LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   Spamassassin Blank body & PDF attachments (https://www.linuxquestions.org/questions/linux-software-2/spamassassin-blank-body-and-pdf-attachments-572175/)

matt1982 07-25-2007 10:24 AM

Spamassassin Blank body & PDF attachments
 
Hi guys,

I've been adding rules to my local.cf file, which obviously I maintain, but recently I've been getting a large amount of SPAM comming in with .pdf attachments and blank lines in the body.

I'm digging hard on google and i'm trying to come up with a rule that if an email comes in with a pdf attachment and a blank body to mark it as SPAM....



Anyone have any ideas, i'm really getting frustrated... :P

Thanks ahead for the help :)

Matt

bigrigdriver 07-25-2007 01:54 PM

Try the SpamAssassin Wiki. They have some custom rulesets that you can download, use, and modify to your hearts content.

Get them here: http://wiki.apache.org/spamassassin/ThirdPartySoftware

matt1982 07-25-2007 02:41 PM

Thanks, I've been checking out that site today, but the only thing I have found for scanning pdf attachments is by installing a plugin on my spamassassin and then use rules to work with it.

Is there now was to have a rule check an attachment, ie a pdf with blank body?



Still searching...., thanks though for the link :)

matt1982 07-26-2007 09:58 AM

How about just a rule that checks for blank body, how would I do this?... I know how to have it check for words, sentences, but empty body... ??

hmm... THANKS :)

Wells 07-27-2007 09:55 AM

Hrm... looking at the raw source for one of these, you have two different sections:

Quote:

Content-Type: text/plain; charset=windows-1250; format=flowed
Content-Transfer-Encoding: 7bit



--------------060802040601060307000504
And...

Quote:

Content-Type: application/pdf;
After the pdf content type is defined you get your standard mime-encoded PDF file. Now, it seems to me that you can scan for a message that has both a PDF and a text section, and if the text section happens to hold nothing but carriage returns, you can flag that one as spam.


All times are GMT -5. The time now is 12:14 PM.