Matthew Burgess wrote: > Bruce Dubbs wrote: > >> Declan Moriarty wrote: >> >>> may I suggest you add the ruleset >>> 70_sare_spoof.cf to trusted rulesets on your spamassassin installation, >>> as that will catch the forged ebay and forged paypal spam causing so >>> much annoyance these days. Vipul's Razor also catches about 50% of them. >>> It should also be possible to blacklist paypal and ebay adresses >>> (*.paypal.com, *.ebay.*, *.ebay.*.*). >> >> >> >> I use Mozilla as my spam catcher so I am not in a position to test >> this out. Randy, what do you think? > > > I already forwarded this to Gerard. He's away for a couple of days, but > should be able to get around to this when he gets back. Alternatively, > if someone can hand-hold me I'll update the spamassasin configuration > myself, though said person will also have to deal with forwarded support > requests if things go belly-up. > > Regards, > > Matt. >
grab it from http://www.rulesemporium.com/rules/ and drop it into /etc/mail/spamassassin for all lists, but it might be better to create a high scoring body test just for ebay and paypal mails in the local.cf...actually better in it's own cf file (if something goes wrong, just rename it without the .cf extension and restart SA). Something to the effect of this: body LOCAL_EBAY_DROP /\bebay\b/i score LOCAL_EBAY_DROP 10.0 describe LOCAL_EBAY_DROP Case insensitive regex for 'ebay' body LOCAL_PAYPAL_DROP /\bpaypal\b/i score LOCAL_PAYPAL_DROP 10.0 describe LOCAL_PAYPAL_DROP Case insensitve regex for 'paypal' That said, hi-scoring on any one rule is generally considered a very very very bad thing to do. For instance, the score for each mail in this thread would have been increased by 10 points even though they are legitimate mails, that is why it's a bad idea and you should let SA build up the score using the multiple rules. I'm also very green WRT to customizing spamassassin, so hopefully somebody who knows a lot more than I can step in and comment on the above. The default rule sets have worked well for me until recently. BAYES_00 and AWL have had a major play in a lot of junk slipping through. I'd like to drop AWL and bayes caches for my vmail user, but I am unsure of the consequences. Wonder if there is a way to set a limit on the amount of time data is cached. I see the same tests (AWL and BAYES_00) droping to negative scores on some of the spam that is getting through on belgarath. Anyway, hope it helps or give at least an idea where to start looking. Sombody who knows more, please follow up as it might be good to clear bayes and auto white lists. Declan, please add to the above or clarify furthur if you can. Thanks. -- DJ Lucas -- http://linuxfromscratch.org/mailman/listinfo/blfs-dev FAQ: http://www.linuxfromscratch.org/blfs/faq.html Unsubscribe: See the above information page
