help with mcp setup

[Quentin Campbell]

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Jeff Mills
>Sent: 21 August 2005 08:05
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: help with mcp setup
>
>Hi all,
>I've got MCP setup and working for single profain words in the 
>body of emails, but I'm trying to set up some testing on 
>subjects and cant seem to work it out.
>I had a read of the man page and looked at the *.cf files in 
>/usr/share/spamassassin.
>In the example below:
>
>header   SUBJECT_LOAN2    Subject =~ /Pre-approved\s+Application/i
>describe SUBJECT_LOAN2    Banned Subject Pre-approved Application
>score    SUBJECT_LOAN2    30
>
>I tried sending myself an email with the subject "Pre-approved 
>Application" and this was allowed through.
>Should the above config have stopped it?

You need to tell MailScanner what action to take if one or more MCP
rules are triggred. What have you set in MailScanner.conf for:

MCP Checks =
MCP Required SpamAssassin Score = 
MCP High SpamAssassin Score = 
Non MCP Actions = 
MCP Actions = 
High Scoring MCP Actions = 

Look in the messages' headers for the "SUBJECT_LOAN2" string. I always
prefix my MCP rule names with "MCP_" so that they are separate from
rules triggered by the other SpamAssassin invocation used to check for
spam. 

>
>I just did a test by using the body check rather than header 
>check, and it was picked up, even though the words were in the 
>subject, not the body.
>Is this normal?

Yes. A "body check" also implies checking the Subject: line text as
well. 

>
>Does anyone know of a resource to learn more about these 
>expressions that spamassassin uses?

There is the Mail::SpamAssassin::Conf POD documentation. See
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Con
f.html for example.

>
>
>Cheers,
>Jeff
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!