amavis | nooblet.org

Tested using Debian 7 Wheezy. To be added to /etc/logcheck/ignore.d.server/

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: \([-[:digit:]]+\) Passed (CLEAN|SPAM|SPAMMY),( LOCAL)?( \[(IPv6:)?[[:xdigit:].:]{3,39}\]){0,2} <[^>]*> -> <[^>]*>(,<[^>]*>)*,( Message-ID: <[^>]+>( \((added by[^)]+|sfid-[_[:xdigit:]]+)\))?,)?( Resent-Message-ID: <[^>]+>,)? mail_id: [-+[:alnum:]]+, Hits: (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, queued_as: [[:xdigit:]]+( OK id=[-[:alnum:]]+)?, [[:digit:]]+ ms$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: \([-[:digit:]]+\) Blocked SPAM,( LOCAL)?( \[(IPv6:)?[[:xdigit:].:]{3,39}\]){0,2} <[^>]*> -> <[^>]*>(,<[^>]*>)*,( Message-ID: <[^>]+>( \((added by[^)]+|sfid-[_[:xdigit:]]+)\))?,)?( Resent-Message-ID: <[^>]+>,)? mail_id: [-+[:alnum:]]+, Hits: (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, [[:digit:]]+ ms$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: \([-[:digit:]]+\) Passed (BAD-HEADER),.*$
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: \([-[:digit:]]+\) Blocked BANNED \([.,_ [:alnum:]-]+\),( LOCAL)?( \[(IPv6:)?[[:xdigit:].:]{3,39}\]){0,2} <[^>]*> -> <[^>]*>(,<[^>]*>)*,( quarantine: [/[:alnum:]-]+,)?( Message-ID: <[^>]+>( \((added by[^)]+|sfid-[_[:xdigit:]]+)\))?,)?( Resent-Message-ID: <[^>]+>,)? mail_id: [-+[:alnum:]]+, Hits: (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, [[:digit:]]+ ms$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: $[-[:digit:]]+$ Passed (CLEAN|SPAM|SPAMMY),( LOCAL)?( \[(IPv6:)?[[:xdigit:].:]{3,39}\]){0,2} <[^>]*> -> <[^>]*>(,<[^>]*>)*,( Message-ID: <[^>]+>( $(added by[^)]+|sfid-[_[:xdigit:]]+)$)?,)?( Resent-Message-ID: <[^>]+>,)? mail_id: [-+[:alnum:]]+, Hits: (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, queued_as: [[:xdigit:]]+( OK id=[-[:alnum:]]+)?, [[:digit:]]+ ms$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: $[-[:digit:]]+$ Blocked SPAM,( LOCAL)?( \[(IPv6:)?[[:xdigit:].:]{3,39}\]){0,2} <[^>]*> -> <[^>]*>(,<[^>]*>)*,( Message-ID: <[^>]+>( $(added by[^)]+|sfid-[_[:xdigit:]]+)$)?,)?( Resent-Message-ID: <[^>]+>,)? mail_id: [-+[:alnum:]]+, Hits: (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, [[:digit:]]+ ms$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: $[-[:digit:]]+$ Passed (BAD-HEADER),.*$

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ amavis\[[[:digit:]]+\]: $[-[:digit:]]+$ Blocked BANNED $[.,_ [:alnum:]-]+$,( LOCAL)?( \[(IPv6:)?[[:xdigit:].:]{3,39}\]){0,2} <[^>]*> -> <[^>]*>(,<[^>]*>)*,( quarantine: [/[:alnum:]-]+,)?( Message-ID: <[^>]+>( $(added by[^)]+|sfid-[_[:xdigit:]]+)$)?,)?( Resent-Message-ID: <[^>]+>,)? mail_id: [-+[:alnum:]]+, Hits: (-?[.[:digit:]]*)+, size: [[:xdigit:]]+, [[:digit:]]+ ms$

With javascript enabled, the above regex block has a toolbar with a copy-to-clipboard button.

I have quite a few of these custom filters, I’ll post some more at another time.

Postfix -> DSPAM -> Amavis/Spamassassin -> Postfix

Spamassassin can add scores depending on the DSPAM output by reading the headers that DSPAM adds.

These rules can be added to local.cf. They read confidence and result headers. Edit the scores to suit your setup.

# DSPAM RULES ###############
# Confidence  #
header DSPAM_CONFIDENCE_8X X-DSPAM-Confidence =~ /^0.8/
describe DSPAM_SPAM_8X DSPAM is moderately confident
score DSPAM_CONFIDENCE_8X 0.001
 
header DSPAM_CONFIDENCE_9X X-DSPAM-Confidence =~ /^0.9[0-8]/
describe DSPAM_SPAM_9X DSPAM is very confident
score DSPAM_CONFIDENCE_9X 0.001
 
header DSPAM_CONFIDENCE_99 X-DSPAM-Confidence =~ /^0.99/
describe DSPAM_SPAM_99 DSPAM is extremely confident
score DSPAM_CONFIDENCE_99 0.001
 
# Spam #
header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/
describe DSPAM_SPAM DSPAM claims it is spam
score DSPAM_SPAM 5
 
meta DSPAM_SPAM_8X (DSPAM_SPAM && DSPAM_CONFIDENCE_8X)
score DSPAM_SPAM_8X 1.5
 
meta DSPAM_SPAM_9X (DSPAM_SPAM && DSPAM_CONFIDENCE_9X)
score DSPAM_SPAM_9X 3.0
 
meta DSPAM_SPAM_99 (DSPAM_SPAM && DSPAM_CONFIDENCE_99)
score DSPAM_SPAM_99 5.0
 
# Ham #
header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
describe DSPAM_HAM DSPAM claims it is ham
score DSPAM_HAM -0.1
 
meta DSPAM_HAM_9X (DSPAM_HAM && DSPAM_CONFIDENCE_9X)
score DSPAM_HAM_9X -1.5
 
meta DSPAM_HAM_99 (DSPAM_HAM && DSPAM_CONFIDENCE_99)
score DSPAM_HAM_99 -5.0
 
# Whitelist #
 
header DSPAM_WHITELIST X-DSPAM-Result =~ /^Whitelisted$/
describe DSPAM_WHITELIST DSPAM has whitelisted this mail
score DSPAM_WHITELIST -2.0
 
meta DSPAM_WHITELIST_9X (DSPAM_WHITELIST && DSPAM_CONFIDENCE_9X)
score DSPAM_WHITELIST_9X -1.5
 
meta DSPAM_WHITELIST_99 (DSPAM_WHITELIST && DSPAM_CONFIDENCE_99)
score DSPAM_WHITELIST_99 -5.0

# DSPAM RULES ###############

# Confidence #

header DSPAM_CONFIDENCE_8X X-DSPAM-Confidence =~ /^0.8/

describe DSPAM_SPAM_8X DSPAM is moderately confident

score DSPAM_CONFIDENCE_8X 0.001

header DSPAM_CONFIDENCE_9X X-DSPAM-Confidence =~ /^0.9[0-8]/

describe DSPAM_SPAM_9X DSPAM is very confident

score DSPAM_CONFIDENCE_9X 0.001

header DSPAM_CONFIDENCE_99 X-DSPAM-Confidence =~ /^0.99/

describe DSPAM_SPAM_99 DSPAM is extremely confident

score DSPAM_CONFIDENCE_99 0.001

# Spam #

header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/

describe DSPAM_SPAM DSPAM claims it is spam

score DSPAM_SPAM 5

meta DSPAM_SPAM_8X (DSPAM_SPAM && DSPAM_CONFIDENCE_8X)

score DSPAM_SPAM_8X 1.5

meta DSPAM_SPAM_9X (DSPAM_SPAM && DSPAM_CONFIDENCE_9X)

score DSPAM_SPAM_9X 3.0

meta DSPAM_SPAM_99 (DSPAM_SPAM && DSPAM_CONFIDENCE_99)

score DSPAM_SPAM_99 5.0

# Ham #

header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/

describe DSPAM_HAM DSPAM claims it is ham

score DSPAM_HAM -0.1

meta DSPAM_HAM_9X (DSPAM_HAM && DSPAM_CONFIDENCE_9X)

score DSPAM_HAM_9X -1.5

meta DSPAM_HAM_99 (DSPAM_HAM && DSPAM_CONFIDENCE_99)

score DSPAM_HAM_99 -5.0

# Whitelist #

header DSPAM_WHITELIST X-DSPAM-Result =~ /^Whitelisted$/

describe DSPAM_WHITELIST DSPAM has whitelisted this mail

score DSPAM_WHITELIST -2.0

meta DSPAM_WHITELIST_9X (DSPAM_WHITELIST && DSPAM_CONFIDENCE_9X)

score DSPAM_WHITELIST_9X -1.5

meta DSPAM_WHITELIST_99 (DSPAM_WHITELIST && DSPAM_CONFIDENCE_99)

score DSPAM_WHITELIST_99 -5.0

#!/usr/bin/nooblet.org

/* not just your average nub */

Tag Archives: amavis

logcheck — amavisd-new filter

Integrating DSPAM with Spamassassin