From 2bd6da0064e02359f2073c70eb44aea7b3bda381 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 17 Aug 2026 14:56:29 -0600 Subject: [PATCH 1/3] Auto-update spamassassin rules --- site-cookbooks/kosmos_email/templates/spamassassin_default.erb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_default.erb b/site-cookbooks/kosmos_email/templates/spamassassin_default.erb index 624688a..03164b3 100644 --- a/site-cookbooks/kosmos_email/templates/spamassassin_default.erb +++ b/site-cookbooks/kosmos_email/templates/spamassassin_default.erb @@ -30,4 +30,4 @@ PIDFILE="/var/run/spamd.pid" # Cronjob # Set to anything but 0 to enable the cron job to automatically update # spamassassin's rules on a nightly basis -CRON=0 +CRON=1 From 413f02d9c18c44e96148e8384c6e22753dd4f998 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 17 Aug 2026 14:57:10 -0600 Subject: [PATCH 2/3] Fix commercial validity lists poisoning Bayes db, harden Bayes learning --- .../templates/spamassassin_local.cf.erb | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb index c196054..052a15c 100644 --- a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb +++ b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb @@ -16,6 +16,37 @@ whitelist_auth <%= @whitelist_auth %> # _CONTACTADDRESS_ in the report template) report_contact <%= @report_contact %> +########################################################################### +# Kosmos custom score overrides +# +# The Validity (Return Path / SenderScore) "certified sender" whitelists +# (RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_SAFE) hand out up to -5.0 +# of credit to sending IPs. These lists are commercially gamed and +# routinely award -5.0 to IPs that are simultaneously listed on Spamhaus +# SBL-CSS, SpamCop, MSPIKE and Validity's own RPBL. Neutralise them. +########################################################################### +score RCVD_IN_VALIDITY_CERTIFIED 0 +score RCVD_IN_VALIDITY_SAFE 0 + +########################################################################### +# Bayes hardening +########################################################################### +use_bayes 1 +bayes_auto_learn 1 + +# Do not let Bayes learn from SpamAssassin's own result headers or from +# Authentication-Results, which leak signal about prior scoring runs. +bayes_ignore_header X-Spam-Flag +bayes_ignore_header X-Spam-Status +bayes_ignore_header X-Spam-Level +bayes_ignore_header X-Spam-Checker-Version +bayes_ignore_header Authentication-Results + +# Only learn ham when the message is clearly clean, and only learn spam +# when it is clearly spam. The defaults (0.1 / 6.0) let marginally-spam +# or marginally-ham messages poison the database. +bayes_auto_learn_threshold_nonspam -1.0 +bayes_auto_learn_threshold_spam 8.0 # Add *****SPAM***** to the Subject header of spam e-mails # From eae40fd55b979d7a2f73a78d6ded6005d73b862f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 17 Aug 2026 14:58:42 -0600 Subject: [PATCH 3/3] Add custom spam rules Targeting known campaigns --- .../kosmos_email/recipes/spamassassin.rb | 6 ++ .../templates/spamassassin_kosmos.cf.erb | 64 +++++++++++++++++++ 2 files changed, 70 insertions(+) create mode 100644 site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb diff --git a/site-cookbooks/kosmos_email/recipes/spamassassin.rb b/site-cookbooks/kosmos_email/recipes/spamassassin.rb index 3971c62..6659c51 100644 --- a/site-cookbooks/kosmos_email/recipes/spamassassin.rb +++ b/site-cookbooks/kosmos_email/recipes/spamassassin.rb @@ -29,6 +29,12 @@ template "/etc/spamassassin/local.cf" do notifies :restart, "service[spamassassin]", :delayed end +template "/etc/spamassassin/kosmos.cf" do + source "spamassassin_kosmos.cf.erb" + mode 0644 + notifies :restart, "service[spamassassin]", :delayed +end + service "spamassassin" do action [:enable, :start] end diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb b/site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb new file mode 100644 index 0000000..7337e57 --- /dev/null +++ b/site-cookbooks/kosmos_email/templates/spamassassin_kosmos.cf.erb @@ -0,0 +1,64 @@ +########################################################################### +# Kosmos custom SpamAssassin rules +# +# The rules below are designed to be individually weak but combine via meta +# rules into strong, low-FP signals. +########################################################################### + +# --- Individual signals -------------------------------------------------- + +# URLs of the form https://////////////... (3+ slashes after the scheme). +# Legitimate mailers never produce this; it is an obfuscation artefact. +rawbody KOSMOS_MULTI_SLASH_URL /https?:\/{3,}/ +describe KOSMOS_MULTI_SLASH_URL URL with three or more consecutive slashes + +# Authoring-tool fingerprint left in the HTML by the spam toolchain. +body KOSMOS_MSHTML_11_9600 /MSHTML 11\.00\.9600\.17037/ +describe KOSMOS_MSHTML_11_9600 HTML generated by MSHTML 11.00.9600.17037 + +# Display name pattern used by the campaign. +header KOSMOS_FROM_LUXURY_GOODS From:name =~ /Luxury (Watches|Bags|Handbags|Timepieces)\b/i +describe KOSMOS_FROM_LUXURY_GOODS From display name advertises luxury goods + +# Base64-encoded unsubscribe links: return.php?p= +uri KOSMOS_RETURN_PHP_B64 /return\.php\?p=[A-Za-z0-9+\/=%]{20,}/ +describe KOSMOS_RETURN_PHP_B64 Base64-encoded return.php unsubscribe link + +# Fabricated "security" headers injected to evade heuristic filters. +# No legitimate MTA or mailing-list manager emits these. +header KOSMOS_FAKE_HDR_PHISHSIM exists:X-PhishSimulator-Mode +header KOSMOS_FAKE_HDR_DECEPTION exists:X-Deception-Asset-Type +header KOSMOS_FAKE_HDR_OBFUSCATION exists:X-Obfuscation-Trace-ID +header KOSMOS_FAKE_HDR_QUARANTINE exists:X-Quarantine-Reason-Code +header KOSMOS_FAKE_HDR_TRUST exists:X-Behavioral-Trust-Index + +# --- Scores for individual signals -------------------------------------- +score KOSMOS_MULTI_SLASH_URL 2.0 +score KOSMOS_MSHTML_11_9600 1.2 +score KOSMOS_FROM_LUXURY_GOODS 0.5 +score KOSMOS_RETURN_PHP_B64 1.5 +score KOSMOS_FAKE_HDR_PHISHSIM 1.0 +score KOSMOS_FAKE_HDR_DECEPTION 1.0 +score KOSMOS_FAKE_HDR_OBFUSCATION 1.0 +score KOSMOS_FAKE_HDR_QUARANTINE 1.0 +score KOSMOS_FAKE_HDR_TRUST 1.0 + +# --- Meta rules ---------------------------------------------------------- + +# Core campaign signature: luxury-goods From name + MSHTML fingerprint + +# HTML-only body. Covers the bulk of the campaign corpus. +meta KOSMOS_LUXURY_SPAM_CAMPAIGN (KOSMOS_FROM_LUXURY_GOODS && KOSMOS_MSHTML_11_9600 && MIME_HTML_ONLY) +describe KOSMOS_LUXURY_SPAM_CAMPAIGN Luxury-goods From + MSHTML 11.00.9600 + HTML-only +score KOSMOS_LUXURY_SPAM_CAMPAIGN 3.5 + +# Luxury-goods From name combined with a suspicious URI signal or a +# Spamhaus-listed relay. +meta KOSMOS_LUXURY_SPAM_URI (KOSMOS_FROM_LUXURY_GOODS && (KOSMOS_MULTI_SLASH_URL || KOSMOS_RETURN_PHP_B64 || RCVD_IN_SBL_CSS)) +describe KOSMOS_LUXURY_SPAM_URI Luxury-goods From + suspicious URI or SBL relay +score KOSMOS_LUXURY_SPAM_URI 2.5 + +# Two or more fabricated "security" headers. Genuine mail never carries +# these; their presence indicates a header-injection evasion kit. +meta KOSMOS_FAKE_SECURITY_HEADERS (KOSMOS_FAKE_HDR_PHISHSIM + KOSMOS_FAKE_HDR_DECEPTION + KOSMOS_FAKE_HDR_OBFUSCATION + KOSMOS_FAKE_HDR_QUARANTINE + KOSMOS_FAKE_HDR_TRUST >= 2) +describe KOSMOS_FAKE_SECURITY_HEADERS Two or more fabricated security headers +score KOSMOS_FAKE_SECURITY_HEADERS 4.0