We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda NextGen Firewall X

Using Custom Rule Sets with SpamAssassin

  • Type: Knowledgebase
  • Date changed: 6 months ago
Solution #00005147 
 
Scope:
This solution replies to:
- NG Firewall firmware versions 4.2.x,5.0.x, 5.2.x
- netfence firmware versions 4.2.x

 
Symptoms:

A rules field is provided in the "Rules" section of the Spamfilter config node.

This field may be used to deactivate or alter the score of tests performed by SpamAssassin. Tests performed are listed in detail on http://spamassassin.apache.org/

The following syntax applies to disable a test (score value set to null):

 

  score <test_name> <score_value>, e.g. score RCVD_IN_OSIRUSOFT_COM 0

 

Additionally, custom rule sets may be included into SpamAssassin by inserting them into the Rules field.

 
 

Solution:

The following syntax applies for including third-party custom rule sets into SpamAssassin:

 

  header SPAM_SUBJECT Subject =~ /\\bniagara\\b/i
  describe SPAM_SUBJECT These subjects are banned
  score SPAM_SUBJECT 1.5

 

These entries filter e-mails containing the word "niagara" in the subject.

A link-list to third-party rule sets is available at http://wiki.apache.org/spamassassin/CustomRulesets. Consider the examples below:

 

  header SARE_OBFU_CUSTOM Subject =~ /(?!BETTE?R)(?:[b8\xDF] \xCE\x92 \xCE\xB2 \xD0\x92 \xD0\xB2)[\x01-\x2F\\\^_`\ \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB] \xC4[\x92-\x9B] \xCE\x88 \xCE\x95 \xCE\xA3 \xCE\xAD \xCE\xB5 \xD0\x81 \xD0\x95 \xD0\xB5 \xD1\x91)[\x01-\x2F\\\^_`\ \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+] \xC5[\xA2-\xA7] \xCE\xA4 \xCF\x84 \xD0\xA2 \xD1\x82)[\x01-\x2F\\\^_`\ \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+] \xC5[\xA2-\xA7] \xCE\xA4 \xCF\x84 \xD0\xA2 \xD1\x82)[\x01-\x2F\\\^_`\ \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB] \xC4[\x92-\x9B] \xCE\x88 \xCE\x95 \xCE\xA3 \xCE\xAD \xCE\xB5 \xD0\x81 \xD0\x95 \xD0\xB5 \xD1\x91)[\x01-\x2F\\\^_`\ \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE] \xC5[\x94-\x99] \xD1\x93)/i

  describe SARE_OBFU_CUSTOM Subject has obfuscated spammer topic
  score SARE_OBFU_CUSTOM 2.5  
 

 

 

  header SARE_ADULT Subject =~ /\b(?:adu?1t amb[1!]en b0y bl0w c0cks? c0re ejaculation f?r0+m g(?:[1!]r[1l] ir[!1]) h0t ntercourse jerkoff l1ttle m0vie manh00d [0o]rg\sm p1ct pen[1!]s (?:ph f)(?:[0\@]t ot[0\@]) secks sm00th t1ny t1ts v(?:irg1 1rgi 1rg1)n v[i1]de0 violenced y0ung)/i
  describe SARE_ADULT Contains OBFU and "strong" adult words
  score SARE_ADULT 1.5
 

 

 

Note:
Backslashes could'nt be inserted directly because it's used as system seperator in the code. To use the "\" in a generic configuration file you must set a slash "/" in front of the backslash.  e.g. /\b .
The rules above has used the correct syntax and could be inserted via copy/paste in your active spamassassin configuration.

 

Important!
Custom or third-party rules are not part of the official SpamAssassin distribution. They may have a different license and are not from the Apache Software Foundation. phion clearly wishes to state, that using custom rule sets takes place at own risk!

 

 

Link to This Page:
https://campus.barracuda.com/solution/50160000000IKZ2AAO