SpamAssassin Rule Actions

Kevin Miller kevin.miller at juneau.org
Thu Jan 24 23:19:59 UTC 2019


I have the following setting in my conf file, and it's working well (forwards mail that hits my sextortion rule to postmaster).
	SpamAssassin Rule Actions = CBJ_Ransom=>forward postmaster at juneau.org

I've been using the sanesecurity UNOFFICIAL clamav signatures, and have gotten mixed results from the malwarepatrol signatures.  It's hard to tell if the messages flagged as viruses are false positives or not so I quit using their clamav signatures in favor of the spamassassin ruleset which gives me more flexibility in what I do w/the hits.  There are over 1500 rules however, having the format below:
...
 body MBL_22060342              /kerte\.ml\/lazada\//i
 describe MBL_22060342  MBL: 22060342
 score MBL_22060342             5.0

 body MBL_22060468              /lanhodiepuytin\.com\/spFOu-lMI_NJ-VGE\/InvoiceCodeChanges\/US_us\//i
 describe MBL_22060468  MBL: 22060468
 score MBL_22060468             5.0

 body MBL_22061432              /horizonth\.com\/dwl\//i
 describe MBL_22061432  MBL: 22061432
 score MBL_22061432             5.0

I'd like to add them to the SpamAssassin Rule Actions but obviously don't want to hand enter all those rule names.  Will the SpamAssassin Rule Actions accept a partial string or wildcard, a la:
  SpamAssassin Rule Actions = CBJ_Ransom=>forward postmaster at juneau.org MBL_=>forward postmaster at juneau.org
Or 
  SpamAssassin Rule Actions = CBJ_Ransom=>forward postmaster at juneau.org MBL_*=>forward postmaster at juneau.org

Thanks...

...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357



More information about the MailScanner mailing list