Ruleset query

[Michele Neylon :: Blacknight Solutions]

Excellent! Thanks :)

Mr Michele Neylon
Blacknight Internet Solutions Ltd
http://www.blacknight.ie/
Tel. +353 59 9137101

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Peter Bonivart
Sent: 27 April 2004 19:31
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Ruleset query

Michele Neylon :: Blacknight Solutions wrote:
> Basically mail from user1 to user2 with a very specific subject. Is there
> anyway to do this via rulesets?
>
> (Basically we want to block mail from user1 to user2 ONLY IF the subject
is
> "somestring" - as an MTA or MUA is being really dumb and sending the same
> email every 60 seconds....)

Rulesets can't do it but a custom SA rule can and it sounds like you
think of it as spam anyway. ;-)

This might work (totally untested though, lint first and keep the low
score!!!). If it does work, bump the score so it becomes high scoring spam.

describe  LOCAL_1     Description goes here
header    __LOCAL_1A  From ~= /fromuser at domain\.com/i
header    __LOCAL_1B  To ~= /touser at domain\.com/i
header    __LOCAL_1C  Subject ~= /your subject goes here/i
meta      LOCAL_1     (__LOCAL_1A && __LOCAL_1B && __LOCAL_1C)
score     LOCAL_1     0.1

--
/Peter Bonivart

--Unix lovers do it in the Sun

Sun Fire V210, Solaris 9, Sendmail 8.12.10, MailScanner 4.29.7,
SpamAssassin 2.63 + DCC 1.2.39, ClamAV 0.70 + GMP 4.1.2, Vispan 1.3

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html