[SA-exim] Header Problem.

[Marc MERLIN]

On Tue, Dec 03, 2002 at 09:05:40PM +0000, Tim Jackson wrote:
> While you're at it, is there any chance of an option, something like:
> 
> SAaddheaders = $some_exim_condition
 
Well, I don't want to add an endless number of options, there are many
already.
SA-Exim-Scanned is trivial to remove from system_filter, and my sample
exim4.conf config shows how to keep it for local mail.
The documentation points you to:
http://marc.merlins.org/linux/exim/exim4-conf/exim4.conf.master
 
> They are undoubtedly useful for debugging, but I'd rather not add these
> headers to mail all the time, especially outgoing mail. It'd be nice to be
> able to switch them on and off, or maybe on for inbound mail only.
 
And you can already do this inside the exim config. Do I really need to add
that to sa-exim?
 
> Thinking off the top of my head, are there also some potential privacy
> issues here, like if a mail is Bcc'd? Assuming your MUA/MTA are set up in
> such a way that the 'To:' recipient has no way of telling that someone
> else has been Bcc'd, would the SA-Exim-Rcpt-To header not reveal this?

Right, see the docs:
http://marc.merlins.org/linux/exim/files/sa-exim-current/README

----------------------------------------------------------------------------
PRIVACY WARNING
---------------
By default SA-Exim adds a header with the list of recipients in an Email
(including Bcced folks). 
X-SA-Exim-Rcpt-To is used to allow you to  see who a spam went to easily
(i.e. without scanning  the exim logs), and to  write SpamAssassin rules
on  the  envelope  To (like  adding  a  score  if  there were  too  many
recipients or a recipient who you know only receives spam)
If it is not acceptable for your users to see this header, you should
strip it in exim's system_filter with header_remove
----------------------------------------------------------------------------

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/   |   Finger marc_f@merlins.org for PGP key