Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

"tagged" content class?

2 views
Skip to first unread message

Patrick Ben Koetter

unread,
Apr 25, 2012, 5:39:54 AM4/25/12
to
Marc,

I would like to detect and quarantine messages that contain special content
e.g. having a Subject:-header with "foo" in it or a special word in the body.

Such content is neither spam, badh, etc.. So even if it were possible to do
detect such content today I would have to abuse a content class to store it in
quarantine.

Do you think it would be possible to add a new content class especially for
tagged messages?

p@rick

--
state of mind ()
Digitale Kommunikation

http://www.state-of-mind.de

Franziskanerstraße 15 Telefon +49 89 3090 4664
81669 München Telefax +49 89 3090 4666

Amtsgericht München Partnerschaftsregister PR 563

Andreas Schulze

unread,
Apr 25, 2012, 5:47:48 AM4/25/12
to
Am 25.04.2012 11:39 schrieb Patrick Ben Koetter:
> I would like to detect and quarantine messages that contain special content
> e.g. having a Subject:-header with "foo" in it or a special word in the body.
>
> Such content is neither spam, badh, etc.. So even if it were possible to do
> detect such content today I would have to abuse a content class to store it in
> quarantine.
>
> Do you think it would be possible to add a new content class especially for
> tagged messages?

+1
good idea for a powerfull feature!

Andreas

--
Andreas Schulze
Internetdienste | P252

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen

Michael Scheidell

unread,
Apr 25, 2012, 10:00:50 AM4/25/12
to
On 4/25/12 5:39 AM, Patrick Ben Koetter wrote: 
Marc,

I would like to detect and quarantine messages that contain special content
e.g. having a Subject:-header with "foo" in it or a special word in the body.

Such content is neither spam, badh, etc.. So even if it were possible to do
detect such content today I would have to abuse a content class to store it in
quarantine.

Do you think it would be possible to add a new content class especially for
tagged messages?
we do it here, for DLP.  we can 'tag', whitelist, blacklist, or quarantine.

start with an amavisd.custom
change %Amavis::Conf::subject_tag_maps_by_ccat and Amavis::Conf::quarantine_method_by_ccat (unless you never need to quarantine by cat)
know what your rule will add to X-Spam-Status

look for that in sub checks() and sub before_send() (if you need quarantine).

do magic, including putting [CONTENT] in Subject line on inbound (like [SPAM] in subject in inbound)

can I share EXACTLY how I did it?

no, not really.  but this should get you started.

--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
> | SECNAP Network Security Corporation
  • Best Mobile Solutions Product of 2011
  • Best Intrusion Prevention Product
  • Hot Company Finalist 2011
  • Best Email Security Product
  • Certified SNORT Integrator

This email has been scanned and certified safe by SpammerTrap®.
For Information please see http://www.spammertrap.com/

0 new messages