How do it stop this: HABEAS_SWE -8.00 ?

[Martin Sapsed]

Peter Bonivart wrote:
> Andrew Stubbs wrote:
>
>> Spam is getting through because of the Habeas watermark. How do I stop
>> MailScanner treating these as non-spam ?
>
> Put...
>
> score HABEAS_SWE -0.5
>
> ...in your spam.assassin.prefs.conf. That way you can still see it in
> your logs.

Or better still the spell that some kind soul here offered:

# Jan 2004 : Fake Habeas
header __HABEAS_SWE         eval:message_is_habeas_swe( )
header __HAB_FORGE_BOUND    Content-Type =~ /boundary="--[0-9]{15,20}"/
header __HAB_FORGE_MID      Message-ID =~ /<[A-Z]{20,25}@[a-z]{3}/

meta LOCAL_HABEAS_FORGERY (__HAB_FORGE_BOUND && __HAB_FORGE_MID &&
__HABEAS_SWE)
meta HABEAS_SWE           (__HABEAS_SWE && ! LOCAL_HABEAS_FORGERY)
# -8.0 for default Habeas score.
describe LOCAL_HABEAS_FORGERY     Common Habeas Forgery
score LOCAL_HABEAS_FORGERY        3.5

which distinguishes the forged versions from the real ones.

(I must remember to credit the authors of these when I stash them away!)

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth