Amavis header and Spamassassin
Phil Daws via amavis-users
amavis-users at amavis.org
Wed Jan 15 18:15:35 CET 2014
Hello all,
have just noticed an issue where emails are not being scored correctly when ClamAV is being used in conjunction with Amavisd-new and Spamassassin. In my amavisd.conf I have set:
@keep_decoded_original_maps = (new_RE(
qr'^MAIL$', # let virus scanner see full original message
qr'^MAIL-UNDECIPHERABLE$', # same as ^MAIL$ if mail is undecipherable
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
qr'^Zip archive data', # don't trust Archive::Zip
));
@virus_name_to_spam_score_maps =
(new_RE( [ qr'Sanesecurity' => 0 ],
[ qr'MSRBL' => 0 ],
[ qr'SecuriteInfo' => 0 ],
[ qr'MBL' => 0 ],
[ qr'winnow' => 0 ],
[ qr'INetMsg' => 0 ],
[ qr'Safebrowsing' => 0 ],
[ qr'ScamNailer' => 0 ],
[ qr'Email' => 0 ],
[ qr'HTML' => 0 ],
[ qr'JS.Redirect-2' => 0 ],
));
and within a local_site.cf under /etc/mail/spamassassin I have:
################################################################################
# SaneSecurity & MSRBL Signatures
################################################################################
header CLAM_SS X-Amavis-AV-Status =~ m{Sanesecurity}
header CLAM_MSRBL X-Amavis-AV-Status =~ m{MSRBL}
header CLAM_MBL X-Amavis-AV-Status =~ m{MBL}
header CLAM_SI X-Amavis-AV-Status =~ m{SecuriteInfo}
header CLAM_WN X-Amavis-AV-Status =~ m{winnow}
header CLAM_IM X-Amavis-AV-Status =~ m{INetMsg}
header CLAM_SB X-Amavis-AV-Status =~ m{Safebrowsing}
header CLAM_SN X-Amavis-AV-Status =~ m{ScamNailer}
header CLAM_CAV X-Amavis-AV-Status =~ m{Email|HTML|JS.Redirect}
header CLAM_DS X-Amavis-AV-Status =~ m{Doppelstern}
score CLAM_SS 2.5
score CLAM_MSRBL 1.5
score CLAM_MBL 1.5
score CLAM_SI 2.0
score CLAM_WN 2.0
score CLAM_IM 2.0
score CLAM_SB 2.5
score CLAM_SN 2.5
score CLAM_CAV 1.0
score CLAM_DS 1.0
but when I check my maillog mails which are hitting the Sanesecurity rules are not being converted to a score ?
Jan 15 15:42:20 mx amavis[19918]: (19918-07) run_av (ClamAV-clamd): /var/amavis/tmp/amavis-20140115T120108-19918-H3u_539H/parts INFECTED: Sanesecurity.Spam.11344.Dom.UNOFFICIAL
Jan 15 15:42:20 mx amavis[19918]: (19918-07) Turning AV infection into a spam report: score=0, AV:Sanesecurity.Spam.11344.Dom.UNOFFICIAL=0
The software revisions am running are:
amavisd-new-2.8.1-1.el6.x86_64
spamassassin-3.3.1-3.el6.x86_64
clamav-db-0.98-2.el6.x86_64
clamav-0.98-2.el6.x86_64
clamd-0.98-2.el6.x86_64
Any ideas please ? Thanks.
More information about the amavis-users
mailing list