[SOLVED] SaneSecurity ClamAV or FuzzyOCR SpamAssassin Plugins

[bbarrons]

yep, I registered both ips' with them. After the first time I tried it and it blocked access to my server I emailed their support to find out what I did wrong. That was over a week ago with no reply from them..... unless their reply is in my spam folder... :-)

[ewilen]

Have you tried doing a manual lookup?

First get the IP address of the sbcglobal MTA used to deliver your mail. Let's say it's w.x.y.z

Then open a shell session on your zimbra server and do:

host z.y.x.w.b.barracudacentral.org
You should get

Host z.y.x.w.b.barracudacentral.org not found: 3(NXDOMAIN)

Here's an example response you get when you look up a spamming site:

$ host 138.71.249.209.b.barracudacentral.org
138.71.249.209.b.barracudacentral.org has address 127.0.0.2

[uxbod]

Correct. It should be where the originating DNS requests are coming from so if running a split DNS it will be your MTA

[su_A_ve]

Bump - This is from the latest amavisd 2.6.4.

But I'm looking for a corresponding sa.local config file to go along with it...

TIA.

@virus_name_to_spam_score_maps =
  (new_RE(  # the order matters!
    [ qr'^Phishing\.'                                             => 0.1 ],
    [ qr'^Structured\.(SSN|CreditCardNumber)\b'                   => 0.1 ],
    [ qr'^(Email|HTML)\.Phishing\.(?!.*Sanesecurity)'             => 0.1 ],
    [ qr'^Sanesecurity\.(Malware|Rogue|Trojan)\.' => undef ],# keep as infected
    [ qr'^Sanesecurity\.'                                         => 0.1 ],
    [ qr'^Sanesecurity_PhishBar_'                                 => 0   ],
    [ qr'^Sanesecurity.TestSig_'                                  => 0   ],
    [ qr'^Email\.Spam\.Bounce(\.[^., ]*)*\.Sanesecurity\.'        => 0   ],
    [ qr'^Email\.Spammail\b'                                      => 0.1 ],
    [ qr'^MSRBL-(Images|SPAM)\b'                                  => 0.1 ],
    [ qr'^VX\.Honeypot-SecuriteInfo\.com\.Joke'                   => 0.1 ],
    [ qr'^VX\.not-virus_(Hoax|Joke)\..*-SecuriteInfo\.com(\.|\z)' => 0.1 ],
    [ qr'^Email\.Spam.*-SecuriteInfo\.com(\.|\z)'                 => 0.1 ],
    [ qr'^Safebrowsing\.'                                         => 0.1 ],
    [ qr'-SecuriteInfo\.com(\.|\z)'         => undef ],  # keep as infected
    [ qr'^MBL_NA\.UNOFFICIAL'               => 0.1 ],    # false positives
    [ qr'^MBL_'                             => undef ],  # keep as infected
    [ qr'^winnow\.(phish|spam)\.'                                  => 0.1],
    [ qr'^winnow\.malware\.'                => undef ],  # keep as infected
    [ qr'^INetMsg\.SpamDomain-2m\.'               => 0.1 ],
    [ qr'^INetMsg\.SpamDomain-2w\.'               => 0.1 ],
  ));

[uxbod]

Look at page one of this thread You may need to adjust the regex's for any new rules.