diff --git a/site-cookbooks/kosmos_email/recipes/spamassassin.rb b/site-cookbooks/kosmos_email/recipes/spamassassin.rb index 3971c62..6659c51 100644 --- a/site-cookbooks/kosmos_email/recipes/spamassassin.rb +++ b/site-cookbooks/kosmos_email/recipes/spamassassin.rb @@ -29,6 +29,12 @@ template "/etc/spamassassin/local.cf" do notifies :restart, "service[spamassassin]", :delayed end +template "/etc/spamassassin/kosmos.cf" do + source "spamassassin_kosmos.cf.erb" + mode 0644 + notifies :restart, "service[spamassassin]", :delayed +end + service "spamassassin" do action [:enable, :start] end diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_default.erb b/site-cookbooks/kosmos_email/templates/spamassassin_default.erb index 624688a..03164b3 100644 --- a/site-cookbooks/kosmos_email/templates/spamassassin_default.erb +++ b/site-cookbooks/kosmos_email/templates/spamassassin_default.erb @@ -30,4 +30,4 @@ PIDFILE="/var/run/spamd.pid" # Cronjob # Set to anything but 0 to enable the cron job to automatically update # spamassassin's rules on a nightly basis -CRON=0 +CRON=1 diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb b/site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb new file mode 100644 index 0000000..7337e57 --- /dev/null +++ b/site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb @@ -0,0 +1,64 @@ +########################################################################### +# Kosmos custom SpamAssassin rules +# +# The rules below are designed to be individually weak but combine via meta +# rules into strong, low-FP signals. +########################################################################### + +# --- Individual signals -------------------------------------------------- + +# URLs of the form https://////////////... (3+ slashes after the scheme). +# Legitimate mailers never produce this; it is an obfuscation artefact. +rawbody KOSMOS_MULTI_SLASH_URL /https?:\/{3,}/ +describe KOSMOS_MULTI_SLASH_URL URL with three or more consecutive slashes + +# Authoring-tool fingerprint left in the HTML by the spam toolchain. +body KOSMOS_MSHTML_11_9600 /MSHTML 11\.00\.9600\.17037/ +describe KOSMOS_MSHTML_11_9600 HTML generated by MSHTML 11.00.9600.17037 + +# Display name pattern used by the campaign. +header KOSMOS_FROM_LUXURY_GOODS From:name =~ /Luxury (Watches|Bags|Handbags|Timepieces)\b/i +describe KOSMOS_FROM_LUXURY_GOODS From display name advertises luxury goods + +# Base64-encoded unsubscribe links: return.php?p= +uri KOSMOS_RETURN_PHP_B64 /return\.php\?p=[A-Za-z0-9+\/=%]{20,}/ +describe KOSMOS_RETURN_PHP_B64 Base64-encoded return.php unsubscribe link + +# Fabricated "security" headers injected to evade heuristic filters. +# No legitimate MTA or mailing-list manager emits these. +header KOSMOS_FAKE_HDR_PHISHSIM exists:X-PhishSimulator-Mode +header KOSMOS_FAKE_HDR_DECEPTION exists:X-Deception-Asset-Type +header KOSMOS_FAKE_HDR_OBFUSCATION exists:X-Obfuscation-Trace-ID +header KOSMOS_FAKE_HDR_QUARANTINE exists:X-Quarantine-Reason-Code +header KOSMOS_FAKE_HDR_TRUST exists:X-Behavioral-Trust-Index + +# --- Scores for individual signals -------------------------------------- +score KOSMOS_MULTI_SLASH_URL 2.0 +score KOSMOS_MSHTML_11_9600 1.2 +score KOSMOS_FROM_LUXURY_GOODS 0.5 +score KOSMOS_RETURN_PHP_B64 1.5 +score KOSMOS_FAKE_HDR_PHISHSIM 1.0 +score KOSMOS_FAKE_HDR_DECEPTION 1.0 +score KOSMOS_FAKE_HDR_OBFUSCATION 1.0 +score KOSMOS_FAKE_HDR_QUARANTINE 1.0 +score KOSMOS_FAKE_HDR_TRUST 1.0 + +# --- Meta rules ---------------------------------------------------------- + +# Core campaign signature: luxury-goods From name + MSHTML fingerprint + +# HTML-only body. Covers the bulk of the campaign corpus. +meta KOSMOS_LUXURY_SPAM_CAMPAIGN (KOSMOS_FROM_LUXURY_GOODS && KOSMOS_MSHTML_11_9600 && MIME_HTML_ONLY) +describe KOSMOS_LUXURY_SPAM_CAMPAIGN Luxury-goods From + MSHTML 11.00.9600 + HTML-only +score KOSMOS_LUXURY_SPAM_CAMPAIGN 3.5 + +# Luxury-goods From name combined with a suspicious URI signal or a +# Spamhaus-listed relay. +meta KOSMOS_LUXURY_SPAM_URI (KOSMOS_FROM_LUXURY_GOODS && (KOSMOS_MULTI_SLASH_URL || KOSMOS_RETURN_PHP_B64 || RCVD_IN_SBL_CSS)) +describe KOSMOS_LUXURY_SPAM_URI Luxury-goods From + suspicious URI or SBL relay +score KOSMOS_LUXURY_SPAM_URI 2.5 + +# Two or more fabricated "security" headers. Genuine mail never carries +# these; their presence indicates a header-injection evasion kit. +meta KOSMOS_FAKE_SECURITY_HEADERS (KOSMOS_FAKE_HDR_PHISHSIM + KOSMOS_FAKE_HDR_DECEPTION + KOSMOS_FAKE_HDR_OBFUSCATION + KOSMOS_FAKE_HDR_QUARANTINE + KOSMOS_FAKE_HDR_TRUST >= 2) +describe KOSMOS_FAKE_SECURITY_HEADERS Two or more fabricated security headers +score KOSMOS_FAKE_SECURITY_HEADERS 4.0 diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb index c196054..052a15c 100644 --- a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb +++ b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb @@ -16,6 +16,37 @@ whitelist_auth <%= @whitelist_auth %> # _CONTACTADDRESS_ in the report template) report_contact <%= @report_contact %> +########################################################################### +# Kosmos custom score overrides +# +# The Validity (Return Path / SenderScore) "certified sender" whitelists +# (RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_SAFE) hand out up to -5.0 +# of credit to sending IPs. These lists are commercially gamed and +# routinely award -5.0 to IPs that are simultaneously listed on Spamhaus +# SBL-CSS, SpamCop, MSPIKE and Validity's own RPBL. Neutralise them. +########################################################################### +score RCVD_IN_VALIDITY_CERTIFIED 0 +score RCVD_IN_VALIDITY_SAFE 0 + +########################################################################### +# Bayes hardening +########################################################################### +use_bayes 1 +bayes_auto_learn 1 + +# Do not let Bayes learn from SpamAssassin's own result headers or from +# Authentication-Results, which leak signal about prior scoring runs. +bayes_ignore_header X-Spam-Flag +bayes_ignore_header X-Spam-Status +bayes_ignore_header X-Spam-Level +bayes_ignore_header X-Spam-Checker-Version +bayes_ignore_header Authentication-Results + +# Only learn ham when the message is clearly clean, and only learn spam +# when it is clearly spam. The defaults (0.1 / 6.0) let marginally-spam +# or marginally-ham messages poison the database. +bayes_auto_learn_threshold_nonspam -1.0 +bayes_auto_learn_threshold_spam 8.0 # Add *****SPAM***** to the Subject header of spam e-mails #