Topic: howto add what spamassassin rules

[hanscees]

Hi,

I want to get rid of emails whith shortened links in them like http://ow.ly/rhjskgfurh   and so on.

I found the contribs howto here that describes howto add rules to spamassasin: http://wiki.contribs.org/Email#Spamassassin

But I do not understand what rules I can add. Can I just add every rule at: http://spamassassin.apache.org/tests_3_2_x.html

Any clues would be apreciated!

can I just add something like:

body LOCAL_DEMONSTRATION_RULE   /test/
score LOCAL_DEMONSTRATION_RULE 0.1
describe LOCAL_DEMONSTRATION_RULE       This is a simple test rule

(https://wiki.apache.org/spamassassin/WritingRules)

[hanscees]

Hi,

I want to get rid of emails whith shortened links in them like http://ow.ly/rhjskgfurh   and so on.

I found the contribs howto here that describes howto add rules to spamassasin: http://wiki.contribs.org/Email#Spamassassin

But I do not understand what rules I can add. Can I just add every rule at: http://spamassassin.apache.org/tests_3_2_x.html

Any clues would be apreciated!

can I just add something like:

body LOCAL_DEMONSTRATION_RULE   /test/
score LOCAL_DEMONSTRATION_RULE 0.1
describe LOCAL_DEMONSTRATION_RULE       This is a simple test rule

(https://wiki.apache.org/spamassassin/WritingRules)

the rule as a above works. Of course that does not mean it is a sensable rule and it should be added to the server as the contrib above writes.

[hanscees]

yes it works. Here is how I added a spamassassin rule on sme9 to identify emails with url shorteners with a score of +4.1


mkdir -p /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf
vi /etc/e-smith/templates-custom/etc/mail/spamassassin/local.cf/20localscores

add to file:

rawbody OWLYANDSOON /\bhttp:\/\/\w{1,3}\.\w{1,3}\/[a-zA-Z0-9]{1,11}\b/
score OWLYANDSOON  6.1
describe OWLYANDSOON  no mail with url shorteners


save file

expand-template /etc/mail/spamassassin/local.cf

##did the file expand correct?
cat /etc/mail/spamassassin/local.cf
## is syntax correct?
spamassassin --lint

signal-event email-update

[hanscees]

Actually, it fails because
signal-event email-update
or expand-template /etc/mail/spamassassin/local.cf

eats some {} form the regeps:

this in a custom template:
rawbody OWLYANDSOON /\bhttp:\/\/\w{1,3}\.\w{1,3}\/[a-zA-Z0-9]{1,11}\b/

is garbled to this:
rawbody OWLYANDSOON /\bhttp:\/\/\w3\.\w3\/[a-zA-Z0-9]11\b/


bug?

[FlowerInMyHeart]

I know weird. But it work.

[CharlieBrady]

bug?

Only in your template, or perhaps some missing documentation about use of templates (I haven't checked).

{ and } need to be escaped in templates - use \{ and \}.