On 17 Dec 2020, at 16:19, Dave Wreski <dwre...@guardiandigital.com> wrote:
> On 12/17/20 6:05 PM, Matt wrote:
>> Is there a way with spamassassin local.conf to add a higher score
>> based on source ip address or subnet? Basically the last IP in
>> "Received:" header.
>> bad_subnet_add_20_points: 192.168.240.0/24
>> Raising the score if that IP appeared anywhere in headers or body
>> might work too.
> Yes, but if you're effectively going to create a "poison pill" rule where any
> mail from a particular network is quarantined, you might be better of doing
> this at the firewall or in postfix directly and just rejecting it outright.
>
> header __BAD_IP_RCVD Received =~ /192\.168\.240\.\d{1,3}/
> body __BAD_IP_BODY /192\.168\.240\.\d{1,3}/
> rawbody __BAD_IP_RAWBODY /192\.168\.240\.\d{1,3}/
> meta MY_BAD_SENDER __BAD_IP_RCVD || __BAD_IP_BODY || __BAD_IP_RAWBODY
> score MY_BAD_SENDER 20
> describe MY_BAD_SENDER Contains bad IP
Won't this match for that IP in ANY Received: header?
--
"How good bad music and bad reasons sound when we march against an
enemy." - Friedrich Nietzsche
