You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Patrick Steiner <pa...@a1.net> on 2005/05/19 08:20:08 UTC
German Spam local.conf
hello,
i am totally unskilled in config spamassisn, but i found this url:
http://www.exit0.us/index.php?pagename=GermanSoberSpamBounceRules
i but the text into my /etc/mail/spamassassin/local.conf
and restarted spamassassin. but spamc doesnt use the rules :-(.
if have tryed:spamc < 1116480451.P29200Q0M105826.isengard.skynet\:2\,Sc
Return-path: <xx...@xxx.com>
Received: from mmp.a1.net [194.48.124.160]
by localhost with POP3 (fetchmail-6.2.5)
for pat@isengard.skynet (single-drop); Wed, 18 May 2005 09:50:05
+0200 (CEST)
Received: from uxmtat02-real.net.mobilkom.at
(uxmtat02-real.net.mobilkom.at [194.48.125.55]) by
msgstore4.net.mobilkom.at
(A1.net ORGANIZER - Alle Emails und Termine fest im Griff)
with ESMTP id <0I...@msgstore4.net.mobilkom.at> for law@a1.net;
Wed, 18 May 2005 09:48:30 +0200 (MEST)
Received: from okioweoj.com (N712P016.adsl.highway.telekom.at
[62.47.32.240])
by smtpin2.a1.net (A1.net ORGANIZER - Alle Emails und Termine fest im
Griff)
with SMTP id <0I...@smtpin2.a1.net> for law@a1.net
(ORCPT law@a1.net); Wed, 18 May 2005 09:48:30 +0200 (MEST)
Date: Wed, 18 May 2005 07:44:32 +0000 (GMT)
From: SMTPmetallbau.wilhelmer@carinthia.com
Subject: Auslaenderpolitik
To: Server@a1.net
Message-id: <f5...@carinthia.com>
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii
Content-transfer-encoding: 7bit
Importance: Normal
X-Priority: 3 (Normal)
Original-recipient: rfc822;law@a1.net
X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.2 with clamscan / ClamAV
0.85/884/Wed May 18 00:14:26 2005
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on isengard.skynet
X-Spam-Level: ****
X-Spam-Status: No, score=4.5 required=5.0 tests=AWL,BAYES_80,
DNS_FROM_RFC_POST,NO_REAL_NAME,PRIORITY_NO_NAME,RCVD_IN_SORBS_WEB
autolearn=no version=3.0.3
Lese selbst:
http://www.mjoelnirsseite.de/2100.htm
here is my local.conf:
# These values can be overridden by editing ~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)
# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.
required_hits 5
report_safe 0
rewrite_header Subject [SPAM]
#ruleset to catch german sober virus spam bounces
#adapted from Raymond Dijkxhoor's original ruleset by Kevin Peuhkurinen
#http://www.exit0.us/index.php?pagename=GermanSoberSpamBounceRules
body __PROLO_GSPAMB01 /Gegen das Vergessen/i
body __PROLO_GSPAMB02 /Verbrechen der deutschen Frau/i
body __PROLO_GSPAMB03 /Dresden Bombing Is To Be Regretted Enormously/i
body __PROLO_GSPAMB04 /Graeberschaendung auf bundesdeutsche Anordnung/i
body __PROLO_GSPAMB05 /Deutsche Buerger trauen sich nicht \.\.\./i
body __PROLO_GSPAMB06 /S\.O\.S. Kiez\! Polizei schlaegt Alarm/i
body __PROLO_GSPAMB07 /Schily ueber Deutschland/i
body __PROLO_GSPAMB08 /Massenhafter Steuerbetrug durch auslaendische
Arbeitnehmer/i
body __PROLO_GSPAMB09 /The Whore Lived Like a German/i
body __PROLO_GSPAMB10 /Transparenz ist das Mindeste/i
body __PROLO_GSPAMB11 /Volk wird nur zum zahlen gebraucht!/i
body __PROLO_GSPAMB12 /Trotz Stellenabbau/i
body __PROLO_GSPAMB13 /Augen auf/i
body __PROLO_GSPAMB14 /Armenian Genocide Plagues Ankara 90 Years On/i
body __PROLO_GSPAMB15 /Du wirst ausspioniert \.\.\.\.\!/i
body __PROLO_GSPAMB16 /Dresden 1945/i
body __PROLO_GSPAMB17 /Blutige Selbstjustiz/i
body __PROLO_GSPAMB18 /Turkish Tabloid Enrages Germany with Nazi
Comparisons/i
body __PROLO_GSPAMB19 /Multi-Kulturell \= Multi-Kriminell/i
body __PROLO_GSPAMB20 /60 Jahre Befreiung: Wer feiert mit?/i
body __PROLO_GSPAMB21 /Vorbildliche Aktion/i
body __PROLO_GSPAMB22 /Auf Streife durch den Berliner Wedding/i
body __PROLO_GSPAMB23 /Tuerkei in die EU/i
body __PROLO_GSPAMB24 /Paranoider Deutschenmoerder kommt in Psychiatrie/i
body __PROLO_GSPAMB25 /Hier sind wir Lehrer die einzigen Auslaender/i
body __PROLO_GSPAMB26 /4\,8 Mill\. Osteuropaeer durch Fischer-Volmer
Erlass/i
body __PROLO_GSPAMB27 /Du wirst zum Sklaven gemacht\!\!\!/i
body __PROLO_GSPAMB28 /Deutsche werden kuenftig beim Arzt abgezockt/i
body __PROLO_GSPAMB29 /Auslaenderpolitik/i
body __PROLO_GSPAMB30 /Auslaender bevorzugt/i
body __PROLO_GSPAMB31 /Can you believe this still happens today/i
header __KP_DAEMON From =~
/(?:postmaster|daemon|administrator|automated|subsystem)/i
header __KP_UNDELIV Subject =~
/(?:undeliverable|returned|failed|failure)/i
meta KP_GSPAMB01 __PROLO_GSPAMB01 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB02 __PROLO_GSPAMB02 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB03 __PROLO_GSPAMB03 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB04 __PROLO_GSPAMB04 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB05 __PROLO_GSPAMB05 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB06 __PROLO_GSPAMB06 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB07 __PROLO_GSPAMB07 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB08 __PROLO_GSPAMB08 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB09 __PROLO_GSPAMB09 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB10 __PROLO_GSPAMB10 && (__KP_DAEMON || __KP_UNDELIV)
meta KP_GSPAMB11 __PROLO_GSPAMB11 && (__KP_DAEMON || __KP_UNDELIV)
patrick
Re: German Spam local.conf
Posted by wolfgang <me...@gmx.net>.
In an older episode (Thursday 19 May 2005 08:20), Patrick Steiner wrote:
> hello,
>
> i am totally unskilled in config spamassisn, but i found this url:
>
> http://www.exit0.us/index.php?pagename=GermanSoberSpamBounceRules
That file will only detect Non Delivery Notifications that have been sent in
reply to the sober spam. You are running it on one of the spams, not on a non
delivery notification.
> i but the text into my /etc/mail/spamassassin/local.conf
As pointed out here before, that is to be local.cf, or any .cf file, not
local.conf tho.
> From: SMTPmetallbau.wilhelmer@carinthia.com
does not match
header __KP_DAEMON From =~ /(?:postmaster|daemon|administrator|
automated|subsystem)/i
> Subject: Auslaenderpolitik
does not match
header __KP_UNDELIV Subject =~ /(?:undeliverable|returned|failed|
failure)/i
rules to detect the original sober spam can be found at
http://mailscanner.prolocation.net/german.cf
http://weir.dattitu.de/archives/9-Filtering-Sober-P.html
regards,
wolfgang
Re: German Spam local.conf
Posted by Kris Deugau <kd...@vianet.ca>.
Alan Premselaar wrote:
> first, make sure your file is named local.cf and not local.conf.
> also, you don't appear to have any scores assigned to these rules.
> I'm not a rules writing expert, but these rules may not actually do
> anything for you without scores assigned.
ALL rules receive a default score of 1 - with the exception that rules
with names that begin with __ do not add to the total score for the
message.
-kgd
--
Get your mouse off of there! You don't know where that email has been!
Re: German Spam local.conf
Posted by Alan Premselaar <al...@12inch.com>.
Patrick Steiner wrote:
> hello,
>
> i am totally unskilled in config spamassisn, but i found this url:
>
> http://www.exit0.us/index.php?pagename=GermanSoberSpamBounceRules
>
> i but the text into my /etc/mail/spamassassin/local.conf
>
> and restarted spamassassin. but spamc doesnt use the rules :-(.
>
> if have tryed:spamc < 1116480451.P29200Q0M105826.isengard.skynet\:2\,Sc
> Return-path: <xx...@xxx.com>
> Received: from mmp.a1.net [194.48.124.160]
> by localhost with POP3 (fetchmail-6.2.5)
> for pat@isengard.skynet (single-drop); Wed, 18 May 2005 09:50:05
> +0200 (CEST)
> Received: from uxmtat02-real.net.mobilkom.at
> (uxmtat02-real.net.mobilkom.at [194.48.125.55]) by
> msgstore4.net.mobilkom.at
> (A1.net ORGANIZER - Alle Emails und Termine fest im Griff)
> with ESMTP id <0I...@msgstore4.net.mobilkom.at> for law@a1.net;
> Wed, 18 May 2005 09:48:30 +0200 (MEST)
> Received: from okioweoj.com (N712P016.adsl.highway.telekom.at
> [62.47.32.240])
> by smtpin2.a1.net (A1.net ORGANIZER - Alle Emails und Termine fest im
> Griff)
> with SMTP id <0I...@smtpin2.a1.net> for law@a1.net
> (ORCPT law@a1.net); Wed, 18 May 2005 09:48:30 +0200 (MEST)
> Date: Wed, 18 May 2005 07:44:32 +0000 (GMT)
> From: SMTPmetallbau.wilhelmer@carinthia.com
> Subject: Auslaenderpolitik
> To: Server@a1.net
> Message-id: <f5...@carinthia.com>
> MIME-version: 1.0
> Content-type: text/plain; charset=us-ascii
> Content-transfer-encoding: 7bit
> Importance: Normal
> X-Priority: 3 (Normal)
> Original-recipient: rfc822;law@a1.net
> X-Virus-Status: No
> X-Virus-Checker-Version: clamassassin 1.2.2 with clamscan / ClamAV
> 0.85/884/Wed May 18 00:14:26 2005
> X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on isengard.skynet
> X-Spam-Level: ****
> X-Spam-Status: No, score=4.5 required=5.0 tests=AWL,BAYES_80,
> DNS_FROM_RFC_POST,NO_REAL_NAME,PRIORITY_NO_NAME,RCVD_IN_SORBS_WEB
> autolearn=no version=3.0.3
>
> Lese selbst:
> http://www.mjoelnirsseite.de/2100.htm
>
>
> here is my local.conf:
> # These values can be overridden by editing ~/.spamassassin/user_prefs.cf
> # (see spamassassin(1) for details)
>
> # These should be safe assumptions and allow for simple visual sifting
> # without risking lost emails.
>
> required_hits 5
> report_safe 0
> rewrite_header Subject [SPAM]
>
> #ruleset to catch german sober virus spam bounces
> #adapted from Raymond Dijkxhoor's original ruleset by Kevin Peuhkurinen
> #http://www.exit0.us/index.php?pagename=GermanSoberSpamBounceRules
>
> body __PROLO_GSPAMB01 /Gegen das Vergessen/i
> body __PROLO_GSPAMB02 /Verbrechen der deutschen Frau/i
> body __PROLO_GSPAMB03 /Dresden Bombing Is To Be Regretted Enormously/i
> body __PROLO_GSPAMB04 /Graeberschaendung auf bundesdeutsche Anordnung/i
> body __PROLO_GSPAMB05 /Deutsche Buerger trauen sich nicht \.\.\./i
> body __PROLO_GSPAMB06 /S\.O\.S. Kiez\! Polizei schlaegt Alarm/i
> body __PROLO_GSPAMB07 /Schily ueber Deutschland/i
> body __PROLO_GSPAMB08 /Massenhafter Steuerbetrug durch auslaendische
> Arbeitnehmer/i
> body __PROLO_GSPAMB09 /The Whore Lived Like a German/i
> body __PROLO_GSPAMB10 /Transparenz ist das Mindeste/i
> body __PROLO_GSPAMB11 /Volk wird nur zum zahlen gebraucht!/i
> body __PROLO_GSPAMB12 /Trotz Stellenabbau/i
> body __PROLO_GSPAMB13 /Augen auf/i
> body __PROLO_GSPAMB14 /Armenian Genocide Plagues Ankara 90 Years On/i
> body __PROLO_GSPAMB15 /Du wirst ausspioniert \.\.\.\.\!/i
> body __PROLO_GSPAMB16 /Dresden 1945/i
> body __PROLO_GSPAMB17 /Blutige Selbstjustiz/i
> body __PROLO_GSPAMB18 /Turkish Tabloid Enrages Germany with Nazi
> Comparisons/i
> body __PROLO_GSPAMB19 /Multi-Kulturell \= Multi-Kriminell/i
> body __PROLO_GSPAMB20 /60 Jahre Befreiung: Wer feiert mit?/i
> body __PROLO_GSPAMB21 /Vorbildliche Aktion/i
> body __PROLO_GSPAMB22 /Auf Streife durch den Berliner Wedding/i
> body __PROLO_GSPAMB23 /Tuerkei in die EU/i
> body __PROLO_GSPAMB24 /Paranoider Deutschenmoerder kommt in Psychiatrie/i
> body __PROLO_GSPAMB25 /Hier sind wir Lehrer die einzigen Auslaender/i
> body __PROLO_GSPAMB26 /4\,8 Mill\. Osteuropaeer durch Fischer-Volmer
> Erlass/i
> body __PROLO_GSPAMB27 /Du wirst zum Sklaven gemacht\!\!\!/i
> body __PROLO_GSPAMB28 /Deutsche werden kuenftig beim Arzt abgezockt/i
> body __PROLO_GSPAMB29 /Auslaenderpolitik/i
> body __PROLO_GSPAMB30 /Auslaender bevorzugt/i
> body __PROLO_GSPAMB31 /Can you believe this still happens today/i
>
> header __KP_DAEMON From =~
> /(?:postmaster|daemon|administrator|automated|subsystem)/i
> header __KP_UNDELIV Subject =~
> /(?:undeliverable|returned|failed|failure)/i
>
> meta KP_GSPAMB01 __PROLO_GSPAMB01 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB02 __PROLO_GSPAMB02 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB03 __PROLO_GSPAMB03 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB04 __PROLO_GSPAMB04 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB05 __PROLO_GSPAMB05 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB06 __PROLO_GSPAMB06 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB07 __PROLO_GSPAMB07 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB08 __PROLO_GSPAMB08 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB09 __PROLO_GSPAMB09 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB10 __PROLO_GSPAMB10 && (__KP_DAEMON || __KP_UNDELIV)
> meta KP_GSPAMB11 __PROLO_GSPAMB11 && (__KP_DAEMON || __KP_UNDELIV)
>
>
> patrick
>
>
Patrick,
first, make sure your file is named local.cf and not local.conf.
also, you don't appear to have any scores assigned to these rules. I'm
not a rules writing expert, but these rules may not actually do anything
for you without scores assigned.
running spamassassin --lint after making the changes will check for any
problems. I highly recommend doing this.
lastly, make sure you restart spamd after making changes if you're using
spamd.
hope this helps
alan