HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   HOWTO-Related Questions (http://www.howtoforge.com/forums/forumdisplay.php?f=2)
-   -   SpamSnake: filter on content rules (http://www.howtoforge.com/forums/showthread.php?t=34053)

padonker 23rd April 2009 12:19

SpamSnake: filter on content rules
 
Guys, lately our server is receiving a whole load of spam, which is passed by the SpamSnake as regular mail. The total score is <0.
The mail contains random words and a hyperlink, which always points to the same domain; interia.pl

How do I configure the Snake to filter messages with interia.pl in its body?

Thanks for any hints

-Patrick-

topdog 23rd April 2009 14:11

Are you using the sane security clamav signatures ? They should be able to catch such may.

Also check your rules that are being matched by the message you could have bayes poisoning.

To catch the message you will have to write a custom spamassassin rule. something like

Code:

body MY_INTERIA_RULE /interia\.pl/i
score MY_INTERIA_RULE 10.0


padonker 23rd April 2009 14:16

Thanks,
In which conf file do I put such a rule?

topdog 23rd April 2009 14:35

/etc/mail/spamassassin/local.cf

padonker 24th April 2009 11:20

Thanks, that worked a lot, but still too much is passed through.
I noticed that even though they are found on, amongst others, DCC, the score does not reach my defined level of 5.
I've looked in all config files but cannot find the right place where to tinker with the scores.
Any suggestions?

http://img261.imageshack.us/img261/2...2009101212.png

topdog 24th April 2009 11:24

Put your custom scores in /etc/mail/spamassassin/local.cf i suggest you raise your razor scores as well, razor is a network check which is expensive on resources have it score at 0.50 is just not efficient.

I suggest you score anything in razor at 5.0 and above

padonker 24th April 2009 11:30

is there a place where I can look up the syntax for such things? Don't want to bother for every little thingy :o

topdog 24th April 2009 11:36

for the razor rules you need this

Code:

score 5.0 RAZOR2_CF_RANGE_51_100
score 5.0 RAZOR2_CF_RANGE_E4_51_100
score 5.0 RAZOR2_CHECK

And yes, if you read the spamassassin documentation as well as the wiki, writing of rules is explained. You can also look at the rules that come with the installation. You will be some basic perl knowledge though to understand them.

padonker 24th April 2009 11:50

excellent! great help :D


All times are GMT +2. The time now is 21:30.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.