Two questions on virus_name_to_spam_score_maps

[Ricardo Stella via amavis-users]

On 8/27/2013 11:37 AM, Benedict White wrote:
>> On 8/26/2013 5:45 PM, Benedict White via amavis-users wrote:
>> >
>> >1 - If I want to add something to the default list of @virus_name_to_spam_score_maps, do I need to define the default ones, or will it >simply add the existing ones?  I would assume that defining a rule will overwrite the >existing one, but not sure if by defining >@virus_name_to_spam_score_maps would replace all the other existing ones.
>> >
>> >I preume that if you define that map you will over write the default so if you want to add to it, copy the default into your amavisd.conf
>> >and then add to it.
>> >
>> >Thanks - that's what I was thinking...
>> >
>> >
>> >2 - Is there a sample local.cf to accompany the existing default set?  Working on a sample provided a few years ago and was looking for >a more up-to-date version.
>> >
>> >local,cf is a Spammassassin config file, download the latest version of that and have a look at it.
>> >
>> >
>> >What I'm looking for is the corresponding entries that would go in the local.cf file that match the new defined virus_name_to_spam_score_maps.
>> >
>> >This would be something like:
>> >
>> >header L_AV_Phish       X-Amavis-AV-Status =~ m{\bAV:(Email|HTML)\.Phishing\.}i
>> >score  L_AV_Phish       14
>> >
>> >I'd rather not reinvent the wheel if someone already wrote these.
> virus_name_to_spam_score_maps is an Amavisd setting not a Spamassassin setting so it doesn't crop up in a local.cf
>
>
> Kindest regards,
>
> Benedict White
>

Not quite.   When you define @virus_name_to_spam_score_maps, you
downgrade a reported infection to spam.  The default values for most
(some stay undefined to keep the status as infected) is set to 0.1.  You
have the option to change the values here, or, you can keep this small
value and make adjustments in spamassassin in local.cf (or a dedicated
sa config file).  This detection is passed down to SA and hence you
would make the corresponding scores like my example above.  The benefit
of this is that other SA rules would also be triggered and add to the score.

In my example, Amavis adds 0.1 points to Email|HTML.Phishing detections
by ClamAV but then SA adds 14 points with it's definition in local.cf.

There was an old one posted years ago but looks like it was never updated. 

http://www200.pair.com/mecham/spam/amavis-sanesecurity_v2.cf

Since the defaults for @virus_name_to_spam_score_maps has been updated,
I imagined a corresponding version of the above would also be available.

Thanks in advance.





-- 
°((( = (( ===°°° ((( ================================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20130827/cb231df5/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: stella.vcf
Type: text/x-vcard
Size: 261 bytes
Desc: not available
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20130827/cb231df5/attachment.vcf>