##### # # Copyright (C) 2006 G Ramon Gomez <gene at gomezbrothers dot com> # All Rights Reserved # # This file is part of the Prelude-LML program. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; see the file COPYING. If not, write to # the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. # ##### ##### # # Each supported MTA should have a rule that creates a context to # be used by the spamd rule to match up originator information. # ##### ##### # # Once the MTAs set up their contexts, the SpamAssassin-specific rule can # be called # ##### #LOG: Apr 28 11:09:56 awale postfix/smtpd[30879]: 8144DC232CF: client=benji1.traduc.org[213.246.37.27] regex=(\S+): client=(\S+)[\S+]; \ new_context=SPAMASSASSIN_$1,expire:10; \ source(0).node.name = $2; \ source(0).node.address(>>).address = $3; \ silent; #LOG: Apr 28 11:09:56 awale postfix/qmgr[5304]: 8144DC232CF: from=<mailman-bounces@traduc.org>, size=15179, nrcpt=1 (queue active) regex=(\S+): from=<(\S+)>, size=(\d+); \ require_context=SPAMASSASSIN_$1; \ source(0).node.address(>>).address = $2; \ additional_data(0).type=integer; \ additional_data(0).meaning=Size; \ additional_data(0).data=$3; \ silent; #LOG:Apr 5 16:59:44 vm-mail spamd[1819]: spamd: result: Y 999 - ALL_TRUSTED,GTUBE,NO_REAL_NAME scantime=0.1,size=769,user=jenny@yyy.com,uid=8,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=38643,mid=<443459EF.mail1EK1XC3LT@xxx.com>,autolearn=no regex=spamd: result: Y (\d+) - (\S+) scantime=([\d\.]+),size=\d+,user=(\S+),uid=(\d+),required_score=([\d\.]+)\S+mid=<(\S+@\S+)>; \ require_context=SPAMASSASSIN_$7; \ classification.text=Spam found; \ analyzer(0).name=SpamAssassin; \ analyzer(0).manufacturer=http://spamassassin.apache.org/; \ analyzer(0).class=Antispam; \ assessment.impact.severity=low; \ assessment.impact.completion=failed; \ assessment.impact.type=user; \ assessment.impact.description=SpamAssassin detected spam being sent to $4. This spam scored $1 of a required $6 points.; \ target(0).node.address(0).category=e-mail; \ target(0).node.address(0).address=$4; \ target(0).user.user_id(0).type=target-user; \ target(0).user.user_id(0).number=$5; \ additional_data(>>).type=string; \ additional_data(>>).meaning=Signatures matched; \ additional_data(>>).data=$2; \ additional_data(>>).type=integer; \ additional_data(>>).meaning=Score; \ additional_data(>>).data=$1; \ additional_data(>>).type=string; \ additional_data(>>).meaning=Required Score; \ additional_data(>>).data=$6; \ additional_data(>>).type=string; \ additional_data(>>).meaning=Scan time; \ additional_data(>>).data=$3; \ additional_data(>>).type=integer; \ additional_data(>>).meaning=Size; \ additional_data(>>).data=$2; \ last