ScamNailer

[Richard Mealing]

Hi everyone,

I'm trying to implement ScamNailer and I'm using the perl script to download the ScamNailer.cf file into my spamassassin directory.


On that file I can see lots of rules included with a score at the very bottom. I'm just wondering if I have to add a line to the "SpamAssassin Rule Actions" directive or can I leave spamassassin to deal with the scores?



The reason I am asking is that I've run this most of the day today and so far I can't see it's tripped on any emails using a "grep SCAMNAILER /var/log/maillog".




Thanks,
Rich
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130722/e51ca50a/attachment.html

[Mark Sapiro]

I?m trying to implement ScamNailer and I?m using the perl script to
download the ScamNailer.cf file into my spamassassin directory.

First of all, see the thread that begins
at<http://lists.mailscanner.info/pipermail/mailscanner/2013-June/100789.html>
and particularly, the patch in the post at
<http://lists.mailscanner.info/pipermail/mailscanner/2013-June/100822.html>.

Otherwise you will be working with old data.

On that file I can see lots of rules included with a score at the very
bottom. I?m just wondering if I have to add a line to the ?SpamAssassin
Rule Actions? directive or can I leave spamassassin to deal with the scores?

The bottom has a score for the rule 'SCAMNAILER'. The score is not
important, but you need a 'SpamAssassin Rule Actions' rule or ruleset
for it. See the documentation in MailScanner.conf around line 2551
starting with "# This next setting is very powerful."

In my case, I have

SpamAssassin Rule Actions = %rules-dir%/spamassassin_rule_actions.rules

and for the default rule I have

FromOrTo: default SCAMNAILER=>store,not-deliver,forward
user+phish at example.com,header "X-GPC-MailScanner-Originally-To: _TO_"

which will store the message in quarantine, not deliver it, forward it
to user+phish at example.com and add the header
X-GPC-MailScanner-Originally-To: with the original envelope recipient to
the forwarded message.

[Richard Mealing]

Hi Mark,

Thanks for this. I went for the database clamd option in the end.
I don't imagine there's any difference. I want the phishing just added as spam viruses (which share the same header as normal spam), but I might split up phishing and spam viruses at some point.

It's all working now. Thanks for your explanation (and sorry for top posting).


Rich





-----Original Message-----
From: Mark Sapiro [mailto:mark at msapiro.net]
Sent: 23 July 2013 20:13
To: MailScanner discussion
Cc: Richard Mealing
Subject: Re: ScamNailer

Post by Richard Mealing
I'm trying to implement ScamNailer and I'm using the perl script to
download the ScamNailer.cf file into my spamassassin directory.

First of all, see the thread that begins at<http://lists.mailscanner.info/pipermail/mailscanner/2013-June/100789.html>
and particularly, the patch in the post at <http://lists.mailscanner.info/pipermail/mailscanner/2013-June/100822.html>.

Otherwise you will be working with old data.

Post by Richard Mealing
On that file I can see lots of rules included with a score at the very
bottom. I'm just wondering if I have to add a line to the
"SpamAssassin Rule Actions" directive or can I leave spamassassin to deal with the scores?

The bottom has a score for the rule 'SCAMNAILER'. The score is not important, but you need a 'SpamAssassin Rule Actions' rule or ruleset for it. See the documentation in MailScanner.conf around line 2551 starting with "# This next setting is very powerful."

In my case, I have

SpamAssassin Rule Actions = %rules-dir%/spamassassin_rule_actions.rules

and for the default rule I have

FromOrTo: default SCAMNAILER=>store,not-deliver,forward
user+phish at example.com,header "X-GPC-MailScanner-Originally-To: _TO_"

which will store the message in quarantine, not deliver it, forward it to user+phish at example.com and add the header
X-GPC-MailScanner-Originally-To: with the original envelope recipient to the forwarded message.