<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title type="html"><![CDATA[iRedMail — How to score points in Spamassassin on reply-to header.]]></title>
	<link rel="self" href="http://www.iredmail.org/forum/feed-atom-topic4172.xml" />
	<updated>2012-11-20T07:32:29Z</updated>
	<generator>PunBB</generator>
	<id>http://www.iredmail.org/forum/topic4172-how-to-score-points-in-spamassassin-on-replyto-header.html</id>
		<entry>
			<title type="html"><![CDATA[Re: How to score points in Spamassassin on reply-to header.]]></title>
			<link rel="alternate" href="http://www.iredmail.org/forum/post19166.html#p19166" />
			<content type="html"><![CDATA[<p>From not reply-to, this is very common, i don&#039;t think we should use it to fight spam...</p><p>P.S. it should be easier to achieve it in iRedAPD as a plugin.</p>]]></content>
			<author>
				<name><![CDATA[ZhangHuangbin]]></name>
				<uri>http://www.iredmail.org/forum/user2.html</uri>
			</author>
			<updated>2012-11-20T07:32:29Z</updated>
			<id>http://www.iredmail.org/forum/post19166.html#p19166</id>
		</entry>
		<entry>
			<title type="html"><![CDATA[How to score points in Spamassassin on reply-to header.]]></title>
			<link rel="alternate" href="http://www.iredmail.org/forum/post19152.html#p19152" />
			<content type="html"><![CDATA[<p>==== ==== Required information ====<br />- iRedMail version:&nbsp; iRedMail-0.8.3<br />- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL<br />- Linux/BSD distribution name and version: CENTOS<br />- Related log if you&#039;re reporting an issue: none<br />==== </p><p>This is only a contribution of how to configure spamassassin to score mails with a reply-to header that is different from the sender (From: header). This is usually a technique used by spammers but often some real users are using this functionality. Be careful, make sure to not get in troubles yourself by implementing this rule, before using it!!!</p><p>Notice that the scored points in this guide are very high, you can setting as you need it. In my case I make the decision of send to quarantine almost all mails using a reply-to because it&#039;s what I needed, maybe it&#039;s a good stuff setting down a low score like 0.001 to get started and see if this is what you need!</p><p>Based on: <a href="http://wiki.apache.org/spamassassin/FromNotReplyTo">http://wiki.apache.org/spamassassin/FromNotReplyTo</a></p><p>Rule FromNotReplyTo. Score 2 points to mail with reply-to and from headers are not the same<br />Rule FromNotReplyToSameDomain. Score 5 points to mail with reply-to and from headers are not in the same domain</p><p>################### Add in /etc/mail/spamassassin/local.conf ###################<br />## Score 2 points to mail with reply-to and from headers are not the same<br />loadplugin FromNotReplyTo plugins/FromNotReplyTo.pm<br />header FROM_NOT_REPLYTO eval:check_for_from_not_reply_to()<br />score FROM_NOT_REPLYTO 2.0<br />describe FROM_NOT_REPLYTO From: does not match Reply-To:</p><p># Score 5 points to mail with reply-to and from headers are not the same domain<br />loadplugin FromNotReplyToSameDomain plugins/FromNotReplyToSameDomain.pm<br />header FROM_NOT_REPLYTO_SAME_DOMAIN eval:check_for_from_not_reply_to_same_domain()<br />score FROM_NOT_REPLYTO_SAME_DOMAIN 5.0<br />describe FROM_NOT_REPLYTO_SAME_DOMAIN From domain: does not match Reply-To: domain<br />###########################################################################</p><p># create plugin directory.<br />mkdir /etc/mail/spamassassin/plugins/</p><p>########## Create /etc/mail/spamassassin/plugins/FromNotReplyTo.pm ############<br />package FromNotReplyTo;<br />1;</p><p>use strict;</p><p>use Mail::SpamAssassin;<br />use Mail::SpamAssassin::Plugin;<br />our @ISA = qw(Mail::SpamAssassin::Plugin);</p><br /><p>sub new {<br />&nbsp; &nbsp; &nbsp; &nbsp; my ($class, $mailsa) = @_;<br />&nbsp; &nbsp; &nbsp; &nbsp; $class = ref($class) || $class;<br />&nbsp; &nbsp; &nbsp; &nbsp; my $self = $class-&gt;SUPER::new( $mailsa );<br />&nbsp; &nbsp; &nbsp; &nbsp; bless ($self, $class);<br />&nbsp; &nbsp; &nbsp; &nbsp; $self-&gt;register_eval_rule ( &#039;check_for_from_not_reply_to&#039; );<br />&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp; &nbsp; &nbsp; &nbsp; return $self;<br />}</p><br /><p># Often spam uses different From: and Reply-To:<br /># while most legitimate e-mails does not.<br />sub check_for_from_not_reply_to {<br />&nbsp; &nbsp; &nbsp; &nbsp; my ($self, $msg) = @_;</p><p>&nbsp; &nbsp; &nbsp; &nbsp; my $from = $msg-&gt;get( &#039;From:addr&#039; );<br />&nbsp; &nbsp; &nbsp; &nbsp; my $replyTo = $msg-&gt;get( &#039;Reply-To:addr&#039; );</p><p>&nbsp; &nbsp; &nbsp; &nbsp; #Mail::SpamAssassin::Plugin::dbg( &quot;FromNotReplyTo: Comparing &#039;$from&#039;/&#039;$replyTo&quot; );</p><p>&nbsp; &nbsp; &nbsp; &nbsp; if ( $from ne &#039;&#039; &amp;&amp; $replyTo ne &#039;&#039; &amp;&amp; $from ne $replyTo ) {<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return 1;<br />&nbsp; &nbsp; &nbsp; &nbsp; }</p><p>&nbsp; &nbsp; &nbsp; &nbsp; return 0;<br />}<br />###########################################################################</p><p>##### Create /etc/mail/spamassassin/plugins/FromNotReplyToSameDomain.pm #######<br />package FromNotReplyToSameDomain;<br />1;</p><p>use strict;</p><p>use Mail::SpamAssassin;<br />use Mail::SpamAssassin::Plugin;<br />our @ISA = qw(Mail::SpamAssassin::Plugin);</p><br /><p>sub new {<br />&nbsp; &nbsp; &nbsp; &nbsp; my ($class, $mailsa) = @_;<br />&nbsp; &nbsp; &nbsp; &nbsp; $class = ref($class) || $class;<br />&nbsp; &nbsp; &nbsp; &nbsp; my $self = $class-&gt;SUPER::new( $mailsa );<br />&nbsp; &nbsp; &nbsp; &nbsp; bless ($self, $class);<br />&nbsp; &nbsp; &nbsp; &nbsp; $self-&gt;register_eval_rule ( &#039;check_for_from_not_reply_to_same_domain&#039; );<br />&nbsp; &nbsp; &nbsp; &nbsp; <br />&nbsp; &nbsp; &nbsp; &nbsp; return $self;<br />}</p><br /><p># Often spam uses different From: and Reply-To:<br /># while most legitimate e-mails does not.<br />sub check_for_from_not_reply_to_same_domain {<br />&nbsp; &nbsp; &nbsp; &nbsp; my ($self, $msg) = @_;</p><p>&nbsp; &nbsp; &nbsp; &nbsp; my $from = $msg-&gt;get( &#039;From:addr&#039; );<br />&nbsp; &nbsp; &nbsp; &nbsp; $from =~ s/.*@//;<br />&nbsp; &nbsp; &nbsp; &nbsp; my $replyTo = $msg-&gt;get( &#039;Reply-To:addr&#039; );<br />&nbsp; &nbsp; &nbsp; &nbsp; $replyTo =~ s/.*@//;</p><p>&nbsp; &nbsp; &nbsp; &nbsp; #Mail::SpamAssassin::Plugin::dbg( &quot;FromNotReplyToSameDomain: Comparing &#039;$from&#039;/&#039;$replyTo&quot; );</p><p>&nbsp; &nbsp; &nbsp; &nbsp; if ( $from ne &#039;&#039; &amp;&amp; $replyTo ne &#039;&#039; &amp;&amp; $from ne $replyTo ) {<br />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return 1;<br />&nbsp; &nbsp; &nbsp; &nbsp; }</p><p>&nbsp; &nbsp; &nbsp; &nbsp; return 0;<br />}<br />###########################################################################</p><p>#Stop amavis with:<br />/etc/init.d/amavisd stop</p><p># Debug amavis with:<br />amavisd -c /etc/amavisd/amavisd.conf debug 2&gt;&amp;1 | grep -i &#039;FromNotReplyTo&#039;</p><p>#You must see someting like: <br /># /etc/init.d/amavisd -c /etc/amavisd/amavisd.conf debug 2&gt;&amp;1 | grep -i &#039;FromNotReplyTo&#039;<br />Nov 19 10:03:46.219 your.mail-host.domain /usr/sbin/amavisd[7971]: SpamAssassin loaded plugins: AutoLearnThreshold, Bayes, BodyEval, Check, DCC, DKIM, DNSEval, FreeMail, <strong><span class="bbu">FromNotReplyTo</span></strong>, <strong><span class="bbu">FromNotReplyToSameDomain</span></strong>, HTMLEval, HTTPSMismatch, Hashcash, HeaderEval, ImageInfo, MIMEEval, MIMEHeader, Pyzor, Razor2, RelayEval, ReplaceTags, SPF, SpamCop, URIDNSBL, URIDetail, URIEval, VBounce, WLBLEval, WhiteListSubject<br />Nov 19 10:03:46.219 your.mail-host.domain /usr/sbin/amavisd[7971]: extra modules loaded after daemonizing/chrooting: <strong><span class="bbu">/etc/mail/spamassassin/plugins/FromNotReplyTo.pm</span></strong>, <strong><span class="bbu">/etc/mail/spamassassin/plugins/FromNotReplyToSameDomain.pm</span></strong>, Mail/SpamAssassin/BayesStore/MySQL.pm, Mail/SpamAssassin/BayesStore/SQL.pm, Mail/SpamAssassin/Plugin/FreeMail.pm</p><p># If all it&#039;s working, end debug with CTRL+C and start amavis as usual.<br />/etc/init.d/amavisd start</p><p>I hope this was usefull for you!!!</p><p>Greetings!</p><p>Omar David Zapién López</p>]]></content>
			<author>
				<name><![CDATA[ozapien]]></name>
				<uri>http://www.iredmail.org/forum/user32149.html</uri>
			</author>
			<updated>2012-11-19T16:17:16Z</updated>
			<id>http://www.iredmail.org/forum/post19152.html#p19152</id>
		</entry>
</feed>
