Mailing List Archive

Rule syntax in local.cf?
Howdy, all -

As I mentioned in a previous email, I'm trying to bump up the score for
BAYES_999. I have not messed with SA in years, but I'm trying to get
back into it. Sorry if this is a silly question.

I tried to add the following line to /etc/mail/spamassassin/local.cf,
but it's not firing:

[root@mail-east ~]# cat /etc/mail/spamassassin/local.cf
# These values can be overridden by editing ~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)

# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.

score SPAM_999 3

required_hits 5
report_safe 0
rewrite_header Subject [SPAM _SCORE_]

What I am seeing when I run spamassassin -D < mail/INBOX/spam looks like
this:

<snip>
From PowerPlant@sqribblemoney.cam  Fri May  6 14:28:32 2022
Return-Path: <PowerPlant@sqribblemoney.cam>
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on
        mail.redacted.foo
X-Spam-Flag: YES
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.3 required=5.0 tests=BAYES_99,BAYES_999,
HTML_IMAGE_ONLY_20,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,KHOP_HELO_FCRDNS,
        MAY_BE_FORGED,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE,
        URIBL_ABUSE_SURBL,URIBL_BLACK autolearn=disabled version=3.4.4
X-Spam-Report:
        *  1.2 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
        *      blocklist
        *      [URIs: sqribblemoney.cam]
        *  3.5 BAYES_99 BODY: Bayes May  6 14:46:39.902 [8259] dbg:
check: tagrun - tag DKIMDOMAIN is still blocking action 1
May  6 14:46:39.905 [8259] dbg: plugin:
Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0x5567f8e09e90) implements
'finish_tests', priority 0
May  6 14:46:39.905 [8259] dbg: plugin:
Mail::SpamAssassin::Plugin::Check=HASH(0x5567f8e0a430) implements
'finish_tests', priority 0
May  6 14:46:39.922 [8259] dbg: netset: cache trusted_networks
hits/attempts: 11/12, 91.7 %
spam probability is 99 to 100%
        *      [score: 1.0000]
        *  0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
        *      [score: 1.0000]
        *  1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
        *      [URIs: sqribblemoney.cam]
        *  0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
        *  0.0 SPF_NONE SPF: sender does not publish an SPF Record
        *  1.5 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000
bytes of
        *      words
        *  0.0 HTML_MESSAGE BODY: HTML included in message
        * -0.0 T_SCC_BODY_TEXT_LINE No description available.
        *  0.1 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
        *  1.0 MAY_BE_FORGED Relay IP's reverse DNS does not resolve to IP
        *  0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's
reverse DNS
<snip>

If I'm reading it correctly, it is NOT bumping up the score for
BAYES_999, it's only adding the default 0.2 to it.

I'm running this on Red Hat Enterprise Linux 8.5. The SA package is
spamassassin-3.4.4-4.el8.x86_64.

What am I doing wrong?

Thomas
Re: Rule syntax in local.cf? [ In reply to ]
On 2022-05-06 at 10:58:15 UTC-0400 (Fri, 6 May 2022 09:58:15 -0500)
Thomas Cameron <thomas.cameron@camerontech.com>
is rumored to have said:

> Howdy, all -
>
> As I mentioned in a previous email, I'm trying to bump up the score for BAYES_999. I have not messed with SA in years, but I'm trying to get back into it. Sorry if this is a silly question.
>
> I tried to add the following line to /etc/mail/spamassassin/local.cf, but it's not firing:
>
> [root@mail-east ~]# cat /etc/mail/spamassassin/local.cf
> # These values can be overridden by editing ~/.spamassassin/user_prefs.cf
> # (see spamassassin(1) for details)
>
> # These should be safe assumptions and allow for simple visual sifting
> # without risking lost emails.
>
> score SPAM_999 3

Where are you getting that rule name???

> If I'm reading it correctly, it is NOT bumping up the score for BAYES_999, it's only adding the default 0.2 to it.

SA is not clairvoyant or telepathic. It has no idea that you want to change the score on BAYES_999 by using the name of a non-existent rule SPAM_999.

> I'm running this on Red Hat Enterprise Linux 8.5. The SA package is spamassassin-3.4.4-4.el8.x86_64.
>
> What am I doing wrong?

Changing the score for a non-existent rule.


--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: Rule syntax in local.cf? [ In reply to ]
On 5/6/22 11:31, Bill Cole wrote:
> On 2022-05-06 at 10:58:15 UTC-0400 (Fri, 6 May 2022 09:58:15 -0500)
> Thomas Cameron <thomas.cameron@camerontech.com>
> is rumored to have said:
>
>> Howdy, all -
>>
>> As I mentioned in a previous email, I'm trying to bump up the score for BAYES_999. I have not messed with SA in years, but I'm trying to get back into it. Sorry if this is a silly question.
>>
>> I tried to add the following line to /etc/mail/spamassassin/local.cf, but it's not firing:
>>
>> [root@mail-east ~]# cat /etc/mail/spamassassin/local.cf
>> # These values can be overridden by editing ~/.spamassassin/user_prefs.cf
>> # (see spamassassin(1) for details)
>>
>> # These should be safe assumptions and allow for simple visual sifting
>> # without risking lost emails.
>>
>> score SPAM_999 3
> Where are you getting that rule name???
>
>> If I'm reading it correctly, it is NOT bumping up the score for BAYES_999, it's only adding the default 0.2 to it.
> SA is not clairvoyant or telepathic. It has no idea that you want to change the score on BAYES_999 by using the name of a non-existent rule SPAM_999.
>
>> I'm running this on Red Hat Enterprise Linux 8.5. The SA package is spamassassin-3.4.4-4.el8.x86_64.
>>
>> What am I doing wrong?
> Changing the score for a non-existent rule.
>
>
Ugh. I have no idea how I got it in my head that it was SPAM and not
BAYES. Sorry for the noise.

Thomas