LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 09-12-2019, 10:41 AM   #1
pshoaf
LQ Newbie
 
Registered: Feb 2005
Location: Charleroi, PA 30 mi SE of Pgh
Distribution: RedHat, Fedora, Oracle
Posts: 20

Rep: Reputation: 0
Question PROCMAIL Spam Filter on base64 content


I am trying to filter SPAM with procmail. I am receiving emails where the HTML content has been encoded as base64.

I am running on Oracle Linux 6 and mimeencode is included.

The following is a portion of a SPAM email.

Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64
X-BESS-ID: 1568295682-893335-3181-18792-1
X-BESS-VER: 2019.1_20190911.2255
X-BESS-Apparent-Source-IP: 95.189.78.2


PCFkb2N0eXBlIGh0bWw+DQo8aHRtbCB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRt
bCIgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVybjpz
Y2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSI+DQo8aGVhZD4NCjwhLS0gTkFNRTog

I would want to
-- check the header for "Content-Transfer-Encoding: base64"
-- if yes, then
----- decode content
----- parse HTML code for specific words in content using pregexp pattern
----- when found send message to /dev/null or to a junk mail box

Can anyone help me with a rule for this?

Thanks
 
Old 09-13-2019, 08:16 PM   #2
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.6
Posts: 3,778

Rep: Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263
You might want to edit your post to remove your email address. Spammers will harvest it.

You'll need to use an external program to decode the base64. Do you know how to run an external program in procmail?
I found several informative links with this search.

An alternative is to use spamassassin, which decodes base64 already and is probably in your distro's repositories.

On my server, I run all email through spamassassin, and mail that's not rejected goes through procmail for some further checks and sorting.
 
1 members found this post helpful.
Old 09-14-2019, 08:24 PM   #3
pshoaf
LQ Newbie
 
Registered: Feb 2005
Location: Charleroi, PA 30 mi SE of Pgh
Distribution: RedHat, Fedora, Oracle
Posts: 20

Original Poster
Rep: Reputation: 0
Thumbs up RE: PROCMAIL Spam Filter on base64 content

Thanks for the catch on my Signature. I fixed that.

I added SPAMASASSIN again and it is catching most of the MIME encoded emails.

I had found a document on using mimeencode -d to decode the base64 encoded message, but was unsure how to properly write the PROCMAIL filter.

I guess for now, unless someone has a better method, I will keep using SPAMASASSIN and tweek that to get best results.
 
Old 09-14-2019, 08:37 PM   #4
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.6
Posts: 3,778

Rep: Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263
I didnít know how to it either...there were a couple of examples in that search I posted.
If youíre happy, you can mark the thread SOLVED using the Thread tools at the top of the page.
 
  


Reply

Tags
base64, filter, procmailrc, spam


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Firefox adult/drug/gambling/alcohol site filter: md5 encryption/deciphering & base64 encoding/decoding l0f4r0 General 17 03-10-2019 04:48 PM
[SOLVED] base64 encoding in program vs piping to base64 command-line utility 0x53h Linux - General 3 08-05-2016 10:39 AM
Move SA Marked Spam to Junk/Spam Folder Using Procmail, Postfix, and Virtual Users alden_pease Linux - Server 0 01-05-2012 12:29 AM
spam filter that puts spam into spam folder? paul_mat Linux - Software 3 03-31-2009 04:18 AM
procmail and spam -- do not send out of office auto replay to spam draix Linux - Software 0 12-30-2004 08:35 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 08:25 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration