<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 4/25/12 5:39 AM, Patrick Ben Koetter wrote:
<blockquote cite="mid:20120425093954.GB30685@state-of-mind.de"
type="cite">
<pre wrap="">Marc,
I would like to detect and quarantine messages that contain special content
e.g. having a Subject:-header with "foo" in it or a special word in the body.
Such content is neither spam, badh, etc.. So even if it were possible to do
detect such content today I would have to abuse a content class to store it in
quarantine.
Do you think it would be possible to add a new content class especially for
tagged messages?
</pre>
</blockquote>
we do it here, for DLP. we can 'tag', whitelist, blacklist, or
quarantine.<br>
<br>
start with an amavisd.custom<br>
change %Amavis::Conf::subject_tag_maps_by_ccat and
Amavis::Conf::quarantine_method_by_ccat (unless you never need to
quarantine by cat)<br>
know what your rule will add to X-Spam-Status<br>
<br>
look for that in sub checks() and sub before_send() (if you need
quarantine).<br>
<br>
do magic, including putting [CONTENT] in Subject line on inbound
(like [SPAM] in subject in inbound)<br>
<br>
can I share EXACTLY how I did it?<br>
<br>
no, not really. but this should get you started.<br>
<br>
<div class="moz-signature">-- <br>
Michael Scheidell, CTO<br>
o: 561-999-5000<br>
d: 561-948-2259<br>
<font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
Network Security Corporation
<style type="text/css">
<!--
.unnamed1 {
margin: 1em;
padding: 1px;
} -->
</style>
<ul class="unnamed1">
<li>Best Mobile Solutions Product of 2011</li>
<li>Best Intrusion Prevention Product</li>
<li>Hot Company Finalist 2011</li>
<li>Best Email Security Product</li>
<li>Certified SNORT Integrator</li>
</ul>
</div>
<br>
<div id="disclaimer.secnap.com"><hr />This email has been scanned and certified safe by SpammerTrap®.</div>
<div>For Information please see
<a href="http://www.spammertrap.com/">http://www.spammertrap.com/</a> <hr /></div>
<br>
</body>
</html>