Rules with object/quarantine and whitelist

[fab909]

Hello

I created "What Object" who block mails who have field contains "newsletter@" and make following action :
- quarantine
- Modify spam subject
-> OK it works!

But if user whitelist a mail blocked with this rule, the whitelist doesn't work (I tested with differente priority + and -)

Thanks for your help

 

[fab909]

I carry on my research.
I tested to create objet for modify SPAM-LEVEL-SCORE

So I create new object:
TITLE: Set SPAM LEVEL 5
TYPE: HEADER ATTRIBUT
FIELD : X-SPAM-LEVEL
VALUE : 5 (also test with: Spam detection results: 5)

And in my rule action (block sender) > action object > Set SPAM LEVEL 5
But the spam level is the same

Mail header:
X-SPAM-LEVEL: Spam detection results: 0

 

[fab909]

the question is : Can we set spam score with an object action ?

 

[Stoiko Ivanov]

I created "What Object" who block mails who have field contains "newsletter@" and make following action :

That should be a rule and not a what object?

* could you post some (anonymized) loglines of such mails (/var/log/mail.log)?

But if user whitelist a mail blocked with this rule, the whitelist doesn't work (I tested with differente priority + and -)

* The user white/black list basically are there to prevent mails from getting into the spam-quarantine, but rather get directly delivered to the users
* This is in contrast to the Admin or Global white/black list which can be used in the rule system to let mail get delivered directly or blocked without taking into consideration the spamscore

the question is : Can we set spam score with an object action ?

* This is not possible directly - since the spamscore is determined via SpamAssassin.
* You could create a custom spamassassin configuration to add a spamscore to a certain mail ( see the admin guide https://www.proxmox.com/images/download/pmg/docs/pmg-admin-guide.pdf - section 4.8)
* Additionally since PMG-5.2 you have the possibility to create a custom check script which has access to the mail and can set a spam-score (admin guide section 4.9)

Hope this helps!

 

[fab909]

Hello

I try to add custom rule, exemple :
add file : /etc/mail/spamassassin/custom.cf

mimeheader MIME_FAIL   Content-Type =~ /\.(ade|adp|bat|chm|cmd|com|cpl|exe|hta|ins|isp|jse|lib|lnk|mde|msc|msp|mst|pif|scr|sct|shb|sys|vb|vbe|vbs|vxd|wsc|wsf|wsh|reg)\b/i
describe   MIME_FAIL   Blacklisted file extension detected
score      MIME_FAIL   5

SSH (no error):

spamassassin --lint

Test send mail with file toto.vxd

But the mail received haven't the 5 score

X-SPAM-LEVEL: Spam detection results:  0

I forgot to do something ?

 

[fluxX04]

Hi,

try to sync the config with:

pmgconfig sync --restart 1

and test again.

Greetz

 

[fab909]

thanks for your answer but unfortunately still the same problem

 

[fab909]

I saw it has a include KAM.cf (PMG filter) in local.cf :

include /usr/share/spamassassin-extra/KAM.cf

It's works if I added my include into local.cf:

include /etc/mail/spamassassin/custom.cf

Mail header

MIME_FAIL 5 Blacklisted file extension detected

it's a bug ? can I let my include ?

 

[fluxX04]

Hi,

i'm using also the custom.cf for own rules and i didn't include them in local.cf.
I search around here and you have to restart the pmg-smtp-filter service to refresh the rules:

systemctl restart pmg-smtp-filter

or restart the service over the GUI: Administration -> Services

Greetz

 

[fab909]

Hi,

i'm using also the custom.cf for own rules and i didn't include them in local.cf.
I search around here and you have to restart the pmg-smtp-filter service to refresh the rules:

systemctl restart pmg-smtp-filter

or restart the service over the GUI: Administration -> Services

Greetz

Yes! you are right!
I remove my include and using "systemctl restart pmg-smtp-filter" it works!

I am searching a regex for changing score of a mail which would contain prefix 'newsletter@' would you have the syntax of rule for that ?

 

[fluxX04]

Hi,

here is a good start to understand and what is possible with the rules:
https://wiki.apache.org/spamassassin/WritingRules

Is that the from address?
Maybe something like this:

header NEWSLETTER   From =~ /newsletter\@/i
describe NEWSLETTER Contains newsletter in from address
score NEWSLETTER    10

Greetz