.procmailrc

   1 #
   2 # User configuration file for procmail
   3 #
   4
   5 #
   6 # SET VARIABLES
   7
   8 # Internal Variables
   9
  10 SHELL=/bin/sh               #Shell used to run procmail.  Be sure this points to
  11                             #your system's copy of sh.  DO NOT substitute a
  12                             #different shell unless you really know Unix
  13
  14 LINEBUF=4096                #Needed to keep Procmail from choking on long
  15                             #"recipes", or instructions on what to do with
  16                             #particular kinds of email.
  17
  18 PATH=$HOME/bin:$HOME/mail/bin:/bin:/usr/bin:/usr/local/bin
  19                             #Path for your programs -- this is probably best
  20                             #left alone.
  21
  22 VERBOSE=off                 #Change this to "on" when you try a new recipe
  23                             #so that Procmail will log literally every step
  24                             #it takes.  DO NOT LEAVE IT ON, though, because
  25                             #it creates huge logfiles.
  26
  27 # Default Program & file locations
  28
  29 MAILDIR=${HOME}/Mail        #you'd better make sure this directory exists
  30
  31 #ORGMAIL=/var/spool/mail/phd
  32 #DEFAULT=${ORGMAIL}
  33
  34 LOGFILE=${MAILDIR}/procmail.log      #Logs message disposition.  Recommended -- otherwise
  35                                      #errors are emailed to you. :/
  36
  37 SENDMAIL=/usr/sbin/sendmail    #useful for autoreply recipes.
  38 FORMAIL=/usr/bin/formail       #useful for autoreply recipes.
  39
  40
  41 MYEMAIL=${HOME}/mail/misc/.myemail   #Tells Procmail where your MYEMAIL
  42                                      #file is located, a text file containing all the
  43                                      #email addresses you use.
  44
  45 ADMINFOLDER=${MAILDIR}/admin         #for bounced mail, mail from root,
  46                                      #postmaster, abuse, etc.
  47
  48 BLOCKFOLDER=${MAILDIR}/block         #for suspicious mail, but possibly not spam
  49
  50 BULKFOLDER=${MAILDIR}/bulk           #for bulk mail which appears legitimate, such
  51                                      #as mail from mailing lists or mail sent using
  52                                      #Bcc:
  53
  54 SPAMFOLDER=${MAILDIR}/spam           #change this to SPAMFOLDER=/dev/null
  55                                      #to delete spam entirely.
  56
  57 VIRUSFOLDER=/dev/null                #Set this variable to /dev/null to delete
  58                                      #all viruses. You don't want to take chances with a virus,
  59                                      #and the false positive rate on the virus filters is near zero.
  60
  61 # BEGIN RECIPES
  62
  63
  64 # Create a backup cache of 2000 most recent messages in case of mistakes
  65 :0 c
  66 backup
  67
  68   :0 ic
  69   | cd backup && rm -f dummy `ls -t msg.* | sed -e 1,2000d`
  70
  71 # Regenerate "From" lines to make sure they are valid
  72 :0 fhw
  73 | ${FORMAIL} -I "From " -a "From "
  74
  75
  76 # *CLOSED (only subscribers can write)* MAILING LISTS
  77 # No need to filter them for spam
  78
  79 :0
  80 * ^List-Id: Moscow Linux User Group <mlug\.UnixCenter\.RU>
  81 lists/mlug
  82
  83 :0
  84 * ^(From|To|Cc|Reply-To): .*((mlug@unixcenter\.ru)|@altlinux\.ru)
  85 lists/mlug
  86
  87 :0
  88 * ^(To|Cc|Reply-To|Resent-To|X-BeenThere): .*(-list@(python\.org|cwi\.nl))
  89 lists/python
  90
  91 :0
  92 * ^Sender: python-list-admin@python\.org
  93 lists/python
  94
  95 :0
  96 * ^Newsgroups: .*comp\.lang\.python
  97 lists/python
  98
  99 :0
 100 * ^List-Id: Python core developers <python-dev\.python\.org>
 101 lists/python
 102
 103 :0
 104 * ^List-Id: "Python 3000 process, design, development" <python-3000\.python\.org>
 105 lists/python
 106
 107 :0
 108 * ^List-Id: Discussions of speculative Python language ideas.*<python-ideas\.python\.org>
 109 lists/python
 110
 111 :0
 112 * ^Sender: "Email-SIG" <email-sig-bounces\+phd=phdru\.name@python\.org>
 113 lists/python
 114
 115 :0
 116 * ^Sender: mimelib-devel-admin@lists\.sourceforge\.net
 117 lists/python
 118
 119 :0
 120 * ^List-Id: Discussion of the Quixote Web development framework.*<quixote-users\.mems-exchange\.org>
 121 lists/python
 122
 123 :0
 124 * ^List-Id: Discussion of the Durus object database.*<durus-users\.mems-exchange\.org>
 125 lists/python
 126
 127 :0
 128 * ^From: sitelist-bounces@lists\.sourceforge\.net
 129 * ^To: sqlobject-discuss-owner@lists\.sourceforge\.net
 130 * ^Subject: Uncaught bounce notification
 131 ${SPAMFOLDER}
 132
 133 :0
 134 * ^From: sqlobject-cvs-bounces@lists\.sourceforge\.net
 135 * ^To: sqlobject-cvs-owner@lists\.sourceforge\.net
 136 * ^Subject: Auto-discard notification
 137 ${SPAMFOLDER}
 138
 139 :0
 140 * ^List-Id: .+<sqlobject-(discuss|cvs)\.lists\.sourceforge\.net>
 141 lists/python
 142
 143 :0
 144 * ^To: "(\[sqlobject:bugs\] )|(Ticket [0-9]+)" <[0-9]+@bugs\.sqlobject\.p\.re\.sf\.net>
 145 * ^Reply-To: "?(\\?\[sqlobject:bugs\\?\] )|(Ticket [0-9]+)"? <[0-9]+@bugs\.sqlobject\.p\.re\.sf\.net>
 146 * ^Subject: (\[SQL-CVS\] )?\[sqlobject:bugs\] (Re: )?\#[0-9]+
 147 lists/python
 148
 149 :0
 150 * ^From: "Repository SQLObject (fullhistory|sqlobject|scripts)\.git" .*<noreply@(fullhistory|sqlobject|scripts)\.sqlobject\.p\.re\.sf\.net>
 151 * ^To: "Repository SQLObject (fullhistory|sqlobject|scripts)\.git" .*<noreply@(fullhistory|sqlobject|scripts)\.sqlobject\.p\.re\.sf\.net>
 152 * ^Reply-To: "Repository SQLObject (fullhistory|sqlobject|scripts)\.git" .*<noreply@(fullhistory|sqlobject|scripts)\.sqlobject\.p\.re\.sf\.net>
 153 * ^Subject: \[sqlobject:(fullhistory|sqlobject|scripts)\]
 154 lists/python
 155
 156 :0
 157 * ^Sender: ppa-qps-devel-admin@lists\.sourceforge\.net
 158 lists/python
 159
 160 :0
 161 * ^Sender: pysqlite-bounces@lists\.initd\.org
 162 lists/python
 163
 164 :0
 165 * ^List-Id: <parsedatetime-dev\.googlegroups\.com>
 166 lists/python
 167
 168 :0
 169 * ^(To|Cc|Reply-To|Resent-To|Sender): .*(zope.*@zope\.(org|net|com))|(zip@eevolute\.com)
 170 lists/zope
 171
 172
 173 # Now filters
 174
 175 # Klez
 176 :0 B
 177 * ^Content-Transfer-Encoding: base64
 178 * name( ?)=.*\.(com|exe|bat|scr|pif)
 179 | ${FORMAIL} -A"X-Note: Klez" -A"X-Folder: Virus" >${VIRUSFOLDER}
 180
 181 # Sobig.E
 182 :0 HB
 183 * ^Subject: Re: (Movie|Application)$
 184 * ^Content-Transfer-Encoding: base64
 185 * ^Content-Disposition: attachment;
 186 * filename=.your_details\.zip
 187 | ${FORMAIL} -A"X-Note: Sobig.E" -A"X-Folder: Virus" >${VIRUSFOLDER}
 188
 189 # Sobig.F
 190 :0 H
 191 * ^Subject: .*(Thank you!|Your application|That movie|Approved|Details|My details|Your details|Wicked screensaver)$
 192 * ^X-MailScanner: Found to be clean$
 193 | ${FORMAIL} -A"X-Note: Sobig.F" -A"X-Folder: Virus" >${VIRUSFOLDER}
 194
 195 # MyDoom/Novarg
 196 :0 HB
 197 * <50000
 198 * ^Subject: (test|hi|hello|Mail Delivery System|Mail Transaction Failed|Server Report|Status|Error|)$
 199 * ^Content-type: application/octet-stream;
 200 * (file)?name="(document|readme|doc|text|file|data|test|message|body)\.(pif|scr|exe|cmd|bat|zip)
 201 | ${FORMAIL} -A"X-Note: MyDoom" -A"X-Folder: Virus" >${VIRUSFOLDER}
 202
 203 # Netsky
 204 :0
 205 * > 20000
 206 * < 60000
 207 * ^Subject:[ ]*(hi|hello|read it immediately|\
 208 something for you|warning|information|stolen|fake|unknown)
 209 * B ?? ^(anything ok\?|what does it mean?|ok|\
 210 i'm waiting|read the details\.|here is the document\.|\
 211 read it immediately\!|my hero|\
 212 here|is that true?|is that your name?|is that your account?|\
 213 i wait for a reply\!|is that from you?|you are a bad writer|\
 214 I have your password\!|something about you\!|\
 215 kill the writer of this document\!|i hope it is not true\!|\
 216 your name is wrong|i found this document about you|\
 217 yes, really\?|that is bad|here it is|see you|\
 218 greetings|stuff about you\?|something is going wrong!|\
 219 information about you|about me|from the chatter|\
 220 here, the serials|here, the introduction|here, the cheats|\
 221 that's funny|do you\?|reply|take it easy|why\?|\
 222 thats wrong|misc|you earn money|you feel the same|\
 223 you try to steal|you are bad|something is going wrong|\
 224 something is fool)$
 225 * B ?? ^(Content-Disposition:[  ]*attachment;)?[        ]*(file)?name="?(document|msg|doc|talk|message|creditcard|\
 226 details|attachment|me|stuff|posting|textfile|concert|\
 227 information|note|bill|swimmingpool|product|\
 228 topseller|ps|shower|aboutyou|nomoney| found|\
 229 story|mails|website|friend|jokes|location|\
 230 final|release|dinner|ranking|object|mail2|part2|\
 231 disco|party|misc)\..*(zip|exe|scr|com|pif)"?$
 232 | ${FORMAIL} -A"X-Note: Netsky" -A"X-Folder: Virus" >${VIRUSFOLDER}
 233
 234 # Bagle.J
 235 :0
 236 * ^Subject:(.*E-mail account disabling warning)|\
 237    (.*E-mail account security warning)|\
 238    (.*Email account utilization warning)|\
 239    (.*Important notify about your e-mail account)|\
 240    (.*Notify about using the e-mail account)|\
 241    (.*Notify about your e-mail account utilization)|\
 242    (.*Warning about your e-mail account)
 243 * B ?? ^Content-Type: application/octet-stream;
 244 * B ?? ^Content-Transfer-Encoding: base64
 245 * B ?? ^Content-Disposition: attachment;
 246 | ${FORMAIL} -A"X-Note: Bagle.J" -A"X-Folder: Virus" >${VIRUSFOLDER}
 247
 248
 249 # From http://www.internetguru.com.au/igblog-102.html
 250
 251 # Redirect common virus attachments inc. zipped versions
 252 :0 B
 253 * name=.*(document|readme|doc|text|file|data|test|message|body)\.(vbs\"|wsf\"|vbe\"|wsh\"|hta\"|scr\"|pif\"|exe\"|shs\"|bat\"|bas\"|cmd\"|zip\")
 254 {
 255    :0
 256    | ${FORMAIL} -A"X-Note: executable attachment virus" -A"X-Folder: Virus" >>${VIRUSFOLDER}
 257 }
 258
 259 # Some more common virus attachments inc. zipped versions
 260 :0 B
 261 * name=.*(Attach|Information|Readme|Document|Info|TextDocument|Textfile|MoreInfo|Message)\.(pif\"|zip\")
 262 {
 263    :0
 264    | ${FORMAIL} -A"X-Note: executable attachment virus" -A"X-Folder: Virus" >>${VIRUSFOLDER}
 265 }
 266
 267 # Redirect windows executables (note - haven't included exe and com
 268 :0 B
 269 * name=.*\.(vbs\"|wsf\"|vbe\"|wsh\"|hta\"|scr\"|pif\"|shs\"|bat\"|bas\"|scr\"|dll\")
 270 {
 271    :0
 272    | ${FORMAIL} -A"X-Note: executable attachment virus" -A"X-Folder: Virus" >>${VIRUSFOLDER}
 273 }
 274
 275 # This one finds them annoying Custom Logo spams that seem to get past most filters
 276 :0 B
 277 * .*out\.php\?email\=(sales|info)\@
 278 {
 279    :0
 280    | ${FORMAIL} -A"X-Note: Custom Logo spam" -A"X-Folder: Spam" >>${SPAMFOLDER}
 281 }
 282
 283 # This catches about 99% of deliberate viagra mispellings ie v1@GRa, v1agr@ etc
 284 :0 H
 285 * ^Subject.*[Vv][1jl\|][aA\@][Gg][Rr][Aa\@]
 286 {
 287    :0
 288    | ${FORMAIL} -A"X-Note: viagra spam" -A"X-Folder: Spam" >/dev/null
 289 }
 290
 291
 292 # Chineese/japaneese/korean spam
 293
 294 :0
 295 * ^Content-Type: text/(plain|html); *charset=("?)(big5|gb2312|iso-2022-jp|ks_c_5601-1987|shift_jis)("?)
 296 | ${FORMAIL} -A"X-Note: chineese/japaneese/korean charset" -A"X-Folder: Spam" >/dev/null
 297
 298 :0
 299 * ^X-RBL-Warning: .*(china|korea) does not seem to care about spam
 300 | ${FORMAIL} -A"X-Note: chineese/korean source" -A"X-Folder: Spam" >>${SPAMFOLDER}
 301
 302
 303 # SpamAssassin (spamassassin.org)
 304 :0fw
 305 * < 10240000
 306 | spamc -U /tmp/spamassassin.sock -s 10240000
 307
 308
 309 # Mail with a score of 14 or higher is certainly spam
 310 :0:
 311 * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*
 312 | ${FORMAIL} -A"X-Note: certainly spam" -A"X-Folder: Spam" >/dev/null
 313
 314 :0:
 315 * ^X-Spam-Status: Yes
 316 * > 20000
 317 | ${FORMAIL} -A"X-Note: oversized spam" -A"X-Folder: Spam" >/dev/null
 318
 319 :0 HB:
 320 * ^X-Spam-Status: Yes
 321 * http://www\.gstinc\.com/
 322 | ${FORMAIL} -A"X-Note: gstinc spam" -A"X-Folder: Spam" >/dev/null
 323
 324 :0 HB:
 325 * ^X-Spam-Status: Yes
 326 * (www\.)?sonidom\.ru
 327 | ${FORMAIL} -A"X-Note: sonidom spam" -A"X-Folder: Spam" >/dev/null
 328
 329 :0 HB:
 330 * ^X-Spam-Status: Yes
 331 * (www\.)?pos-tel\.ru
 332 | ${FORMAIL} -A"X-Note: pos-tel spam" -A"X-Folder: Spam" >/dev/null
 333
 334 :0 HB:
 335 * ^X-Spam-Status: Yes
 336 * @besttraining\.ru
 337 | ${FORMAIL} -A"X-Note: besttraining spam" -A"X-Folder: Spam" >/dev/null
 338
 339 # HTML-only mail is almost certainly spam
 340 #:0
 341 #* ^Content-Type: text/html
 342 #| ${FORMAIL} -A"X-Note: HTML-only mail" -A"X-Folder: Spam" >/dev/null
 343
 344 :0:
 345 * ^X-Spam-Status: Yes
 346 ${SPAMFOLDER}
 347
 348
 349 # MAILING LISTS
 350
 351 # Filter out mail from all mailing lists you are on. Just duplicate the recipe
 352 # for each mailing list you are on, and put the correct address for the list in
 353 # the condition statement. (The "* ^TO" part.) If you read mail on shell, you
 354 # may find it easier to deliver this mail to separate folders, especially for
 355 # busy lists. I do. :)
 356
 357
 358 # Block all messages that are too big
 359 :0
 360 * > 1000000
 361 | ${FORMAIL} -A"X-Note: the message is too big" -A"X-Folder: Block" >>${BLOCKFOLDER}
 362
 363
 364 # unfiltered mail marked by exim (using RBL/ORBS/etc)
 365
 366 :0
 367 * ^X-RBL-Warning:
 368 * ^(To|Cc):.*phd
 369 ${BLOCKFOLDER}
 370
 371 :0
 372 * ^X-RBL-Warning:
 373 ${SPAMFOLDER}
 374
 375
 376 # Sort out mail that really is to you from mail Bcc'd to you, or mail
 377 # which doesn't have any of your email addresses on the To: or Cc: line.
 378 # For this to work properly, you must create a text file named .myemail
 379 # in your home directory and enter all email addresses that belong to
 380 # you in it, one per line, just as you do with your .nobounce file.
 381 #
 382 # This does =wonders= in keeping spam from appearing in your personal
 383 # mail. :)
 384 #
 385 # Substitute your shell account email address, custom domain, and any other email
 386 # address you may have for the entries below.
 387 :0:
 388 * ? test -f ${MYEMAIL} && \
 389     (${FORMAIL} -zxTo: -zxCc: |\
 390     fgrep -i -f ${MYEMAIL})
 391 | ${FORMAIL} -A"X-Folder: Default" >>${DEFAULT}
 392
 393 # Deliver email which passed spam filtering, but which wasn't sent to
 394 # a recognizable personal email address of yours, to your "bulk mail"
 395 # folder, for reading on a less-urgent basis.
 396 :0:
 397 | ${FORMAIL} -A"X-Folder: Bulk" >>${BULKFOLDER}
 398
 399
 400 # Vacation - modified version of procmail example from "man procmailex"
 401
 402 # Drop duplicates
 403 #:0 Wh: msgid.lock
 404 #| ${FORMAIL} -D 65536 msgid.cache
 405 #
 406 #:0 Whc: vacation.lock
 407 #* !^From: .*phd
 408 #* !^FROM_MAILER
 409 #* !^FROM_DAEMON
 410 #* !^X-Loop: phd@phdru.name
 411 #* !^X-Loop: phd@iskra.aviel.ru
 412 #* !^From: "AviTicket" <support@aviel\.ru>
 413 #* !^From: .* <lj_notify@livejournal\.com>
 414 #* !^From: .*report_card@sbrf.ru
 415 #| ${FORMAIL} -rD 65536 vacation.cache
 416 #
 417 #:0 ehc  # if the name was not in the cache - reply
 418 #| (egrep -v '^From phd|^Return-Path: phd' | \
 419 #   ${FORMAIL} -r -A"Precedence: junk" \
 420 #      -A"X-Loop: phd@phdru.name" -A"X-Loop: phd@iskra.aviel.ru" \
 421 #      -A"Content-Type: text/plain; charset=koi8-r"; \
 422 #   echo "Hello!"; echo "";\
 423 #   echo "   I am on vacation. This is an auto-generated reply. Your message has been"; \
 424 #   echo "delivered to my mailbox. Thanks a lot. I will read it after 0th of ."; \
 425 #   echo ""; \
 426 #   echo "Здравствуйте."; echo ""; \
 427 #   echo "   Я уехал в отпуск. Это автоматический ответ. Ваше сообщение было доставлено."; \
 428 #   echo "в мой почтовый ящик. Большое спасибо. Я прочту его, когда вернусь 0 ."; \
 429 #   echo ""; cat $HOME/.signature) | $SENDMAIL -oi -t