Stuff for SpamAssassin

What's this? | Notes | Links | Files

This is just some stuff we use with SpamAssassin in our mail gateway.

What's this?

• cmailer.cf is a rule file for SpamAssassin matching some swedish spam we see here.
• p0fOS.pm is a plugin that fetches operating system information from a p0f database and puts it in a header for use by bayes and rules.
• SentOutDB.pm is a plugin that compares incoming mail to a database of sent mail in order to find replies (for negative scoring). We populate the database with our mimedefang-filter, but it shouldn't be too hard to do it some other way.
• DictionaryCheckDB.pm is a plugin that checks a database used by our mimedefang-filter for handling dictionary attacks and other bad behaviour.
• CollectTokens.pm is a plugin that collects tokens from bayes in a SQL database, making it possible to see what tokens the bayes database contains.
• MimeMagic.pm is an experimental plugin that checks for mismatches between a parts MIME type and its actual content. Some mismatches really aren't, so it can have a map between types that are considered equal.
• RepeatMessageDB.pm is a plugin that checks a database used by our mimedefang-filter for repeated messages (with the same envelope from, envelope to and Message-Id) and spam.
• HashCount.pm is a plugin that counts messages using IxHash/NixSpam like hashes.
• HeadersToBody.pm is a plugin that copies the (decoded) content of specified headers to the decoded/rendered body of a the message object.
• URLRedirect.pm follows specified URLs to see if they redirect. If they do redirect, the new location is added to the message meta-data. The idea is to allow URIBLs to check the real destination behind a "shortened" URL.
• ExtractText.pm uses plugin extractors and/or external tools to extract text from message parts. Extractor plugins can extract parts that will be fed into the plugin for checking, so for example a an image OCR extractor could get to check images extracted from a PDF by another extractor. How to extract what from what is very configurable.
• FetchAndSendMail.pl is a perl script that fetches mail from mailboxes, runs them through SpamAssassin and sends them to an address. It currently handles POP3.

Notes

• If this stuff is of interest for you, it's possible that you'll also have an interest in our mimedefang-filter or our p0fOS.pm stuff.

Links

We're using some stuff others have provided as well as our own additions.

• SpamAssassin: It's hard to use it without it...
• Botnet: An excellent plugin that triggers on zombie signs.
• ImageInfo: Fast lean way to catch a lot of image spam.
• Malware Block List: Rules for stopping malware.
• SwiNOG Block Lists: DNS Based relay and URI black lists.
• OpenProtect's SpamAssassin sa-update channel: Makes it easy to use SARE rule sets.
• SARE: The SpamAssassin Rules Emporium.

Files

• cmailer.cf (view)
• p0fOS.pm (view)
• SentOutDB.pm (view)
• DictionaryCheckDB.pm (view)
• CollectTokens.pm (view)
• MimeMagic.pm (view)
• RepeatMessageDB.pm (view)
• HashCount.pm (view)
• HeadersToBody.pm (view)
• URLRedirect.zip (view: module | config | hostpath list | subdomain list)
  
• ExtractText.zip (view: file list | module | config | OpenXML extractor | Example extractor | unrtf tags)
  
• FetchAndSendMail.pl (view)

Regards
/Jonas EckermanDon't send mail to sa@trammer.frukt.org.

(2009-10-13)