Alex Denes
8df9fdc4ab
- More templating and inheritance - New commands + rx_replace + rx_install + rx_cpkgdir - More transparency with secrets being sourced as variables and replaced - Modularization of configs + telegraf + nginx (partial) + fastd + wireguard + unbound - Split of unbound configurations and bind zones - Bumping of key versions (rolling keys) + ZSK/KSK + OpenDKIM - Relaxed permission defaults and other smaller tweaks...
839 lines
20 KiB
Plaintext
839 lines
20 KiB
Plaintext
group "headers" {
|
|
symbols = {
|
|
"FORGED_SENDER" {
|
|
weight = 1.0;
|
|
description = "Sender is forged (different From: header and smtp MAIL FROM: addresses)";
|
|
}
|
|
"R_MIXED_CHARSET" {
|
|
weight = 5.0;
|
|
description = "Mixed characters in a message";
|
|
one_shot = true;
|
|
}
|
|
"R_MIXED_CHARSET_URL" {
|
|
weight = 7.0;
|
|
description = "Mixed characters in a URL inside message";
|
|
one_shot = true;
|
|
}
|
|
"FORGED_RECIPIENTS" {
|
|
weight = 3.0;
|
|
description = "Recipients are not the same as RCPT TO: mail command";
|
|
}
|
|
"FORGED_RECIPIENTS_MAILLIST" {
|
|
weight = 0.0;
|
|
description = "Recipients are not the same as RCPT TO: mail command, but a message from a maillist";
|
|
}
|
|
"FORGED_SENDER_MAILLIST" {
|
|
weight = 0.0;
|
|
description = "Sender is not the same as MAIL FROM: envelope, but a message is from a maillist";
|
|
}
|
|
"ONCE_RECEIVED" {
|
|
weight = 0.1;
|
|
description = "One received header in a message";
|
|
}
|
|
"RDNS_NONE" {
|
|
weight = 1.0;
|
|
description = "Cannot resolve reverse DNS for sender's IP";
|
|
}
|
|
"RDNS_DNSFAIL" {
|
|
weight = 0.0;
|
|
description = "PTR verification DNS error";
|
|
}
|
|
"ONCE_RECEIVED_STRICT" {
|
|
weight = 4.0;
|
|
description = "One received header with 'bad' patterns inside";
|
|
}
|
|
"MAILLIST" {
|
|
weight = -0.5;
|
|
description = "Message seems to be from maillist";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "subject" {
|
|
symbols = {}
|
|
max_score = 6.0;
|
|
}
|
|
|
|
group "mua" {
|
|
symbols = {
|
|
"FORGED_MUA_MAILLIST" {
|
|
weight = 0.0;
|
|
description = "Avoid false positives for FORGED_MUA_* in maillist";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "rbl" {
|
|
symbols = {
|
|
"DNSWL_BLOCKED" {
|
|
weight = 0.0;
|
|
description = "Resolver blocked due to excessive queries";
|
|
groups = ["dnswl", "blocked"];
|
|
}
|
|
"RCVD_IN_DNSWL" {
|
|
weight = 0.0;
|
|
description = "Unrecognised result from https://www.dnswl.org";
|
|
groups = ["dnswl"];
|
|
}
|
|
"RCVD_IN_DNSWL_NONE" {
|
|
weight = 0.0;
|
|
description = "Sender listed at https://www.dnswl.org, no trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"RCVD_IN_DNSWL_LOW" {
|
|
weight = -0.2;
|
|
description = "Sender listed at https://www.dnswl.org, low trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"RCVD_IN_DNSWL_MED" {
|
|
weight = -0.5;
|
|
description = "Sender listed at https://www.dnswl.org, medium trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"RCVD_IN_DNSWL_HI" {
|
|
weight = -1.0;
|
|
description = "Sender listed at https://www.dnswl.org, high trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"DWL_DNSWL_BLOCKED" {
|
|
weight = 0.0;
|
|
description = "Resolver blocked due to excessive queries (dwl)";
|
|
groups = ["dnswl", "blocked"];
|
|
}
|
|
"DWL_DNSWL" {
|
|
weight = 0.0;
|
|
description = "Unrecognised result from https://www.dnswl.org (dwl)";
|
|
groups = ["dnswl"];
|
|
}
|
|
"DWL_DNSWL_NONE" {
|
|
weight = 0.0;
|
|
description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"DWL_DNSWL_LOW" {
|
|
weight = -1.0;
|
|
description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"DWL_DNSWL_MED" {
|
|
weight = -2.0;
|
|
description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"DWL_DNSWL_HI" {
|
|
weight = -3.5;
|
|
description = "Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust";
|
|
groups = ["dnswl"];
|
|
}
|
|
"RBL_SPAMHAUS" {
|
|
weight = 0.0;
|
|
description = "Unrecognised result from Spamhaus ZEN";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SPAMHAUS_SBL" {
|
|
weight = 4.0;
|
|
description = "From address is listed in ZEN SBL";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SPAMHAUS_CSS" {
|
|
weight = 2.0;
|
|
description = "From address is listed in ZEN CSS";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SPAMHAUS_XBL" {
|
|
weight = 5.0;
|
|
description = "From address is listed in ZEN XBL";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SPAMHAUS_XBL_ANY" {
|
|
weight = 5.0;
|
|
description = "From or received address is listed in ZEN XBL (any list)";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SPAMHAUS_PBL" {
|
|
weight = 1.0;
|
|
description = "From address is listed in ZEN PBL (ISP list)";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SPAMHAUS_DROP" {
|
|
weight = 10.0;
|
|
description = "From address is listed in ZEN DROP BL";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RECEIVED_SPAMHAUS_SBL" {
|
|
weight = 3.0;
|
|
description = "Received address is listed in ZEN SBL";
|
|
groups = ["spamhaus"];
|
|
one_shot = true;
|
|
}
|
|
"RECEIVED_SPAMHAUS_CSS" {
|
|
weight = 1.0;
|
|
description = "Received address is listed in ZEN CSS";
|
|
groups = ["spamhaus"];
|
|
one_shot = true;
|
|
}
|
|
"RECEIVED_SPAMHAUS_XBL" {
|
|
weight = 5.0;
|
|
description = "Received address is listed in ZEN XBL";
|
|
groups = ["spamhaus"];
|
|
one_shot = true;
|
|
}
|
|
"RECEIVED_SPAMHAUS_PBL" {
|
|
weight = 0.0;
|
|
description = "Received address is listed in ZEN PBL (ISP list)";
|
|
groups = ["spamhaus"];
|
|
one_shot = true;
|
|
}
|
|
"RECEIVED_SPAMHAUS_DROP" {
|
|
weight = 10.0;
|
|
description = "Received address is listed in ZEN DROP BL";
|
|
groups = ["spamhaus"];
|
|
one_shot = true;
|
|
}
|
|
"RBL_SENDERSCORE" {
|
|
weight = 2.0;
|
|
description = "From address is listed in senderscore.com BL";
|
|
}
|
|
"MAILSPIKE" {
|
|
weight = 0.0;
|
|
description = "Unrecognised result from Mailspike";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RWL_MAILSPIKE_NEUTRAL" {
|
|
weight = 0.0;
|
|
description = "Neutral result from Mailspike";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RBL_MAILSPIKE_WORST" {
|
|
weight = 4.0;
|
|
description = "From address is listed in RBL - worst possible reputation";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RBL_MAILSPIKE_VERYBAD" {
|
|
weight = 3.0;
|
|
description = "From address is listed in RBL - very bad reputation";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RBL_MAILSPIKE_BAD" {
|
|
weight = 2.0;
|
|
description = "From address is listed in RBL - bad reputation";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RWL_MAILSPIKE_POSSIBLE" {
|
|
weight = 0.0;
|
|
description = "From address is listed in RWL - possibly legit";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RWL_MAILSPIKE_GOOD" {
|
|
weight = 1.0;
|
|
description = "From address is listed in RWL - good reputation";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RWL_MAILSPIKE_VERYGOOD" {
|
|
weight = 2.0;
|
|
description = "From address is listed in RWL - very good reputation";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RWL_MAILSPIKE_EXCELLENT" {
|
|
weight = 4.0;
|
|
description = "From address is listed in RWL - excellent reputation";
|
|
groups = ["mailspike"];
|
|
}
|
|
"RBL_SEM" {
|
|
weight = 1.0;
|
|
description = "From address is listed in Spameatingmonkey RBL";
|
|
groups = ["sem"];
|
|
}
|
|
"RBL_SEM_IPV6" {
|
|
weight = 1.0;
|
|
description = "From address is listed in Spameatingmonkey RBL (IPv6)";
|
|
groups = ["sem"];
|
|
}
|
|
"RBL_VIRUSFREE_BOTNET" {
|
|
weight = 2.0;
|
|
description = "From address is listed in virusfree.cz BL";
|
|
}
|
|
"RBL_NIXSPAM" {
|
|
weight = 4.0;
|
|
description = "From address is listed in NiX Spam (http://www.dnsbl.manitu.net/)";
|
|
}
|
|
"RBL_BLOCKLISTDE" {
|
|
weight = 4.0;
|
|
description = "From address is listed in Blocklist (https://www.blocklist.de/)";
|
|
groups = ["blocklistde"];
|
|
}
|
|
"RECEIVED_BLOCKLISTDE" {
|
|
weight = 3.0;
|
|
description = "Received address is listed in Blocklist (https://www.blocklist.de/)";
|
|
groups = ["blocklistde"];
|
|
one_shot = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
group "statistics" {
|
|
symbols = {
|
|
"BAYES_SPAM" {
|
|
weight = 10;
|
|
description = "Message probably spam, probability: ";
|
|
}
|
|
"BAYES_HAM" {
|
|
weight = -3.0;
|
|
description = "Message probably ham, probability: ";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "fuzzy" {
|
|
symbols = {
|
|
"RSPAMDCOM_FUZZY_UNKNOWN" {
|
|
weight = 5.0;
|
|
description = "Generic fuzzy hash match, bl.rspamd.com";
|
|
}
|
|
"RSPAMDCOM_FUZZY_DENIED" {
|
|
weight = 12.0;
|
|
description = "Denied fuzzy hash, bl.rspamd.com";
|
|
}
|
|
"RSPAMDCOM_FUZZY_PROB" {
|
|
weight = 5.0;
|
|
description = "Probable fuzzy hash, bl.rspamd.com";
|
|
}
|
|
"RSPAMDCOM_FUZZY_WHITE" {
|
|
weight = -2.1;
|
|
description = "Whitelisted fuzzy hash, bl.rspamd.com";
|
|
}
|
|
"LOCAL_FUZZY_UNKNOWN" {
|
|
weight = 5.0;
|
|
description = "Generic fuzzy hash match, local";
|
|
}
|
|
"LOCAL_FUZZY_DENIED" {
|
|
weight = 12.0;
|
|
description = "Denied fuzzy hash, local";
|
|
}
|
|
"LOCAL_FUZZY_PROB" {
|
|
weight = 5.0;
|
|
description = "Probable fuzzy hash, local";
|
|
}
|
|
"LOCAL_FUZZY_WHITE" {
|
|
weight = -2.0;
|
|
description = "Whitelisted fuzzy hash, local";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "policies" {
|
|
symbols = {
|
|
"R_SPF_FAIL" {
|
|
weight = 4.0;
|
|
description = "SPF verification failed";
|
|
groups = ["spf"];
|
|
}
|
|
"R_SPF_SOFTFAIL" {
|
|
weight = 0.0;
|
|
description = "SPF verification soft-failed";
|
|
groups = ["spf"];
|
|
}
|
|
"R_SPF_NEUTRAL" {
|
|
weight = 0.0;
|
|
description = "SPF policy is neutral";
|
|
groups = ["spf"];
|
|
}
|
|
"R_SPF_ALLOW" {
|
|
weight = -0.2;
|
|
description = "SPF verification allows sending";
|
|
groups = ["spf"];
|
|
}
|
|
"R_SPF_DNSFAIL" {
|
|
weight = 0.0;
|
|
description = "SPF DNS failure";
|
|
groups = ["spf"];
|
|
}
|
|
"R_DKIM_REJECT" {
|
|
weight = 4.0;
|
|
description = "DKIM verification failed";
|
|
one_shot = true;
|
|
groups = ["dkim"];
|
|
}
|
|
"R_DKIM_TEMPFAIL" {
|
|
weight = 0.0;
|
|
description = "DKIM verification soft-failed";
|
|
groups = ["dkim"];
|
|
}
|
|
"R_DKIM_ALLOW" {
|
|
weight = -0.2;
|
|
description = "DKIM verification succeed";
|
|
one_shot = true;
|
|
groups = ["dkim"];
|
|
}
|
|
"DMARC_POLICY_ALLOW" {
|
|
weight = -0.5;
|
|
description = "DMARC permit policy";
|
|
groups = ["dmarc"];
|
|
}
|
|
"DMARC_POLICY_ALLOW_WITH_FAILURES" {
|
|
weight = -0.5;
|
|
description = "DMARC permit policy with DKIM/SPF failure";
|
|
groups = ["dmarc"];
|
|
}
|
|
"DMARC_POLICY_REJECT" {
|
|
weight = 4.0;
|
|
description = "DMARC reject policy";
|
|
groups = ["dmarc"];
|
|
}
|
|
"DMARC_POLICY_QUARANTINE" {
|
|
weight = 3.0;
|
|
description = "DMARC quarantine policy";
|
|
groups = ["dmarc"];
|
|
}
|
|
"DMARC_POLICY_SOFTFAIL" {
|
|
weight = 0.1;
|
|
description = "DMARC failed";
|
|
groups = ["dmarc"];
|
|
}
|
|
"ARC_ALLOW" {
|
|
weight = -1.0;
|
|
description = "ARC checks success";
|
|
groups = ["arc"];
|
|
}
|
|
"ARC_REJECT" {
|
|
weight = 4.0;
|
|
description = "ARC checks failed";
|
|
groups = ["arc"];
|
|
}
|
|
"ARC_INVALID" {
|
|
weight = 1.0;
|
|
description = "ARC structure invalid";
|
|
groups = ["arc"];
|
|
}
|
|
"ARC_DNSFAIL" {
|
|
weight = 0.0;
|
|
description = "ARC DNS error";
|
|
groups = ["arc"];
|
|
}
|
|
"ARC_NA" {
|
|
weight = 0.0;
|
|
description = "ARC signature absent";
|
|
groups = ["arc"];
|
|
}
|
|
}
|
|
}
|
|
|
|
group "whitelist" {
|
|
max_score = 10.0;
|
|
symbols = {
|
|
"WHITELIST_SPF" {
|
|
weight = -1.0;
|
|
description = "Mail comes from the whitelisted domain and has a valid SPF policy";
|
|
}
|
|
"BLACKLIST_SPF" {
|
|
weight = 1.0;
|
|
description = "Mail comes from the whitelisted domain and has no valid SPF policy";
|
|
}
|
|
"WHITELIST_DKIM" {
|
|
weight = -1.0;
|
|
description = "Mail comes from the whitelisted domain and has a valid DKIM signature";
|
|
}
|
|
"BLACKLIST_DKIM" {
|
|
weight = 2.0;
|
|
description = "Mail comes from the whitelisted domain and has non-valid DKIM signature";
|
|
}
|
|
"WHITELIST_SPF_DKIM" {
|
|
weight = -3.0;
|
|
description = "Mail comes from the whitelisted domain and has valid SPF and DKIM policies";
|
|
}
|
|
"BLACKLIST_SPF_DKIM" {
|
|
weight = 3.0;
|
|
description = "Mail comes from the whitelisted domain and has no valid SPF policy or a bad DKIM signature";
|
|
}
|
|
"WHITELIST_DMARC" {
|
|
weight = -7.0;
|
|
description = "Mail comes from the whitelisted domain and has valid DMARC and DKIM policies";
|
|
}
|
|
"BLACKLIST_DMARC" {
|
|
weight = 6.0;
|
|
description = "Mail comes from the whitelisted domain and has valid failed DMARC and DKIM policies";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "surbl" {
|
|
max_score = 12.5;
|
|
symbols = {
|
|
"SURBL_BLOCKED" {
|
|
weight = 0.0;
|
|
description = "SURBL: blocked by policy/overusage";
|
|
groups = ["surblorg", "blocked"];
|
|
}
|
|
"PH_SURBL_MULTI" {
|
|
weight = 7.0;
|
|
description = "SURBL: Phishing sites";
|
|
groups = ["surblorg", "phishing"];
|
|
}
|
|
"MW_SURBL_MULTI" {
|
|
weight = 6.0;
|
|
description = "SURBL: Malware sites";
|
|
groups = ["surblorg"];
|
|
}
|
|
"ABUSE_SURBL" {
|
|
weight = 6.0;
|
|
description = "SURBL: ABUSE";
|
|
groups = ["surblorg"];
|
|
}
|
|
"CRACKED_SURBL" {
|
|
weight = 5.0;
|
|
description = "SURBL: cracked site";
|
|
groups = ["surblorg"];
|
|
}
|
|
"RSPAMD_URIBL" {
|
|
weight = 4.5;
|
|
description = "Rspamd uribl, bl.rspamd.com";
|
|
one_shot = true;
|
|
groups = ["rspamdbl"];
|
|
}
|
|
"RSPAMD_EMAILBL" {
|
|
weight = 9.5;
|
|
description = "Rspamd emailbl, bl.rspamd.com";
|
|
one_shot = true;
|
|
groups = ["rspamdbl"];
|
|
}
|
|
"MSBL_EBL" {
|
|
weight = 7.5;
|
|
description = "MSBL emailbl";
|
|
one_shot = true;
|
|
groups = ["ebl"];
|
|
}
|
|
"MSBL_EBL_GREY" {
|
|
weight = 0.5; # TODO: test it
|
|
description = "MSBL emailbl grey list";
|
|
one_shot = true;
|
|
groups = ["ebl"];
|
|
}
|
|
"SEM_URIBL_UNKNOWN" {
|
|
weight = 0.0;
|
|
description = "Spameatingmonkey uribl: unknown result";
|
|
groups = ["sem"];
|
|
}
|
|
"SEM_URIBL" {
|
|
weight = 3.5;
|
|
description = "Spameatingmonkey uribl";
|
|
groups = ["sem"];
|
|
}
|
|
"SEM_URIBL_FRESH15_UNKNOWN" {
|
|
weight = 0.0;
|
|
description = "Spameatingmonkey Fresh15 uribl: unknown result";
|
|
groups = ["sem"];
|
|
}
|
|
"SEM_URIBL_FRESH15" {
|
|
weight = 3.0;
|
|
description = "Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)";
|
|
groups = ["sem"];
|
|
}
|
|
"DBL" {
|
|
weight = 0.0;
|
|
description = "DBL unknown result";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_SPAM" {
|
|
weight = 6.5;
|
|
description = "DBL uribl spam";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_PHISH" {
|
|
weight = 6.5;
|
|
description = "DBL uribl phishing";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_MALWARE" {
|
|
weight = 6.5;
|
|
description = "DBL uribl malware";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_BOTNET" {
|
|
weight = 5.5;
|
|
description = "DBL uribl botnet C&C domain";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_ABUSE" {
|
|
weight = 6.5;
|
|
description = "DBL uribl abused legit spam";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_ABUSE_REDIR" {
|
|
weight = 1.5;
|
|
description = "DBL uribl abused spammed redirector domain";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_ABUSE_PHISH" {
|
|
weight = 7.5;
|
|
description = "DBL uribl abused legit phish";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_ABUSE_MALWARE" {
|
|
weight = 7.5;
|
|
description = "DBL uribl abused legit malware";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_ABUSE_BOTNET" {
|
|
weight = 5.5;
|
|
description = "DBL uribl abused legit botnet C&C";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"DBL_PROHIBIT" {
|
|
weight = 0.0;
|
|
description = "DBL uribl IP queries prohibited!";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"URIBL_MULTI" {
|
|
weight = 0.0;
|
|
description = "uribl.com: unrecognised result";
|
|
groups = ["uribl"];
|
|
}
|
|
"URIBL_BLOCKED" {
|
|
weight = 0.0;
|
|
description = "uribl.com: query refused";
|
|
groups = ["uribl", "blocked"];
|
|
}
|
|
"URIBL_BLACK" {
|
|
weight = 7.5;
|
|
description = "uribl.com black url";
|
|
groups = ["uribl"];
|
|
}
|
|
"URIBL_RED" {
|
|
weight = 4.5;
|
|
description = "uribl.com red url";
|
|
groups = ["uribl"];
|
|
}
|
|
"URIBL_GREY" {
|
|
weight = 2.5;
|
|
description = "uribl.com grey url";
|
|
one_shot = true;
|
|
groups = ["uribl"];
|
|
}
|
|
"SPAMHAUS_ZEN_URIBL" {
|
|
weight = 0.0;
|
|
description = "Spamhaus ZEN URIBL: Filtered result";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"URIBL_SBL" {
|
|
weight = 7.0;
|
|
description = "A domain in the message body resolves to an IP listed in Spamhaus SBL";
|
|
one_shot = true;
|
|
groups = ["v"];
|
|
}
|
|
"URIBL_SBL_CSS" {
|
|
weight = 6.5;
|
|
description = "A domain in the message body resolves to an IP listed in Spamhaus SBL CSS";
|
|
one_shot = true;
|
|
groups = ["spamhaus"];
|
|
}
|
|
"URIBL_XBL" {
|
|
weight = 1.5;
|
|
description = "A domain in the message body resolves to an IP listed in Spamhaus XBL";
|
|
one_shot = true;
|
|
groups = ["spamhaus"];
|
|
}
|
|
"URIBL_PBL" {
|
|
weight = 0.0;
|
|
description = "A domain in the message body resolves to an IP listed in Spamhaus PBL";
|
|
groups = ["spamhaus"];
|
|
}
|
|
"URIBL_DROP" {
|
|
weight = 10.0;
|
|
description = "A domain in the message body resolves to an IP listed in Spamhaus DROP";
|
|
one_shot = true;
|
|
groups = ["spamhaus"];
|
|
}
|
|
"RBL_SARBL_BAD" {
|
|
weight = 2.5;
|
|
description = "A domain in the message body is blacklisted in SARBL";
|
|
one_shot = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
group "phishing" {
|
|
max_score = 10.0;
|
|
symbols = {
|
|
"PHISHING" {
|
|
weight = 5.0;
|
|
description = "Phished URL";
|
|
one_shot = true;
|
|
}
|
|
"PHISHED_OPENPHISH" {
|
|
weight = 7.0;
|
|
description = "Phished URL found in openphish.com";
|
|
}
|
|
"PHISHED_PHISHTANK" {
|
|
weight = 7.0;
|
|
description = "Phished URL found in phishtank.com";
|
|
}
|
|
HACKED_WP_PHISHING {
|
|
weight = 4.5;
|
|
description = "Phishing message from hacked wordpress";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "hfilter" {
|
|
symbols = {
|
|
"HFILTER_HELO_BAREIP" {
|
|
weight = 3.0;
|
|
description = "Helo host is bare ip";
|
|
}
|
|
"HFILTER_HELO_BADIP" {
|
|
weight = 4.5;
|
|
description = "Helo host is very bad ip";
|
|
}
|
|
"HFILTER_HELO_1" {
|
|
weight = 0.5;
|
|
description = "Helo host checks (very low)";
|
|
}
|
|
"HFILTER_HELO_2" {
|
|
weight = 1.0;
|
|
description = "Helo host checks (low)";
|
|
}
|
|
"HFILTER_HELO_3" {
|
|
weight = 2.0;
|
|
description = "Helo host checks (medium)";
|
|
}
|
|
"HFILTER_HELO_4" {
|
|
weight = 2.5;
|
|
description = "Helo host checks (hard)";
|
|
}
|
|
"HFILTER_HELO_5" {
|
|
weight = 3.0;
|
|
description = "Helo host checks (very hard)";
|
|
}
|
|
"HFILTER_HOSTNAME_1" {
|
|
weight = 0.5;
|
|
description = "Hostname checks (very low)";
|
|
}
|
|
"HFILTER_HOSTNAME_2" {
|
|
weight = 1.0;
|
|
description = "Hostname checks (low)";
|
|
}
|
|
"HFILTER_HOSTNAME_3" {
|
|
weight = 2.0;
|
|
description = "Hostname checks (medium)";
|
|
}
|
|
"HFILTER_HOSTNAME_4" {
|
|
weight = 2.5;
|
|
description = "Hostname checks (hard)";
|
|
}
|
|
"HFILTER_HOSTNAME_5" {
|
|
weight = 3.0;
|
|
description = "Hostname checks (very hard)";
|
|
}
|
|
"HFILTER_HELO_NORESOLVE_MX" {
|
|
weight = 1.0;
|
|
description = "MX found in Helo and no resolve";
|
|
}
|
|
"HFILTER_HELO_NORES_A_OR_MX" {
|
|
weight = 2.0;
|
|
description = "Helo no resolve to A or MX";
|
|
}
|
|
"HFILTER_HELO_IP_A" {
|
|
weight = 1.0;
|
|
description = "Helo A IP != hostname IP";
|
|
}
|
|
"HFILTER_HELO_NOT_FQDN" {
|
|
weight = 3.0;
|
|
description = "Helo not FQDN";
|
|
}
|
|
"HFILTER_FROMHOST_NORESOLVE_MX" {
|
|
weight = 1.5;
|
|
description = "MX found in FROM host and no resolve";
|
|
}
|
|
"HFILTER_FROMHOST_NORES_A_OR_MX" {
|
|
weight = 2.5;
|
|
description = "FROM host no resolve to A or MX";
|
|
}
|
|
"HFILTER_FROMHOST_NOT_FQDN" {
|
|
weight = 3.0;
|
|
description = "FROM host not FQDN";
|
|
}
|
|
"HFILTER_FROM_BOUNCE" {
|
|
weight = 0.0;
|
|
description = "Bounce message";
|
|
}
|
|
"HFILTER_MID_NORESOLVE_MX" {
|
|
weight = 0.5;
|
|
description = "MX found in Message-id host and no resolve";
|
|
}
|
|
"HFILTER_MID_NORES_A_OR_MX" {
|
|
weight = 0.5;
|
|
description = "Message-id host no resolve to A or MX";
|
|
}
|
|
"HFILTER_MID_NOT_FQDN" {
|
|
weight = 0.5;
|
|
description = "Message-id host not FQDN";
|
|
}
|
|
"HFILTER_HOSTNAME_UNKNOWN" {
|
|
weight = 2.5;
|
|
description = "Unknown client hostname (PTR or FCrDNS verification failed)";
|
|
}
|
|
"HFILTER_RCPT_BOUNCEMOREONE" {
|
|
weight = 1.5;
|
|
description = "Message from bounce and over 1 recipient";
|
|
}
|
|
"HFILTER_URL_ONLY" {
|
|
weight = 2.2;
|
|
description = "URL only in body";
|
|
}
|
|
"HFILTER_URL_ONELINE" {
|
|
weight = 2.5;
|
|
description = "One line URL and text in body";
|
|
}
|
|
}
|
|
}
|
|
|
|
group "mime_types" {
|
|
symbols = {
|
|
"MIME_GOOD" {
|
|
weight = -0.1;
|
|
description = "Known content-type";
|
|
one_shot = true;
|
|
}
|
|
"MIME_BAD" {
|
|
weight = 1.0;
|
|
description = "Known bad content-type";
|
|
one_shot = true;
|
|
}
|
|
"MIME_UNKNOWN" {
|
|
weight = 0.1;
|
|
description = "Missing or unknown content-type";
|
|
one_shot = true;
|
|
}
|
|
"MIME_BAD_ATTACHMENT" {
|
|
weight = 4.0;
|
|
description = "Invalid attachment mime type";
|
|
one_shot = true;
|
|
}
|
|
"MIME_ENCRYPTED_ARCHIVE" {
|
|
weight = 1.0;
|
|
description = "Encrypted archive in a message";
|
|
one_shot = true;
|
|
}
|
|
"MIME_ARCHIVE_IN_ARCHIVE" {
|
|
weight = 5.0;
|
|
description = "Archive within another archive";
|
|
one_shot = true;
|
|
}
|
|
"MIME_DOUBLE_BAD_EXTENSION" {
|
|
weight = 3.0; # This rule has dynamic weight up to 4.0
|
|
description = "Bad extension cloaking";
|
|
one_shot = true;
|
|
}
|
|
"MIME_BAD_EXTENSION" {
|
|
weight = 2.0; # This rule has dynamic weight up to 4.0
|
|
description = "Bad extension";
|
|
one_shot = true;
|
|
}
|
|
"MIME_BAD_UNICODE" {
|
|
weight = 8.0;
|
|
description = "Filename with known obscured unicode characters";
|
|
one_shot = true;
|
|
}
|
|
}
|
|
}
|