OT: DCC installation
Hi everyone, Is there any up-to-date howto available for DCC installation for use with SpamAssassin? I see some old questions about DCC on this list and mostly old howto's on the web. Best I found was this: http://wbitt.com/knowledge/how-to-tutorials/136-spamassassindccrazor-howto-for-qmail.html But it for example doesn't include --disable-dccm Other howtos seem to assume use of SA calling dccproc not mentioning dccifd at all. Any tips or links? Thank you everyone!
Re: Custom rule based on AWL score
On 24/10/16 16:46, John Hardin wrote: Paul: I haven't looked at the plugin myself yet, but here's a suggestion: have a mode where you can mark a RE as capturing a numeric value, and the rule's hit value is the value that the RE captured. This would (for example) let the AWL/TXREP mean be captured in a way it could be compared using gt/lt in a meta. Perhaps: tagcapnum __TXREP_IP_MEAN_TXREP_IP_MEAN_ /^(-?[\d]+(?:\.\d+)?)$/ metaTAGMATCH_TXREP_IP_HIGHSCORE __TXREP_IP_MEAN > 5.0 describeTAGMATCH_TXREP_IP_HIGHSCORE TXRep mean score quite large score TAGMATCH_TXREP_IP_HIGHSCORE 0.1 (...this sort of thing might be really useful as a general purpose rule type in base SA too...) Hmm doesn't look like this would be possible with minus (-) numbers unless I'm reading the PMS src wrong :/ Paul -- Paul Stead Systems Engineer Zen Internet
Re: Custom rule based on AWL score
On 24/10/16 16:46, John Hardin wrote: Paul: I haven't looked at the plugin myself yet, but here's a suggestion: have a mode where you can mark a RE as capturing a numeric value, and the rule's hit value is the value that the RE captured. This would (for example) let the AWL/TXREP mean be captured in a way it could be compared using gt/lt in a meta. Perhaps: tagcapnum __TXREP_IP_MEAN_TXREP_IP_MEAN_ /^(-?[\d]+(?:\.\d+)?)$/ metaTAGMATCH_TXREP_IP_HIGHSCORE __TXREP_IP_MEAN > 5.0 describeTAGMATCH_TXREP_IP_HIGHSCORE TXRep mean score quite large score TAGMATCH_TXREP_IP_HIGHSCORE 0.1 (...this sort of thing might be really useful as a general purpose rule type in base SA too...) Thanks for the suggestion John - this looks like an elegant solution to the problem, I'll look into this at some point soon. Paul -- Paul Stead Systems Engineer Zen Internet
Re: Custom rule based on AWL score
On Mon, 24 Oct 2016, SimpleRezo wrote: So, to the OP: try the tagmatch plugin to look at where _AWLMEAN_ is (e.g.) <= -1 and _AWLCOUNT_ is greater than (e.g.) 10 and that may get you what you want for a meta to use with the rules you want to control. Thank you Paul & John, it looks like I will be able to achieve what I want with tagmatch & _AWL* tags ! Paul, will be awesome to be able to do gt/lt (of course for now I can deal with regexp to achieve this) Paul: I haven't looked at the plugin myself yet, but here's a suggestion: have a mode where you can mark a RE as capturing a numeric value, and the rule's hit value is the value that the RE captured. This would (for example) let the AWL/TXREP mean be captured in a way it could be compared using gt/lt in a meta. Perhaps: tagcapnum __TXREP_IP_MEAN_TXREP_IP_MEAN_ /^(-?[\d]+(?:\.\d+)?)$/ metaTAGMATCH_TXREP_IP_HIGHSCORE __TXREP_IP_MEAN > 5.0 describeTAGMATCH_TXREP_IP_HIGHSCORE TXRep mean score quite large score TAGMATCH_TXREP_IP_HIGHSCORE 0.1 (...this sort of thing might be really useful as a general purpose rule type in base SA too...) -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- When designing software, any time you think to yourself "a user would never be stupid enough to do *that*", you're wrong. --- 307 days since the first successful real return to launch site (SpaceX)
Re: Custom rule based on AWL score
>So, to the OP: try the tagmatch plugin to look at where _AWLMEAN_ is >(e.g.) <= -1 and _AWLCOUNT_ is greater than (e.g.) 10 and that may get you >what you want for a meta to use with the rules you want to control. Thank you Paul & John, it looks like I will be able to achieve what I want with tagmatch & _AWL* tags ! Paul, will be awesome to be able to do gt/lt (of course for now I can deal with regexp to achieve this) -- SimpleRezo https://www.simplerezo.com/ - -- SimpleRezo http://www.simplerezo.com/ -- View this message in context: http://spamassassin.1065346.n5.nabble.com/Custom-rule-based-on-AWL-score-tp123087p123131.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: PYZOR_CHECK always have zero score, why?
The 'net' tflag exists to allow SA to know what tests to disable when it
is told to run only local tests. That is usually done when messages are
being checked well after their arrival, because network-dependent tests
are generally dynamic. There are also places where policy or network
architecture prohibit the use of external services.
On 24.10.16 03:56, Pedro David Marco wrote:
if i set a rule like this:
urirhssub TEST_URIBL_BLACK multi.uribl.com. A 2header
TEST_URIBL_BLACK eval:check_uridnsbl('URIBL_BLACK')describe
TEST_URIBL_BLACK Contains an URL listed in the URIBL blacklistscore
TEST_URIBL_BLACK 3
where tflag is not set... the rule does not run when in local mode..
urirhssub is network rule by definition.
try with another rule.
btw. you still have not answered my question:
how do you run spamassassin?
Aren't you using local tests only by any chance?
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"Two words: Windows survives." - Craig Mundie, Microsoft senior strategist
"So does syphillis. Good thing we have penicillin." - Matthew Alton
