trouble using unbase64 w bogofilter & procmail

[Allyn Fratkin]

Barry Gould wrote:

> Allyn, thanks for that recipe.
>
> Unfortunately, I'm having some trouble with it.
>
> It seems to work if the users mailbox is small, but for one user whose
> mailbox is about 1.4MB, it never seems to execute this rule, or it gets
> clobbered due to locking issues.
> (The larger mbox gets the spam with the standard bogofilter header, not
> the bogofilter-unbase64 one)

hmm, i can't think of a reason for this behavior.  procmail doesn't
care about the size of the users mailbox, i doubt that it has even
checked the mailbox at this point.  something else must be going on.

try adding these lines which should give you a better idea of what's
going on:
LOGFILE=$HOME/procmail.log
VERBOSE=on

> I'm not using any bogofilter.cf, and I have a SYMLINK for
> /root/.bogofilter -> /var/spool/mail/.bogofilter
> as I'm keeping the db's in /var/spool/mail/.bogofilter

you could also call bogofilter with a "-d /var/spool/mail/.bogofilter"
parameter and skip the symlink.

> #check for base64 spam
> :0fHB
> * < 256000
> #* H ?? ^X-Bogosity: No
> * ^content-transfer-encoding: *(base64|quoted-printable)
> * ? /usr/local/bin/unbase64.pl | bogofilter -u
> | formail -I"X-Bogosity: Yes, tests=bogofilter-unbase64"

is there a reason you commented out the X-Bogosity check?  this will
run bogofilter on messages a second time even if the first bogofilter
run tagged it as spam.  this is probably not necessary.

you are using the bogofilter -u option, which tells bogofilter to
update the databases.  i'm not sure that's what you want in light of
the rule below (although the advantage of using the -u here will get the
decoded base64 text trained).

> #update db ONLY IF it was spam (due to too many false negatives)
> :0c
> * ^X-Bogosity: Yes, tests=bogofilter
> | bogofilter -s

messages tagged as spam by the unbase64 rule will be entered into the
database twice if you use this rule.  i'm not sure that's what you want.
-- 
Allyn Fratkin             allyn at fratkin.com
Escondido, CA             http://www.fratkin.com/