# This configuration file contains lists.debian.org specific rulessets # our MTAs fix up headers for a slew of spams, so mark these as suspicious # -- joy, 2003-06-28 # deactivated as this rule is also part of SA itself. #header OUR_MTA_MSGID Message-Id =~ /\@(murphy|master|gluck)\.debian\.org/ #describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs #score OUR_MTA_MSGID 1 # -- joy, 2003-08-15 header SENDER_FOR_US From =~ /\@(murphy|master|gluck|lists)\.debian\.org/ describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs score SENDER_FOR_US 2 # exception... --joy, 2003-07-12 header WEBSUBS X-Remote-IP =~ /./ describe WEBSUBS Sounds like a subscription request from the web score WEBSUBS -2 # another exception... --joy, 2003-07-27 header SUBSCONFIRM Subject =~ /CONFIRM [su]\d+/ describe SUBSCONFIRM Sounds like a subscription request confirmation score SUBSCONFIRM -2 # some valid autogenerated mail of ours # -- joy, 2003-07-09 header OUR_SCRIPTS_1 Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/ describe OUR_SCRIPTS_1 Mail likely generated by .bin/mladmin score OUR_SCRIPTS_1 -5 # our daily un/subscription report gets ~8 SA points ! # lower it to 3 # -- zobel, 2006-12-10 header _OUR_UNSUB_CHANGES1 Subject =~ /Daily un\/subscription report/ meta OUR_UNSUB_CHANGES (_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID) describe OUR_UNSUB_CHANGES Daily mail sent to listmaster about un/subscriptions score OUR_UNSUB_CHANGES -5 # exception... --joy, 2003-08-15 body MDOMOSUBS /^Request forwarded.$/ describe MDOMOSUBS Sounds like a subscription request via majorsmart score MDOMOSUBS -2 # another exception --joy, 2004-05-27 #body OURCRONMAILS Subject =~ /^Cron \