SA-Exim was written by Marc MERLIN <marc_soft@merlins.org> and you can find
the latest version here:
http://sa-exim.sf.net/
or
http://marc.merlins.org/linux/exim/sa.html

Enjoy,
Marc


INSTALL
-------
See the file named INSTALL for installations instructions (either compiled
in exim, or as a stand-alone shared library)


PRIVACY WARNING
---------------
SA-Exim can add a header with the list of recipients in an Email (including
Bcced folks).
X-SA-Exim-Rcpt-To is used to allow you to  see who a spam went to easily
(i.e. without scanning  the exim logs), and to  write SpamAssassin rules
on  the  envelope  To (like  adding  a  score  if  there were  too  many
recipients or a recipient who you know only receives spam)
X-SA-Exim-Rcpt-To is not added anymore by default, you need to enable it
by setting SAmaxrcptlistlength to a value up to 8000, but if you do add
it, you should consider remove it in exim's system_filter or in a transport
If SARewriteBody is true you should also consider setting
SAaddSAEheaderBeforeSA to false (see the config) as all the receipients will
be visible in the attached spam, note that this disables the ability to
write SpamAssassin rules based on X-SA-Exim-Rcpt-From/To.
In real life who a spam was sent to isn't really a problem, but it could be
if a private message is mis-categorized as spam


CONFIGURATION
-------------
You should read sa-exim.conf, all the options there should be well
documented.

Note that the code will not act on any mail before it is flagged as
SPAM by SA. 
Having SA flag the mail however doesn't mean the code rejects it or throws
the alleged spam away, you control what you want to do depending on the score.
The only restriction is that things happen in this order (for increasing SA
scores)

- Save in SAnotspamsave if enabled
- Save in SAspamacceptsave if enabled
- Temporarily reject and optionally save if enabled
- Permanently reject and optionally save if enabled
- Accept, drop the mail, and optionally save if enabled
- Stall the sender to waste his resources (and yours)
  (SAstallsender is deprecated, you should use SAteergrube instead)

You cannot set a stall threshold of 12, and a permreject threshold of 20
(not that it would make much sense anyway)


EXIM4 INTEGRATION / NOT SCANNING YOUR OWN MAILS
-----------------------------------------------
For a very complete exim4 config, including settings for SA, you should
look at sa-exim.conf and play with:

SAEximRunCond: ${if and {{def:sender_host_address} {!eq {$sender_host_address}{127.0.0.1}} {!eq {$h_X-SA-Do-Not-Run:}{Yes}} } {1}{0}}   

You may also want to look at my exim4.conf config if you haven't done so yet:
http://marc.merlins.org/linux/exim/#conf

The check_rcpt ACL has:
  warn     message       = X-SA-Do-Not-Rej: Yes
           local_parts   = +nosarej:postmaster:abuse

  warn     message       = X-SA-Do-Not-Run: Yes
           hosts         = +relay_from_hosts

  warn     message       = X-SA-Do-Not-Run: Yes
           authenticated = *

Then, you'll want to strip SA headers for messages that aren't local
This means you should strip them at least in remote_smtp

  # This is generally set on messages originating from local users and it tells
  # SA-Exim not to scan the message or that the message was scanned.
  # Let's remove these headers if the message is sent remotely
  headers_remove = "X-SA-Do-Not-Run:X-SA-Exim-Scanned:X-SA-Exim-Rcpt-To"




SAteergrube
-----------
The idea is for mail that you know for sure is spam (I use a threshold of 25),
you can try to stall the spammer as much as possible by sending a continuation
line every 10 seconds:
451- wait for more output
451- wait for more output
451- wait for more output
(...)

You can go there for details:
http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html

What should you know?
1) This is obviously going to use up some of your resources
2) You should not teergrube SMTP servers that relay mail for you, be
   courteous (set SAteergrubecond). Besides they are real mail relays, so they
   will diligently try to send you the spam over and over for days)
   (note that you should probably not teergrube mailling lists you subscribed
   to either)
3) Become of limitations in the current exim code (4.11 as of this writing),
   teergrubing will not work over TLS.
   This shouldn't be a problem since real spammers should not be using TLS,
   and you shouldn't teergrube relays that do TLS with you.
   If you do teergrube a TLS connection, it will break the connection and you
   will see this in your logs:
   18640m-0000Vb-00 SSL_write error 5
   TLS error (SSL_write): error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
   This is not ideal, but in real life, that's ok.


READING ARCHIVED SPAMS
----------------------
Spams are saved in individual files in a 'new' subdirectory of something
like /var/spool/exim/SAteergrube.

There are two ways to read them:
1) cat new/*  > /tmp/mailbox, and use  the resulting file as  a standard
   mbox file with any mail client (if SAPrependArchiveWithFrom is true)
2) create two directories: cur and tmp at the same level than 'new', and
   run something  like 'mutt -f  /var/spool/exim/SAteergrube'. This will
   read  the messages  in place,  since it  looks like  a valid  Maildir
   spool.

If you configured SA-Exim to set X-SA-Exim-Rcpt-To, you can even resend
archived refused messages to the users they were meant for


LOG AND SMTP OUTPUT
-------------------
As of SA-Exim 3.0, SMTP output does not contain the spam score anymore,
and you can change the messages or re-add the score by changing the
runtime SAmsg* variables
All SA-Exim log now looks like this:
- "SA: PANIC: "		-> severe errors
- "SA: Warning: "	-> config file parsing errors
- "SA: Notice: "	-> misc info on what SA-Exim is doing or not doing
- "SA: Action: "	-> what action SA-Exim took on a mail after scanning
- "SA: Debug[X]: "	-> misc debug info if enabled

Marin Balvers has written a nice log parser here:
http://nossie.addicts.nl/projects/sa-exim-stats/
