Aerospace Software Ltd.

Procmail Howto

For Mandrake 9.1
Sep 2003

General

Most ISPs allow you to have a small number of mail accounts on their system. If you are running a club or a small business, then you may have to pay the ISP a lot of money, just to sort your mail into separate accounts. Using procmail, you can sort your mail yourself, and save some money.

For example, many ISPs give you 10 mailboxes and 10 aliases. Using procmail, you can have 20 email addresses with that account. Some ISPs give you 10 mailboxes and a wildcard. With wildcard delivery, you can have an unlimited number of email addresses. If you are running a club with a large number of users, then you can give each member an email address and save a big wad of money.

Mail has two sets of addresses, the envelope address is used for the delivery, while it also has To:, CC: and Resent-To: headers. If you configure your mail client to identify you as john.doe@example.com, then that address will be echoed in the To: header when someone responds to your mail - that is your so called email alias. If you are willing to sort your mail yourself, then you can have as many email aliases as you want, without having to ask your ISP to increase your number of mailboxes.

Procmail is a common local mail delivery agent. Its ability to sort e-mail is very good, but its regular expression filter syntax is rather confusing. The syntax sucks, but it works - the trouble being that it is an older kind of regular expression syntax - not the kind you use for GNU grep - it is sufficiently similar to be aggravating...

Apart from delivering mail, procmail is typically also used to invoke a virus and spam filter, which complicates matters.

Procmail is typically invoked by postfix for local delivery and by fetchmail for incoming mail. The mail can then be served to users using qpopper from Qualcom. I have not found a better pop3 daemon than qpopper - it just works - no ifs buts of whatevers - just the way I like it.

A good virus filter is available here:

http://www.impsec.org/email-tools/procmail-security.html

A good spam filter is available here:

http://spamprobe.sourceforge.net/

Good procmail manuals are available here:

http://pm-doc.sourceforge.net/
http://pm-doc.sourceforge.net/pm-tips.html

This guide simply presents a small procmailrc file which can serve as a starting point for your system.

Just one tip:

Any Carriage Returns in the procmailrc file will break procmail. Therefore, only use proper Linux editors to edit this file. Vi, Emacs, Kedit and Gedit works. I can't vouch for anything else.

Example Procmailrc File

This example is for use with a fetchmail delivery agent. If you pop your mail via fetchmail from your ISP, then the envelope address of the message is usually stripped by the ISP sendmail MTA. Therefore you have to deliver the mail based on the To:, CC: and Resent-To: headers. The procmail TO_ macro was designed to make this easier.

If you get all your mail via the postfix MTA, then you can deliver the mail based on the Delivered-To: header, in which case the problems with CC: lists and multiple deliveries discussed here, are a non-issue.

This file can be used to run the html-trap virus filter, the spamprobe crud filter and will deliver mail to a number of users.

A problem arises with the use of CC lists behind a fetchmail MTA and I have never seen anyone else provide a way to handle it. This file will deliver a copy to each person in the list, without causing double deliveries.

# procmailrc
# A mail filter for multiple users sharing a single ISP mailbox
# Copyright 2002, Aerospace Software Ltd.
# Licenced under the GPL available from http://www.gnu.org

# Installation notes:
# Put the filter files in directory /etc/procmail
# Remember that procmail assumes the identity of the recipient
# Change the file permissions to 644 so that all recipients can read the filter scripts
# The From: black/white lists are the files /etc/procmail/blacklist and /etc/procmail/whitelist
# provide one line per listee
# do not end the file with a carriage return

# Debug stuff
LOGFILE=/var/log/procmail.log
FORMAIL=/usr/bin/formail
SENDMAIL=/usr/sbin/sendmail
VERBOSE=yes
LOGABSTRACT=all
LASTFOLDER

# HTML-trap Sanitizer configuration
PATH="/usr/bin:$PATH:/usr/local/bin"
SHELL=/bin/sh

POISONED_EXECUTABLES=/etc/procmail/poisoned-files
SECURITY_NOTIFY="postmaster"
SECURITY_NOTIFY_VERBOSE="virus-checker"
#SECURITY_NOTIFY_SENDER=/etc/procmail/crudreply.txt
SECURITY_NOTIFY_SENDER=
SECRET="crudfilter"
SECURITY_QUARANTINE=/var/spool/mail/quarantine
POISONED_SCORE=25
SCORE_HISTORY=/var/log/macro_scanner_scores
DROPPRIVS=YES

# Spamprobe configuration
SPAMPROBE="/usr/local/bin/spamprobe -d /var/spool/mail"


### Fix/add the From headers
# Berkley MBX format message Separator = "\n\nFrom "
:0 fhw
| $FORMAIL -I "From " -a "From "



### Trap mail bombs
:0
* > 20000000
/dev/null



### Common mail log for debug and security purposes
:0 c
/var/spool/mail/mail.log



### Html-trap - Virus Filter
INCLUDERC=/etc/procmail/html-trap.procmail



### Process all Herman's mailing lists first, before filtering crud out
### These lists may appear to come from daemons, so get them first
# KDE
:0:
* ^To:.*koffice-devel.*@mail\.kde\.org
/var/spool/mail/herman

# OOo
:0:
* ^To:.*dev.*@wp\.openoffice\.org
/var/spool/mail/herman

# Mandrake Linux
:0:
* (^From.*@Mandrakesoft\.com)|(^From.*@Mandrake\.org)
/var/spool/mail/herman

# Globi
:0:
* (^From.*@globi\.ca)
/var/spool/mail/herman

# PGIB
:0:
* (^From.*pgib)
/var/spool/mail/herman



### Spamprobe - Naive Bayesian Word Probability Filter
## Avoid running spamprobe again on spam corrections
:0
* ! (^TO_spam@aerospacesoftware\.com)
{
   # Score the message
   :0
   SCORE=| $SPAMPROBE receive

   # Add the score to X-Spamprobe header
   :0 wf
   | formail -I "X-SpamProbe: $SCORE"

   # Put all spams in the spamprobe box, so we can rebuild the sp_words database if required.
   # If you want to deliver the spam to the users, use this line.
   #:0 ac:
   # If you don't want to deliver the spams to the users, use this line.
   :0 a:
   * (^X-Spamprobe: SPAM)
   /var/spool/mail/spamprobe
}

### Spam Corrections
### To correct a misclassification, forward it to the spam user address
:0
* (^TO_spam@aerospacesoftware\.com)
{
   :0
   * (^X-SpamProbe: SPAM)
   * ! (^X-Loop: SpamProbe)
   {
      # Was seen as spam, should be ham and reverse header
      :0 wf
      | $FORMAIL -I "X-SpamProbe: GOOD" -rk

      :0 wf
      | $FORMAIL -I "X-Loop: SpamProbe"

      # After the To/From reversal, fix the From line again
      :0 wf
      | $FORMAIL -I "From " -a "From "

      # Put it in Hambox and copy for redelivery and user verification
      :0 c:
      /var/spool/mail/ham

      # Rescan the hambox
      :0 w
      | $SPAMPROBE good /var/spool/mail/ham
   }

   :0
   * (^X-SpamProbe: GOOD)
   * ! (^X-Loop: SpamProbe)
   {
      # Was seen as ham, should be spam and reverse header
      :0 wf
      | $FORMAIL -I "X-SpamProbe: SPAM" -rk

      :0 wf
      | $FORMAIL -I "X-Loop: SpamProbe"

      # After the To/From reversal, fix the From line again
      :0 wf
      | $FORMAIL -I "From " -a "From "

      # Put it in Spambox and copy for redelivery and user verification
      :0 c:
      /var/spool/mail/spam

      # Rescan the spambox
      :0 w
      | $SPAMPROBE spam /var/spool/mail/spam
   }
}



### Deliver the mail

# Gustav's mail
:0c:
* (^TO_gustav@aerospacesoftware\.com)
/var/spool/mail/gustav

# Lona's mail
:0c:
* (^TO_lona@aerospacesoftware\.com)
/var/spool/mail/lona

# Aerosoft's mail
:0c:
* (^TO_aerosoft@aerospacesoftware\.com)|(^TO_info@aerospacesoftware\.com)|(^TO_abuse@aerospacesoftware\.com)
/var/spool/mail/herman

# Herman's mail
:0c:
* (^TO_herman@aerospacesoftware\.com)|(^TO_h\.oosthuysen@ieee\.org)
/var/spool/mail/herman

# The rest of the daemon messages go to root
:0c:
* (^TO_postmaster@aerospacesoftware\.com)|(^TO_root@aerospacesoftware\.com)|(^FROM_DAEMON)|(^FROM_MAILER)|(^FROM_.*Cron)
/var/spool/mail/herman

# Handle the ARMdimension forwarded mail
:0c:
* (^TO_.*armdimension\.com)
/var/spool/mail/herman



### Unknowns - Whatever is left over is spam by definition
# Only do this if the mail was not delivered, if LASTFOLDER is not set
:0
*$ !{LASTFOLDER+!}
{
  # Deliver to the unknown box
  :0:
  /var/spool/mail/unknown
}

### Done. Junk the delivered copies.
### This also ensures that any cloned procmail stops running.
:0
/dev/null

exit

'Hope this helps! Herman