc. 

bye
mike


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Michael Schulz]

On Sun, 2003-09-28 at 20:31, Monique Y. Herman wrote:

> Just to clarify (because I read it as syntax at first)
> 
> In the case of deletion, FILENAME would be /dev/null
> In the case of wanting to send it somewhere other than your normal
> mailbox, FILENAME would be ~/mail/mysupercoolfilterbox or something.
yes, sorry if I was unspecific .. don't mix it up :)

bye
mike


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Monique Y. Herman]

On Sun, 28 Sep 2003 20:26:40 +0200, Michael Schulz <[EMAIL PROTECTED]> penned:
> Hi,
> 
> On Sun, 2003-09-28 at 20:00, LeVA wrote:
>> Hello!
>> 
>> How can I make this with procmail (what should I write to the 
>> ~/.procmailrc file):
>> 
>> If an email has a given text in it's subject, delete the mail,
>> if another email has aonther given text in its subject write it to 
>> another file than the user's mail spool file.
> 
> man procmailex gives you some good examples.
> 
>:0
> ^Subject:.YOUR_REGEXP_GOES_HERE
> FILENAME (for deletion: /dev/null)
> 
> hth
> mike
> 

Just to clarify (because I read it as syntax at first)

In the case of deletion, FILENAME would be /dev/null
In the case of wanting to send it somewhere other than your normal
mailbox, FILENAME would be ~/mail/mysupercoolfilterbox or something.

-- 
monique


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Michael Schulz]

Hi,

On Sun, 2003-09-28 at 20:00, LeVA wrote:
> Hello!
> 
> How can I make this with procmail (what should I write to the 
> ~/.procmailrc file):
> 
> If an email has a given text in it's subject, delete the mail,
> if another email has aonther given text in its subject write it to 
> another file than the user's mail spool file.

man procmailex gives you some good examples.

:0
^Subject:.YOUR_REGEXP_GOES_HERE
FILENAME (for deletion: /dev/null)

hth
mike



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Procmail question

[Tony Green]

On Mon, 2002-02-25 at 10:51, Corey Halpin wrote:
>   Does anybody have a procmail script to trim html out of email?
>   such that all the email I get is only text-plain?


> :0
* ^Content-Type: text/html
{

:0 bfW:
| (echo "[html stripped]"; lynx -dump -force_html -stdin)

:0 ahfw:
| formail -i"Content-Type: text/plain"
}


You need lynx installed, but that works for me
-- 
Tony Green <[EMAIL PROTECTED]>
Tel   :   +61-(0)2-9500-9996
Mobile:   +61-(0)4-2521-9996
GnuPG Key :  1024D/B5657C8B
Key fingerprint = 9ED8 59CC C161 B857 462E  51E6 7DFB 465B B565 7C8B

Re: Procmail Question

[Corey Halpin]

  Nevermind.
  I found formail -i.

  In case anyone's interested, here's a recipe that I find handy for 
debian-user:

:0
* ^x-mailing-list.*debian-user
| formail -i "reply-to: debian-user@lists.debian.org" \
| rcvstore +lists/debian/user

>   Does anyone know of a way in procmail to to replace one header with 
> another? 
>  (ie, replace the contents of the From header with the contents of the 
> List-ID 
> header?)

crh
-- 
Corey R. Halpin (http://www.cae.wisc.edu/~halpin/ )
Student of Electrical Engineering and Computer Sciences
University of Wisconsin - Madison

Re: Procmail question (was Re: Virus incident)

[Craig Dickson]

Richard Cobbe wrote:

> I understood all of the rules that were posted except for one thing.
> Just out of curiosity, what does the 1^0 above do?  The procmail
> manpages weren't much help.

Try "man procmailsc" and read up on scoring.

Craig

Re: Procmail question-

[Mario Olimpio de Menezes]

On Mon, 8 May 2000, brian moore wrote:

> 
> true.  procmail ain't ideal for this, but it's the best tool around
> without loading perl on every MIME'd mail.
> 


how do you put this in a exim.conf file? 
do you use it as your .procmailrc or a system-wide one?


thanks,


> > :0
> > * < 5
> > {
> > 
> > :0 B:
> > * .*(name=.*\.vbs|[EMAIL PROTECTED]).*
> > /share/etc/ILOVEYOU
> > }
> 
> I find this one is a bit safer (though slightly more complex) -- note
> that your filter will match your mail as well as this one.
> 
> :0
> *^Content-type: (multipart/mixed|application/octet-stream)
> {
> :0 B
> *^Content-Disposition: (attachment|inline);
> *filename=".*\.(vbs|wsf)"
> {
>:0 fbw
>|/usr/bin/sed -e 's/\([nN][aA][mM][eE]=".*\.[vV][bB][sS]\)"/\1.txt"/' \
>  -e 's/\([nN][aA][mM][eE]=".*\.[wW][sS][fF]\)"/\1.txt"/'
> 
> }
> }
> 
> This will rename 'foo.vbs' to 'foo.vbs.txt', which breaks the
> auto-execution.  It's relatively lightweight, so you can leave it in
> (sadly, I still pick up a couple of happy99's a day still).
> 
> -- 
> Brian Moore   | Of course vi is God's editor.
>   Sysadmin, C/Perl Hacker | If He used Emacs, He'd still be waiting
>   Usenet Vandal   |  for it to load on the seventh day.
>   Netscum, Bane of Elves.
> 
> 


[]s
Mario O.de Menezes"Many are the plans in a man's heart, but
IPEN-CNEN/SP is the Lord's purpose that prevails"
http://curiango.ipen.br/~mario Prov. 19.21
   http://www.revistalinux.com.br

Re: Procmail question-

[brian moore]

On Mon, May 08, 2000 at 02:39:47PM -0800, Adam Shand wrote:
> 
> > Well there is a problem with this rule, it searches the entire email for
> > VBS.  All i want it to search for is the attachment of a file name with
> > the extension of .vbs Okay can this be done?  Im sure it can, just i can
> > not find any info on how to make it do this.  Can someone purdy please
> > help me :)
> 
> procmail doesn't understand mime so there is no way to tell it "delete
> attachments which end with .vbs".  however what you can do is use a rule
> like the below one.  we've been using this rule since the virus came out and
> it's been working pretty well (caught almost 500 copies of it).

true.  procmail ain't ideal for this, but it's the best tool around
without loading perl on every MIME'd mail.

> :0
> * < 5
> {
> 
> :0 B:
> * .*(name=.*\.vbs|[EMAIL PROTECTED]).*
> /share/etc/ILOVEYOU
> }

I find this one is a bit safer (though slightly more complex) -- note
that your filter will match your mail as well as this one.

:0
*^Content-type: (multipart/mixed|application/octet-stream)
{
:0 B
*^Content-Disposition: (attachment|inline);
*filename=".*\.(vbs|wsf)"
{
   :0 fbw
   |/usr/bin/sed -e 's/\([nN][aA][mM][eE]=".*\.[vV][bB][sS]\)"/\1.txt"/' \
 -e 's/\([nN][aA][mM][eE]=".*\.[wW][sS][fF]\)"/\1.txt"/'

}
}

This will rename 'foo.vbs' to 'foo.vbs.txt', which breaks the
auto-execution.  It's relatively lightweight, so you can leave it in
(sadly, I still pick up a couple of happy99's a day still).

-- 
Brian Moore   | Of course vi is God's editor.
  Sysadmin, C/Perl Hacker | If He used Emacs, He'd still be waiting
  Usenet Vandal   |  for it to load on the seventh day.
  Netscum, Bane of Elves.

Re: Procmail question-

[Adam Shand]

> Well there is a problem with this rule, it searches the entire email for
> VBS.  All i want it to search for is the attachment of a file name with
> the extension of .vbs Okay can this be done?  Im sure it can, just i can
> not find any info on how to make it do this.  Can someone purdy please
> help me :)

procmail doesn't understand mime so there is no way to tell it "delete
attachments which end with .vbs".  however what you can do is use a rule
like the below one.  we've been using this rule since the virus came out and
it's been working pretty well (caught almost 500 copies of it).


PATH=/bin:/usr/bin:/usr/local/bin
LOGFILE=/share/etc/procmail.log

:0:
* ^Subject: ILOVEYOU
/share/etc/ILOVEYOU

:0:
* .*name=.*\.vbs.*
/share/etc/ILOVEYOU

:0
* < 5
{

:0 B:
* .*(name=.*\.vbs|[EMAIL PROTECTED]).*
/share/etc/ILOVEYOU
}


if you make /share/etc/ILOVEYOU a directory procmail will deliver each
message to a seperate file in that directory.  the "< 5" means that for
messages which fail the above header check it only scans the first 50k of
the body for matching text.

adam.

Re: Procmail question-

[Oswald Buddenhagen]

> Well there is a problem with this rule, it searches the entire email for
> VBS.  All i want it to search for is the attachment of a file name with the
> extension of .vbs  Okay can this be done?   Im sure it can, just i can not
> find any info on how to make it do this.  Can someone purdy please help me
> :)
> 
afaik, procmail is not able to understand mime (the format, in
which attachements are sent).
you would have to pipe your mails through a script, which uses some
mime-tools (eg, mime-construct, which also has a mimedecode).
i didn't try anything in that direction, so this is only an idea.

-- 
Hi! I'm a .signature virus! Copy me into your ~/.signature, please!
--
Linux - the last service pack you'll ever need.

Re: procmail question (was: looking for a mail client)

[Phillip Deackes]

Sorry, I can't quote since I've deleted the original posting.

All I used to do when I used Procmail was add a line to my .fetchmailrc
so it looked like this:

poll pop.ukgateway.net
protocol pop3
username gsmh
password 
mda "/usr/bin/procmail -d gsmh"

The last line specifies the Mail Delivery Agent. If you simply want to
hand all incoming mail to, say Exim, you can leave this line off and
exim will automatically receive the mail.

Your .procmailrc will contain rules to sort messages into folders.

As an alternative to 'username whatever' you can have 'username whatever
is someothername on this system' which makes things a lot easier if your
username on your Linux box is not the same as your email name.


--
Phillip Deackes
Debian Linux (Potato) 

Re: procmail question (was: looking for a mail client)

[Mark Brown]

On Mon, Aug 09, 1999 at 10:31:51PM +0200, Peter Palfrader aka Weasel wrote:
> I thank everybody for their great help.

> Is it possible to have it run automatically when new mail arrives
> without the need for every user to have his .forward set to
> |/usr/bin/procmail so only having a .procmailrc fur users that want it?

Most MTAs support the use of an external delivery agent - a program used
to perform the actual addition of the mail to the recipient mailbox.  If
you make procmail this program then the right thing should happen.

Unfortunately I don't have any examples handy...

-- 
Mark Brown  mailto:[EMAIL PROTECTED]   (Trying to avoid grumpiness)
http://www.tardis.ed.ac.uk/~broonie/
EUFShttp://www.eusa.ed.ac.uk/societies/filmsoc/


pgpP11xOgxQEE.pgp
Description: PGP signature

Re: procmail question (was: looking for a mail client)

[Lex Chive]

On Mon, Aug 09, 1999 at 10:31:51PM +0200, Peter Palfrader aka Weasel wrote:
> 
> Is it possible to have it run automatically when new mail arrives
> without the need for every user to have his .forward set to
> |/usr/bin/procmail so only having a .procmailrc fur users that want it?
> 
Of course, you just need to set up your mta to use procmail. The exact way to
do it vary of course. That should be given in either the mta's doc or procmail
doc.

-Lex


pgpVVWF8LX0QK.pgp
Description: PGP signature

Re: procmail question (was: looking for a mail client)

[Michael Stenner]

On Mon, Aug 09, 1999 at 10:31:51PM +0200, Peter Palfrader aka Weasel wrote:
> I think I will go for mutt since the PGP stuff works really fine now.
> However, I have some questions regarding procmail.

You have chosen wisely.  I switched recently and can't imagine using
anything else.

> Is it possible to have it run automatically when new mail arrives
> without the need for every user to have his .forward set to
> |/usr/bin/procmail so only having a .procmailrc fur users that want it?

The first paragraph of the procmail manpage says:

"Procmail should be invoked automatically over the .forward file
mechanism as soon as mail arrives.  Alternatively, when installed by a
system administrator."

It looks like you can set it up to automatically run for every mail
that arrives (regardless of what people have or have not done to their
.forward files) and just not DO anything unless they have a
.procmailrc.  Is this what you were asking?

-Michael

-- 
  Michael Stenner   Office Phone: 919-660-2513
  Duke University, Dept. of Physics   [EMAIL PROTECTED]
  Box 90305, Durham N.C. 27708-0305

Re: procmail question

[Remco Blaakmeer]

On Tue, 14 Apr 1998, Art Lemasters wrote:

> > Hi all there!
> > I just set-up my .procmailrc (Many thanks to Oliver Elphick). But I have 
> > big mailbox (/var/spool/mail/) I want to process w. procmail. Can anybody 
> > tell me how?
> 
>  Try the procmail and procmailex (examples) man or info (better yet)
> pages.  They are some of the better-written documents I've seen!  Oh...
> and read the /usr/doc/procmail directory (.gz files with the "zless"
> command) first!  The examples in the procmailex page should be most
> helpful, then more specific questions will be easier to get answers
> for.  You'll do fine! 

A tip for people who are still using zless:

If you have already upgraded your system to hamm, place this line in your
.bash_profile:

eval $(/usr/bin/lesspipe)

/usr/bin/lesspipe is a filter for less that decompresses .gz files and
gives you useful information about a lot of other file formats (among
which .tar and .deb). Look at the script itself for details.

If you have Debian 1.3.X or earlier I can send you this script. It is not
large and quite useful. I don't know which version of less is required,
but I know it works with the less package in Debian 1.3.

Remco


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Santiago Vila Doncel]

-BEGIN PGP SIGNED MESSAGE-

On Wed, 15 Apr 1998, Vaclav Hula wrote:

> I just set-up my .procmailrc (Many thanks to Oliver Elphick). But I
> have big mailbox (/var/spool/mail/) I want to process w. procmail. Can
> anybody tell me how?

What you need is probably:

cat mbox | formail -s procmail

[ I think I will add this to the "QuickStart" file in hamm ].

Thanks.

-BEGIN PGP SIGNATURE-
Version: 2.6.3ia
Charset: latin1

iQCVAgUBNTSZQCqK7IlOjMLFAQEZ9AQAjjYFIOKLOxRaxQ3b5SyluDNi+8SYQRRZ
TGBhUaxVyv+eNqLIVE+Y5aSOk82G891YJaCBUadQQjspqmes7wtn7X5UtEuBHRik
UrJSbvgSzoxZaJvvhUvlg3EZydnz9lnqIpT1PVpsMuoRjVxfEK773imvL/Nc/WQb
ez1pj2fZEjc=
=Xe2E
-END PGP SIGNATURE-


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Carl Mummert]

Art Lemasters wrote:
>  Try the procmail and procmailex (examples) man or info (better yet)
> pages.  They are some of the better-written documents I've seen!  Oh...
> and read the /usr/doc/procmail directory (.gz files with the "zless"
> command) first!  The examples in the procmailex page should be most
> helpful, then more specific questions will be easier to get answers
> for.  You'll do fine! 

I think his question was "I have mail I already received, how do I get it
filtered?"

The answer: formail, a program that comes with procmail.  Basicly, you
will move oyur /var/spool/mail/user file to a temp file, rm the
/var/spool/mial/user, and then cat the temp file throuch formail, which
will remail it all.

Look at formail(1) for the command line options.

Carl

-- 
[EMAIL PROTECTED]
  
The sun's not eternal
   That's why there's the blues...
 -- Ginsburg


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: procmail question

[Art Lemasters]

> Hi all there!
> I just set-up my .procmailrc (Many thanks to Oliver Elphick). But I have big 
> mailbox (/var/spool/mail/) I want to process w. procmail. Can anybody tell me 
> how?

 Try the procmail and procmailex (examples) man or info (better yet)
pages.  They are some of the better-written documents I've seen!  Oh...
and read the /usr/doc/procmail directory (.gz files with the "zless"
command) first!  The examples in the procmailex page should be most
helpful, then more specific questions will be easier to get answers
for.  You'll do fine! 

Art

> 
> Thanks.
> Ax
> -- 
> Vaclav Hula
> [EMAIL PROTECTED]
> http://atrey.karlin.mff.cuni.cz/~ax
> 
> 
> --
> To UNSUBSCRIBE, email to [EMAIL PROTECTED]
> with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
> 
> 


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]