My mail configuration relies on SpamBouncer to deal with spam problem. It works well, and I usually keep spam under control, with very little of false positives and what should be blocked… blocked.
Thanks to Antonio Fragola and his Procmail section (warning: it’s all in Italian) of an How-To he wrote I discovered the joy of using a little Perl script in order to strip the FROM: field of incoming spam messages and add it to a .alwaysblock file used by SpamBouncer as a black list.
The addysort file is simple:
#!/usr/bin/perl -wn
# Extract email addres from the "From:" field
unless (/\]+)/, "\n"; }
and to use it all that you need to do is save it, make it executable, and create a macro (or whatever your mail client has…) to call for it.
In my .muttrc file for mutt I call it with ESC-K with these binds:
macro index "\ek" "| formail -x From: | addysort >> ~/mail/.pm/black.lst\n"
macro pager "\ek" "| formail -x From: | addysort >> ~/mail/.pm/black.lst\n"
Of course being ~/mail/.pm/black.lst my blacklist file.
But let’s come to the point: the addresses are listed fully in the black.lst, which means they’re in the form something@somewere.whatever. This of course will help blocking all further email from that address, but with spam most of the time you’ll end up having addresses like:
ashdgfjg@ispam.net
djgfhsdgfsd@ispam.net
truty47@ispam.net
Same domain with different faked username.
What I usually have done manually in the past year was to edit the file in vim, delete the username@ part with a regexp and save it. Of course that is something that works well, but that is also quite annoying.
So yesterday I came out with a small bash script that uses a few (actually three) perl commands to clean up my black.lst file as I like it: only a list of domains.xx[¹].
#!/bin/bash
#
# Check and clean black.lst file from SpamBouncer.
# Files locations.
BL=/home/curson/mail/.pm/black.lst
BLTEMP=/home/curson/mail/.pm/black.lst.temp
# This will strip the username from the address leaving
# only the domain.
perl -i -p -e 's/[0-9A-Za-z_\.]*@//gi’ $BL
# This will strip domain names that could have been
# inserted into the black list erroneously due to faked
# FROM: fields. They’re just examples of some of the
# common fake I get, and which I’d still like to receive
# mail from ;)
perl -i -p -e ’s/^gmail\.com\n|^yahoo.+\n|^email\.it\n//gi’ $BL
# This will strip out all double recurrencies in the file.
# It’s 100% unuseful to have the same domain listed
# twice.
perl -ne ‘print unless $a{$_}++’ $BL > $BLTEMP | mv $BLTEMP $BL
# Now let’s do a backup of the black.lst file.
cp $BL /home/curson/mail/.pm/black.lst.backup
Save it, make it executable and write a small cron job and live happy! :)
Continue reading…
