list_specific 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104
  1. # This configuration file contains lists.debian.org specific rulessets
  2. # our MTAs fix up headers for a slew of spams, so mark these as suspicious
  3. # -- joy, 2003-06-28
  4. # deactivated as this rule is also part of SA itself.
  5. #header OUR_MTA_MSGID Message-Id =~ /\@(bendel|master|gluck)\.debian\.org/
  6. #describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs
  7. #score OUR_MTA_MSGID 1
  8. # -- joy, 2003-08-15
  9. header SENDER_FOR_US From =~ /\@(bendel|master|gluck|lists)\.debian\.org/
  10. describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs
  11. score SENDER_FOR_US 2
  12. # exception... --joy, 2003-07-12
  13. header WEBSUBS X-Remote-IP =~ /./
  14. describe WEBSUBS Sounds like a subscription request from the web
  15. score WEBSUBS -2
  16. # another exception... --joy, 2003-07-27
  17. header SUBSCONFIRM Subject =~ /CONFIRM [su]\d+/
  18. describe SUBSCONFIRM Sounds like a subscription request confirmation
  19. score SUBSCONFIRM -2
  20. # some valid autogenerated mail of ours
  21. # -- joy, 2003-07-09
  22. header OUR_SCRIPTS_1 Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/
  23. describe OUR_SCRIPTS_1 Mail likely generated by .bin/mladmin
  24. score OUR_SCRIPTS_1 -5
  25. # our daily un/subscription report gets ~8 SA points !
  26. # lower it to 3
  27. # -- zobel, 2006-12-10
  28. header _OUR_UNSUB_CHANGES1 Subject =~ /Daily un\/subscription report/
  29. meta OUR_UNSUB_CHANGES (_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID)
  30. describe OUR_UNSUB_CHANGES Daily mail sent to listmaster about un/subscriptions
  31. score OUR_UNSUB_CHANGES -5
  32. # exception... --joy, 2003-08-15
  33. body MDOMOSUBS /^Request forwarded.$/
  34. describe MDOMOSUBS Sounds like a subscription request via majorsmart
  35. score MDOMOSUBS -2
  36. # another exception --joy, 2004-05-27
  37. #body OURCRONMAILS Subject =~ /^Cron \<list\@.*\/var\/list\//
  38. #describe OURCRONMAILS Sounds like a legitimate cron job mail
  39. #score OURCRONMAILS -3
  40. header BENDEL_LOCAL_FORWARDED Resent-From =~ /bendel\.debian\.org/
  41. describe BENDEL_LOCAL_FORWARDED Mail has been locally forwarded.
  42. score BENDEL_LOCAL_FORWARDED -5
  43. # temp work-around for d-l-f
  44. header RFR Subject =~ /\[RFR\]/
  45. describe RFR Request for revision
  46. score RFR -5
  47. # pasc 2004-02-02
  48. header AM_REPORT Subject =~ /AM Report for Week Ending/
  49. describe AM_REPORT Auto-generated AM summary
  50. score AM_REPORT -5
  51. # automated reports on debian-l10n-french
  52. header MURPHY_MIGUS_REPORT Subject =~ /Etat dans le CVS des/
  53. describe MURPHY_MIGUS_REPORT Auto-generated report from migus on translations
  54. score MURPHY_MIGUS_REPORT -5
  55. # our own whitelisting of subscribers
  56. header LDOSUBSCRIBER X-Subscriber-lists.debian.org =~ /./
  57. describe LDOSUBSCRIBER Sender is a lists.debian.org subscriber
  58. score LDOSUBSCRIBER -6
  59. # whitelist mails to majordomo
  60. header MAJORDOMOMAIL Delivered-To =~ /lists-majordomo@/
  61. describe MAJORDOMOMAIL mail to major domo
  62. score MAJORDOMOMAIL -0.1
  63. meta MAJORDOMOWHITE (MAJORDOMO && (NOSUBJECT || MISSING_SUBJECT))
  64. describe MAJORDOMOWHITE Counteract no subject score for majordomo mails
  65. score MAJORDOMOWHITE -3
  66. # count recipients and score those with Too Many. -cord
  67. describe TO_TOO_MANY To: too many recipients
  68. header TO_TOO_MANY To =~ /(?:,[^,]{1,80}){5}/
  69. score TO_TOO_MANY 1
  70. describe TO_WAY_TOO_MANY To: way too many recipients
  71. header TO_WAY_TOO_MANY To =~ /(?:,[^,]{1,80}){10}/
  72. score TO_WAY_TOO_MANY 3
  73. describe CC_TOO_MANY CC: too many recipients
  74. header CC_TOO_MANY CC =~ /(?:,[^,]{1,80}){10}/
  75. score CC_TOO_MANY 3
  76. score CORRUPT_FROM_LINE_IN_HDRS 0
  77. score FM_DDDD_TIMES_2 0
  78. score FM_SEX_HOSTDDDD 0
  79. score NO_HEADERS_MESSAGE 0
  80. score SARE_HEAD_SUBJ_RAND 0
  81. score SARE_SPEC_PROLEO_M2a 0
  82. score SHACKOUTLOOK 0
  83. score MSGID_FROM_MTA_ID 0