| 1 |
# This configuration file contains lists.debian.org specific rulessets
|
| 2 |
|
| 3 |
# our MTAs fix up headers for a slew of spams, so mark these as suspicious
|
| 4 |
# -- joy, 2003-06-28
|
| 5 |
header OUR_MTA_MSGID Message-Id =~ /\@(murphy|master|gluck)\.debian\.org/
|
| 6 |
describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs
|
| 7 |
score OUR_MTA_MSGID 1
|
| 8 |
|
| 9 |
# -- joy, 2003-08-15
|
| 10 |
header SENDER_FOR_US From =~ /\@(murphy|master|gluck|lists)\.debian\.org/
|
| 11 |
describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs
|
| 12 |
score SENDER_FOR_US 2
|
| 13 |
|
| 14 |
# exception... --joy, 2003-07-12
|
| 15 |
header WEBSUBS X-Remote-IP =~ /./
|
| 16 |
describe WEBSUBS Sounds like a subscription request from the web
|
| 17 |
score WEBSUBS -2
|
| 18 |
|
| 19 |
# another exception... --joy, 2003-07-27
|
| 20 |
header SUBSCONFIRM Subject =~ /CONFIRM [su]\d+/
|
| 21 |
describe SUBSCONFIRM Sounds like a subscription request confirmation
|
| 22 |
score SUBSCONFIRM -2
|
| 23 |
|
| 24 |
# some valid autogenerated mail of ours
|
| 25 |
# -- joy, 2003-07-09
|
| 26 |
header OUR_SCRIPTS_1 Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/
|
| 27 |
describe OUR_SCRIPTS_1 Mail likely generated by .bin/mladmin
|
| 28 |
score OUR_SCRIPTS_1 -5
|
| 29 |
|
| 30 |
# our daily un/subscription report gets ~8 SA points !
|
| 31 |
# lower it to 3
|
| 32 |
# -- zobel, 2006-12-10
|
| 33 |
header _OUR_UNSUB_CHANGES1 Subject =~ /Daily un\/subscription report/
|
| 34 |
meta OUR_UNSUB_CHANGES (_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID)
|
| 35 |
describe OUR_UNSUB_CHANGES Daily mail sent to listmaster about un/subscriptions
|
| 36 |
score OUR_UNSUB_CHANGES -5
|
| 37 |
|
| 38 |
# exception... --joy, 2003-08-15
|
| 39 |
body MDOMOSUBS /^Request forwarded.$/
|
| 40 |
describe MDOMOSUBS Sounds like a subscription request via majorsmart
|
| 41 |
score MDOMOSUBS -2
|
| 42 |
|
| 43 |
# another exception --joy, 2004-05-27
|
| 44 |
#body OURCRONMAILS Subject =~ /^Cron \<list\@.*\/var\/list\//
|
| 45 |
#describe OURCRONMAILS Sounds like a legitimate cron job mail
|
| 46 |
#score OURCRONMAILS -3
|
| 47 |
|
| 48 |
header MURPHY_LOCAL_FORWARDED Resent-From =~ /murphy\.debian\.org/
|
| 49 |
describe MURPHY_LOCAL_FORWARDED Mail has been locally forwarded.
|
| 50 |
score MURPHY_LOCAL_FORWARDED -5
|
| 51 |
|
| 52 |
# temp work-around for d-l-f
|
| 53 |
|
| 54 |
header RFR Subject =~ /\[RFR\]/
|
| 55 |
describe RFR Request for revision
|
| 56 |
score RFR -5
|
| 57 |
|
| 58 |
# pasc 2004-02-02
|
| 59 |
header AM_REPORT Subject =~ /AM Report for Week Ending/
|
| 60 |
describe AM_REPORT Auto-generated AM summary
|
| 61 |
score AM_REPORT -5
|
| 62 |
|
| 63 |
# automated reports on debian-l10n-french
|
| 64 |
header MURPHY_MIGUS_REPORT Subject =~ /Etat dans le CVS des/
|
| 65 |
describe MURPHY_MIGUS_REPORT Auto-generated report from migus on translations
|
| 66 |
score MURPHY_MIGUS_REPORT -5
|
| 67 |
|
| 68 |
# our own whitelisting of subscribers
|
| 69 |
header LDOSUBSCRIBER X-Subscriber-murphy.debian.org =~ /./
|
| 70 |
describe LDOSUBSCRIBER Sender is a lists.debian.org subscriber
|
| 71 |
score LDOSUBSCRIBER -6
|
| 72 |
|
Parent Directory
| 
Revision Log