On 08/17/03 02:53 PM, Martin Radford sat at the `puter and typed:
> At Sun Aug 17 13:53:47 2003, Louis LeBlanc wrote:
> >
> > > >I want to do this w/ DNSBL -- if a mail comes from an MTA that is listed on
> > > >2+ DNSBL lists, multiply the score by a bunch.
> > >
> > > No, but you could use a meta rule and add more points..
> > >
> > > Something like this:
> > >
> > > meta LOCAL_MANY_RBLS ((RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >1)
> > > score LOCAL_MANY_RBLS 1.0
> >
> > Very cool idea. There isn't a way to save the added value and simply
> > use that as the score?
>
> Don't think so.
>
> Of course, you could do the following:
>
> meta LOCAL_MANY_RBLS_2 ((RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >1)
> score LOCAL_MANY_RBLS_2 1.0
> meta LOCAL_MANY_RBLS_3 ((RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >2)
> score LOCAL_MANY_RBLS_3 1.0
> ... and so on.
>
> So, if you hit two or more RBLs, add 1.0 to the total; three RBLs, add
> another 1.0 to the total.
>
> Martin
I like the idea very much. I've written 5 rules based on those you've
provided above, and placed them in my ~/.spamassassin/user_prefs as
follows:
meta LOCAL_MANY_RBLS_2 ((RCVD_IN_OSIRUSOFT_COM + RCVD_IN_BL_SPAMCOP_NET +
RCVD_IN_NJABL + RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >1)
score LOCAL_MANY_RBLS_2 1.0
describe LOCAL_MANY_RBLS_2 found in at least 2 RBLs
meta LOCAL_MANY_RBLS_3 ((RCVD_IN_OSIRUSOFT_COM + RCVD_IN_BL_SPAMCOP_NET +
RCVD_IN_NJABL + RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >2)
score LOCAL_MANY_RBLS_3 1.0
describe LOCAL_MANY_RBLS_3 found in at least 3 RBLs
meta LOCAL_MANY_RBLS_4 ((RCVD_IN_OSIRUSOFT_COM + RCVD_IN_BL_SPAMCOP_NET +
RCVD_IN_NJABL + RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >3)
score LOCAL_MANY_RBLS_4 1.0
describe LOCAL_MANY_RBLS_4 found in at least 4 RBLs
meta LOCAL_MANY_RBLS_5 ((RCVD_IN_OSIRUSOFT_COM + RCVD_IN_BL_SPAMCOP_NET +
RCVD_IN_NJABL + RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >4)
score LOCAL_MANY_RBLS_5 1.0
describe LOCAL_MANY_RBLS_5 found in at least 5 RBLs
meta LOCAL_MANY_RBLS_6 ((RCVD_IN_OSIRUSOFT_COM + RCVD_IN_BL_SPAMCOP_NET +
RCVD_IN_NJABL + RCVD_IN_DSBL + RCVD_IN_RFCI + RCVD_IN_SBL) >5)
score LOCAL_MANY_RBLS_6 1.0
describe LOCAL_MANY_RBLS_6 found in 6 RBLs
However, this just came in and it appears there's some kind of test
execution order problem:
X-Spam-Status: Yes, hits=16.5 required=3.7
tests=CLICK_BELOW,FORGED_YAHOO_RCVD,HTML_20_30,
HTML_FONT_COLOR_BLUE,HTML_LINK_CLICK_HERE,
MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
MSG_ID_ADDED_BY_MTA_3,NORMAL_HTTP_TO_IP,PRIORITY_NO_NAME,
RCVD_FAKE_HELO_DOTCOM_2,RCVD_IN_DSBL,RCVD_IN_NJABL,
RCVD_IN_OSIRUSOFT_COM
version=2.55
X-Spam-Level: ****************
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Spam-Report: ---- Start SpamAssassin results
16.50 points, 3.7 required;
* 1.5 -- BODY: Message is 20% to 30% HTML
* 0.1 -- BODY: HTML link text says "click here"
* 0.1 -- BODY: HTML font color is blue
* 0.7 -- URI: Uses a dotted-decimal IP address in URL
* 2.8 -- Received contains a faked HELO hostname (2)
* 2.7 -- 'From' yahoo.com does not match 'Received' headers
* 0.9 -- 'Message-Id' was added by a relay (3)
* 4.3 -- RBL: Received via a relay in list.dsbl.org
[RBL check: found 83.154.243.210.list.dsbl.org.]
* 0.8 -- RBL: Received via a relay in dnsbl.njabl.org
[RBL check: found 83.154.243.210.dnsbl.njabl.org., type: 127.0.0.9]
* 0.9 -- RBL: Received via a relay in relays.osirusoft.com
[RBL check: found 83.154.243.210.relays.osirusoft.com., type: 127.0.0.9]
* 0.0 -- Asks you to click below
* 0.4 -- Message has priority setting, but no X-Mailer
* 0.1 -- Message only has text/html MIME parts
* 1.2 -- 'Content-Type' found without required MIME headers
---- End of SpamAssassin results
X-Spam-Flag: YES
Since none of my LOCAL_MANY_RBLS_* tests were hit, I can only assume
that there was some test order issue - it's checking these before the
results from the network tests are in.
Does this mean these won't work, or is there a way to dictate when
they are checked?
Thanks a lot for getting me this far.
Lou
--
Louis LeBlanc [EMAIL PROTECTED]
Fully Funded Hobbyist, KeySlapper Extrordinaire :)
http://www.keyslapper.org ԿԬ
No one may kill a man. Not for any purpose. It cannot be condoned.
-- Kirk, "Spock's Brain", stardate 5431.6
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
