Commit Graph

735 Commits

Author SHA1 Message Date
Vsevolod Stakhov
b7d96e6ad2 [Conf] Allow to load users plugins from plugins.d
Issue: #2848
2019-04-16 17:03:06 +01:00
Vsevolod Stakhov
e6e72472ad
Merge pull request #2850 from heraklit256/rule-descr-cleanup
[Minor] unify rule scores and weights and improve descriptions
2019-04-16 12:07:42 +01:00
Edmond
0d2f2dca84
Add a reference to the doc of composite rules 2019-04-08 15:11:17 +08:00
Carsten Rosenberg
2f118ada4e [Minor] fix some warnings 2019-04-02 06:38:54 +02:00
Vsevolod Stakhov
c427048cec [Feature] Validate BTC addresses in LEAKED_PASSWORD_SCAM 2019-03-19 16:15:20 +00:00
Vsevolod Stakhov
38084c8092 [Conf] Add vendor groups for symbols
Issue: #2803
2019-03-18 17:40:29 +00:00
Vsevolod Stakhov
18ce449e3a [Conf] Relax some uribl rules 2019-03-11 16:24:15 +00:00
Vsevolod Stakhov
71631e8a30
Merge pull request #2616 from heraklit256/uribl-spamhaus
also query resolved IPs against Spamhaus ZEN
2019-03-10 21:15:24 +00:00
heraklit256
dbba482e59 unify rules scores and weights forgotten in first commit 2019-03-05 17:18:36 +01:00
heraklit256
66067de1fb use 'message body' instead of 'mail' for rule description 2019-03-05 17:02:53 +01:00
heraklit256
b67cdc46d4 improve rule descriptions 2019-03-04 18:57:06 +01:00
heraklit256
24fd20bff8 set score of URIBL_PBL to +0.01 (be less penalising here) 2019-03-04 18:53:23 +01:00
heraklit256
4e878f443d fix typo in RCVD_UNAUTH_PBL 2019-02-13 21:37:16 +01:00
Vsevolod Stakhov
9f0e1cd979 [Conf] Remove abuse.ch
Issue: #2744
Closes: #2744
2019-02-05 09:09:15 +00:00
John McKay
d4b0d4617b keys from config and http arrayized 2019-02-02 05:41:41 +00:00
Vsevolod Stakhov
ac58581352 [Feature] Mime_types: Add MIME_BAD_UNICODE rule 2019-01-18 17:18:27 +00:00
Vsevolod Stakhov
3203d0f442
Merge pull request #2718 from HeinleinSupport/symbol_fail
[Minor] lua_scanners - use pattern for FAIL symbol
2019-01-18 15:10:12 +00:00
Vsevolod Stakhov
dd4ad1e446 [Conf] Add missing includes 2019-01-18 14:16:27 +00:00
Carsten Rosenberg
4d152f9362 [Minor] lua_scanners - use pattern for FAIL symbol 2019-01-18 14:33:38 +01:00
Vsevolod Stakhov
c20a13ccab
Merge pull request #2711 from HeinleinSupport/master
Oletools,ICAP support / lua_scanners enhancements
2019-01-17 15:03:38 +00:00
Vsevolod Stakhov
ae8f199719 [Rules] Add VIOLATED_DIRECT_SPF composite 2019-01-15 18:05:58 +00:00
Carsten Rosenberg
c2eaa5503f [Fix] groups.conf - filename typo 2019-01-14 15:06:35 +01:00
Carsten Rosenberg
92ec1c9701 [Minor] external_services config + groups 2019-01-13 15:42:09 +01:00
Vsevolod Stakhov
e96cab20b9 [Rework] Another paths rework 2018-12-26 15:00:02 +00:00
Vsevolod Stakhov
36e960ed74 [Rework] Slashing: Distinguish lualibdir, pluginsdir and sharedir 2018-12-26 15:00:02 +00:00
heraklit256
147324eac2 Oops, fix score for PKCS7 MIME types 2018-12-19 20:32:51 +01:00
Vsevolod Stakhov
bd6c26361c [Conf] Rbl: DWL is actually special whitelist 2018-12-15 19:20:11 +00:00
Michael Kliewe
c61f708d7d
Added message/rfc822 to mime_types.inc
message/rfc822 is the mimetype if you forward an email as attachment (.eml)
2018-12-09 20:06:16 +01:00
Vsevolod Stakhov
d3d19ad641 [Feature] Core: allow to emit soft reject on task timeout 2018-12-08 13:32:18 +00:00
Vsevolod Stakhov
eb75483007 [Conf] Move to options 2018-12-06 15:36:22 +00:00
Vsevolod Stakhov
7823e60034 [Conf] Fix configuration sample for ratelimit 2018-11-18 18:07:22 +00:00
Vsevolod Stakhov
2bc29360a3 [Conf] Disable rspamd_update by default (again) 2018-11-16 18:05:30 +00:00
Vsevolod Stakhov
84b57c53f4 [Minor] Allow to have bulk learn in the default config 2018-11-16 17:16:25 +00:00
Carsten Rosenberg
0c7666105a [Minor] Clickhouse - adjust .conf to follow db scheme v2 2018-11-12 09:56:51 +01:00
heraklit256
b6d1cf00f7 also query resolved IPs against Spamhaus ZEN 2018-10-29 21:06:36 +01:00
Vsevolod Stakhov
a8b22f9aac [Minor] Ops, fix symbol name 2018-10-29 17:49:46 +00:00
Vsevolod Stakhov
993c4a7552 [Conf] Add DWL support in the default configuration 2018-10-29 17:41:17 +00:00
Vsevolod Stakhov
04fe3d3f7c
Merge pull request #2566 from heraklit256/composites-leave
Minor Composite rule cleanup
2018-10-18 19:57:38 +01:00
heraklit256
574536f825 lower score for PHISH_EMOTION to 1.0 2018-10-17 21:49:38 +02:00
heraklit256
e5fbf6435a lower score for HAS_ANON_DOMAIN to 0.1 2018-10-17 21:49:16 +02:00
Vsevolod Stakhov
8167af6e65 [Minor] Add log_usec option to the default config as an example 2018-10-16 12:28:42 +01:00
Vsevolod Stakhov
20337000c7 [Conf] Extend BAD_POLICIES composite 2018-10-15 18:08:03 +01:00
heraklit256
8f76d99b15 add HAS_ONION_URI to HAS_ANON_DOMAIN 2018-10-13 20:47:23 +02:00
Vsevolod Stakhov
61b8bccda0 [Conf] Log forced action by default 2018-10-11 17:27:07 +01:00
Vsevolod Stakhov
abaa90892c [Minor] Fixes for the previous project 2018-10-09 14:58:44 +01:00
Vsevolod Stakhov
62b3a7c5e9 [Conf] Add composite to negate policies when fuzzy/bayes found 2018-10-09 12:37:30 +01:00
Vsevolod Stakhov
7f04293f0b [Conf] Increase default bayes score 2018-10-09 12:11:10 +01:00
Vsevolod Stakhov
47e2601278 [Conf] Add dkim checks for some surbl rules 2018-10-09 12:07:46 +01:00
Vsevolod Stakhov
7b1dd5c1a0
Merge pull request #2543 from heraklit256/extended-dnswl-scores
leaving original symbols if DNSWL composite rules are triggered
2018-10-08 16:22:43 +01:00
heraklit256
b6092b1f92 lower weight of RCVD_DKIM_ARC_DNSWL_HI to -1.0 2018-10-08 17:03:03 +02:00
heraklit256
0455923baf Include ARC into AUTH_NA rule 2018-10-04 18:04:44 +02:00
heraklit256
a15bd65a86 Composite rules: Minor cleanups
Added descriptions to some rules and unified AND operator.
2018-10-04 18:03:24 +02:00
heraklit256
baec25184f leave original symbols for composite rules
Removing original symbols if a composite rule triggers is kind
of confusing and makes debugging harder.
2018-10-04 17:58:07 +02:00
heraklit256
1a55afb110 lower weight for RCVD_DKIM_ARC_DNSWL_MED and RCVD_DKIM_ARC_DNSWL_HIGH
These were too high as other symbols - such as ARC_ALLOW - already
introduce some negative scores.

Thanks to @moisseev for reporting this.
2018-10-04 17:49:26 +02:00
Vsevolod Stakhov
730eff720c [Conf] Use new dmarc whitelist 2018-09-29 19:24:15 +01:00
Vsevolod Stakhov
dcc7e9ad2b [Conf] Specify whitelist symbols group 2018-09-29 12:43:13 +01:00
Vsevolod Stakhov
e8fe3c7547
Merge pull request #2544 from heraklit256/composites-cleanup
Fix description for composite rule RBL_SPAMHAUS_XBL_ANY
2018-09-28 20:13:09 +01:00
heraklit256
fc0cec888f Fix description for composite rule RBL_SPAMHAUS_XBL_ANY 2018-09-27 16:42:12 +02:00
heraklit256
6e44ac9fb4 leaving original symbols if DNSWL composite rules are triggered
Without policy = "leave", rspamd replaces the original symbols
in log and message header (if enabled), which makes debugging more
hard and is not used in this case.
2018-09-27 16:35:46 +02:00
Carsten Rosenberg
bb58fb5440 [Minor] Antivirus - configureable mime_part scanning 2018-09-26 14:31:47 +02:00
Carsten Rosenberg
37e36c1cdc [Minor] DCC Upstreams support 2018-09-26 11:20:27 +02:00
Alexander Moisseev
957e3c6d1a
[Minor] Remove UNPRECISE_RCPT_DETAIL_FROM_SPAMMY 2018-09-25 19:16:53 +03:00
Vsevolod Stakhov
b50a8429cf [CritFix] Increase default words_decay 2018-09-25 16:54:31 +01:00
Alexander Moisseev
fda9e074ec [Conf] Restore ability to disable phishtank 2018-09-25 14:34:21 +03:00
Vsevolod Stakhov
8c12705705 [Conf] Add maximum group score for phishing 2018-09-23 14:59:11 +01:00
Vsevolod Stakhov
52d2c9fe2d [Conf] Slashing change: add settings configuration to the vanilla set 2018-09-18 17:01:32 +01:00
Vsevolod Stakhov
3e12a51263
Merge pull request #2486 from heraklit256/rbl-blocklist
make sure blocklist.de-rule for Received IPs only triggers once
2018-09-15 19:51:21 +01:00
heraklit256
306192c0dd make sure blocklist.de-rule for Received IPs only triggers once 2018-09-14 16:37:56 +02:00
Vsevolod Stakhov
a110835223
Merge pull request #2471 from heraklit256/rbl-blocklist
Add blocklist.de RBL
2018-09-12 12:00:50 +01:00
heraklit256
648c87a935 add rule for domains trying to stay anonymous 2018-09-09 18:28:17 +02:00
heraklit256
04b52561b0 improve composite rules for phish messages 2018-09-09 18:21:12 +02:00
heraklit256
5312495106 add some missing composite rule description 2018-09-09 18:19:02 +02:00
heraklit256
08a9a1178a add blocklist.de RBL for from and received addresses 2018-09-08 12:39:41 +02:00
heraklit256
5afbc581fa add rule for spammy mails with detailled sender but generic recipients 2018-09-08 12:30:05 +02:00
heraklit256
faadf253ad add rule for phish messages containing emotional subjects 2018-09-08 12:11:36 +02:00
heraklit256
46bb18fa93 add rule for spammy PHP generated mails 2018-09-08 12:02:02 +02:00
Vsevolod Stakhov
b65379dd67
Merge pull request #2446 from heraklit256/extended-dnswl-scores
also trigger DNSWL score rule in case mails are properly ARC signed
2018-08-29 18:20:15 +01:00
Alexander Moisseev
acc871ecfc
[Conf] Fix whitelist.conf
Reported by @bjo81 via Telegram group
2018-08-28 19:50:29 +03:00
Vsevolod Stakhov
a754307205
Merge pull request #2445 from heraklit256/rbl_groupname
adjust Spamhaus group name for received IPs
2018-08-27 18:53:48 +01:00
heraklit256
f1ebed1f9c also trigger DNSWL score rule in case mails are properly ARC signed 2018-08-27 18:27:03 +02:00
heraklit256
c7cc0400ea adjust Spamhaus group name for received IPs 2018-08-27 18:19:50 +02:00
Vsevolod Stakhov
bb7e01011c
Merge pull request #2403 from heraklit256/extended-dnswl-scores
Add negative weight on DNSWL entries
2018-08-11 11:46:43 +01:00
heraklit256
c98a070546 adjust DNSWL scores to -0.1/-0.2/-0.5 2018-08-11 10:19:58 +02:00
dehnli
8e24ef61d3
[Minor] Remove phishtank map ..
.. in favour of DNS based service
2018-08-11 01:34:47 +03:00
Vsevolod Stakhov
0ebcb5c9fb
Merge pull request #2404 from heraklit256/rbl-nixspam
add NiX spam RBL
2018-08-09 11:54:11 +01:00
heraklit256
848e8f6614 add NiX Spam RBL (http://www.dnsbl.manitu.net/) 2018-08-07 16:47:23 +02:00
heraklit256
df8b53f3b1 Revert "mark PKCS7 mime types as good"
This reverts commit 19b524dc47.
2018-08-07 16:36:52 +02:00
heraklit256
1ecd691570 add negative weight to DNSWL entries
However, a message must be correctly DKIM signed to get some more
negative weight in case an received IP is listed with medium or
high trust at DNSWL.

This supersedes a first patch without the DKIM condition.
2018-08-07 16:34:30 +02:00
heraklit256
19b524dc47 mark PKCS7 mime types as good 2018-08-07 16:23:27 +02:00
Emerson Veenstra
ae1686eca3
Fix typo for ARC_REJECT 2018-08-02 13:12:52 -04:00
Mikhail Galanin
ad7d5442c5 Clickhouse tables retention 2018-07-26 15:21:13 +01:00
Vsevolod Stakhov
6250166809 [Conf] Add reputation module configuration placeholder 2018-07-23 11:20:41 +01:00
Vsevolod Stakhov
41ae3822c6 [Minor] Fix local variable in script 2018-07-20 17:36:48 +01:00
Vsevolod Stakhov
85d3aa18ed [Conf] Disable missing lists 2018-07-19 12:18:48 +01:00
Vsevolod Stakhov
4a5f7b6cae [Conf] Add fallback maps 2018-07-18 14:26:25 +01:00
Vsevolod Stakhov
03acc9d2ac [Conf] Use remote maps 2018-07-17 16:58:47 +01:00
Vsevolod Stakhov
4b6085b959 [Conf] Improve upstreams setup for fuzzy storage by default 2018-07-16 13:04:14 +01:00
Vsevolod Stakhov
1b096b8696 [Conf] Rename and fix RBL_VIRUSFREE symbol 2018-07-16 13:04:14 +01:00
Vsevolod Stakhov
f37c712c6e [Conf] Add RBL_VIRUSFREE RBL 2018-07-13 18:18:32 +01:00
Vsevolod Stakhov
a80a5d03f2 [Minor] Fix comments 2018-07-13 18:04:50 +01:00