1 # This configuration file contains lists.debian.org specific rulessets
3 # our MTAs fix up headers for a slew of spams, so mark these as suspicious
5 # deactivated as this rule is also part of SA itself.
6 #header OUR_MTA_MSGID Message-Id =~ /\@(liszt|master|gluck)\.debian\.org/
7 #describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs
11 header SENDER_FOR_US From =~ /\@(liszt|master|gluck|lists)\.debian\.org/
12 describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs
15 # exception... --joy, 2003-07-12
16 header WEBSUBS X-Remote-IP =~ /./
17 describe WEBSUBS Sounds like a subscription request from the web
20 # another exception... --joy, 2003-07-27
21 header SUBSCONFIRM Subject =~ /CONFIRM [su]\d+/
22 describe SUBSCONFIRM Sounds like a subscription request confirmation
25 # some valid autogenerated mail of ours
27 header OUR_SCRIPTS_1 Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/
28 describe OUR_SCRIPTS_1 Mail likely generated by .bin/mladmin
29 score OUR_SCRIPTS_1 -5
31 # our daily un/subscription report gets ~8 SA points !
33 # -- zobel, 2006-12-10
34 header _OUR_UNSUB_CHANGES1 Subject =~ /Daily un\/subscription report/
35 meta OUR_UNSUB_CHANGES (_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID)
36 describe OUR_UNSUB_CHANGES Daily mail sent to listmaster about un/subscriptions
37 score OUR_UNSUB_CHANGES -5
39 # exception... --joy, 2003-08-15
40 body MDOMOSUBS /^Request forwarded.$/
41 describe MDOMOSUBS Sounds like a subscription request via majorsmart
44 # another exception --joy, 2004-05-27
45 #body OURCRONMAILS Subject =~ /^Cron \<list\@.*\/var\/list\//
46 #describe OURCRONMAILS Sounds like a legitimate cron job mail
47 #score OURCRONMAILS -3
49 header LISZT_LOCAL_FORWARDED Resent-From =~ /liszt\.debian\.org/
50 describe LISZT_LOCAL_FORWARDED Mail has been locally forwarded.
51 score LISZT_LOCAL_FORWARDED -5
53 # temp work-around for d-l-f
55 header RFR Subject =~ /\[RFR\]/
56 describe RFR Request for revision
60 header AM_REPORT Subject =~ /AM Report for Week Ending/
61 describe AM_REPORT Auto-generated AM summary
64 # automated reports on debian-l10n-french
65 header MURPHY_MIGUS_REPORT Subject =~ /Etat dans le CVS des/
66 describe MURPHY_MIGUS_REPORT Auto-generated report from migus on translations
67 score MURPHY_MIGUS_REPORT -5
69 # our own whitelisting of subscribers
70 header LDOSUBSCRIBER X-Subscriber-lists.debian.org =~ /./
71 describe LDOSUBSCRIBER Sender is a lists.debian.org subscriber
72 score LDOSUBSCRIBER -6
74 # whitelist mails to majordomo
75 header MAJORDOMOMAIL Delivered-To =~ /lists-majordomo@/
76 describe MAJORDOMOMAIL mail to major domo
77 score MAJORDOMOMAIL -0.1
79 meta MAJORDOMOWHITE (MAJORDOMO && (NOSUBJECT || MISSING_SUBJECT))
80 describe MAJORDOMOWHITE Counteract no subject score for majordomo mails
81 score MAJORDOMOWHITE -3
83 score CORRUPT_FROM_LINE_IN_HDRS 0
84 score FM_DDDD_TIMES_2 0
85 score FM_SEX_HOSTDDDD 0
86 score NO_HEADERS_MESSAGE 0
87 score SARE_HEAD_SUBJ_RAND 0
88 score SARE_SPEC_PROLEO_M2a 0
90 score MSGID_FROM_MTA_ID 0