MailScanner Rules question

[Rose, Bobby]

Ok that seems workable.

Added to blacklist ruleset where x.x.x.x is our netblock
From:	webmaster at med.wayne.edu and From: x.x.x.x        no
From: webmaster at med.wayne.edu         yes

Added to spam actions ruleset
From:   webmaster at med.wayne.edu and From: x.x.x.x     deliver

From:   webmaster at med.wayne.edu         delete

I noticed that whitelist ruleset does trump because I had set x.x.x.x to
specific IP but because I also had a netblock rule in the whitelist
ruleset the messages were still being whitelisted regardless of what IP
address (in our netblock) the webmaster message came from.  Since most
of this junk is coming from outside our network, then setting it so only
webmaster mails can come from machines in our netblock should be ok. 

-=Bobby

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Martin Hepworth
Sent: Monday, December 05, 2005 8:28 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: MailScanner Rules question

Bobby

Given the way MS 'fires' the rules in order you should be able to use...



From: webmaster at med.wayne.edu AND From: 127.0.0.1 no
From: webmaster at med.wayne.edu yes
FromOrTo:	default  no

In your case if emails from webmail@ and localhost will hit the rule
first and NOT be blacklisted. Any other from webmaster@ will hit line 2
and be classed as spam, and lastly the default action with fire it the
email doesn't match the first two lines.

Actually this is pretty cool. I'm off to try this myself.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On 
> Behalf Of Rose, Bobby
> Sent: 05 December 2005 13:14
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: [MAILSCANNER] MailScanner Rules question
> 
> Is there a Not ability?  For example, this whitelist sample rule would

> read that anymessage that is from example.com "and" from 127.0.0.1 
> would be whitelisted
> From:   /[\@\.]examlpe\.com$/ and From: 127.0.0.1    yes
> 
> Could an opposite be written for the blacklist that says anything from

> example.com and Not From 127.0.0.1 should be blacklisted?  I'm tired 
> of hearing from people about stupid virus generated messages from 
> webmaster at med.wayne.edu that don't have a payload and would like to 
> see if I can drop such messages as high scoring spam since I can't 
> reject webmaster mail.
> 
> Thanks
> -=Bobby
> 
> ------------------------ MailScanner list ------------------------ To 
> unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and the 
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!



**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!