John,
> > I'm still getting a few ZIPs, PDF, etc. getting though. I just noticed
> > this scoring in one of the headers. Note the score for the
> > sanesecurity=0.1:
> >
> > Res, score=5.819 tagged_above=2 required=4
> > tests=[AV:Email.Stk.Gen592.Sanesecurity.07071801.pdf=0.1, BAYES_99=3.5,
> > DKIM_POLICY_SIGNSOME=0, TVD_SPACE_RATIO=2.219]
> >
> > I am using amavisd-new with clamav 91.1. Where can I adjust this
> > scoring?
Bill Landry writes:
> That depends on whether you are using a spamassassin .cf file for scoring
> the header entries or if your scoring them in amavisd.conf. I would guess
> amavisd.conf since you would probably know if you setup a .cf file for
> scoring these.
>
> In amavisd.conf, look for the section starting with:
> @virus_name_to_spam_score_maps =
> You can then adjust the individual SaneSecurity and/or MSRBL scores there.
Right. Or better yet, add rules to a SpamAssassin config file (e.g. local.cf),
as suggested in release notes. This is also a reason why scores assigned
by amavisd itself are near-zero.
amavisd-new-2.5.0 release notes
Here is one example of such SA rules (some long lines are wrapped,
these should be unwrapped before placing them into local.cf):
header L_AV_Phish X-Amavis-AV-Status =~
m{\b(Email|HTML)\.Phishing\.}i
header L_AV_SS_Phish X-Amavis-AV-Status =~
m{\b(Email|Html)\.Phishing(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Scam X-Amavis-AV-Status =~
m{\b(Email|Html)\.(Scam[A-Za-z0-9]?)(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Spam X-Amavis-AV-Status =~
m{\b(Email|Html)\.(Spam|Bou|Stk|Loan|Cred|Job|Dipl|Doc)
(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Hdr X-Amavis-AV-Status =~
m{\b(Email|Html)\.Hdr(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Img X-Amavis-AV-Status =~
m{\b(Email|Html)\.(Img|ImgO)(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_MSRBL_Img X-Amavis-AV-Status =~ m{\bMSRBL-Images/}
header L_AV_MSRBL_Spam X-Amavis-AV-Status =~ m{\bMSRBL-SPAM\.}
score L_AV_Phish 14
score L_AV_SS_Phish -3
score L_AV_SS_Scam 8
score L_AV_SS_Spam 8
score L_AV_SS_Hdr 6
score L_AV_SS_Img 3.5
score L_AV_MSRBL_Img 3.5
score L_AV_MSRBL_Spam 6
Mark
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
