mailscanner with spamassassin : error on subject with [SPAM]

[Denis Beauchemin]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Benoit Guguin wrote:

> Hello,
>
> I have a little probleme. I m using postfix with mailscanner, 
> spamassassin and clamav.
>
> Some mails are receive with a subject  [SPAM] other_thing.   And 
> effectively it's some spam.
> But the users of the server receive them in their mailboxes ...
>
> So to workaround this probleme I have add in spam.assassin.prefs.conf 
> (like the mailscanner wiki says) these lines :
>
>    describe UDES_HEADER Check_header_content_SPA
>    header UDES_HEADER Subject =~ /SPAM/i
>    score UDES_HEADER 100.0
>
> After restarting MailScanner,  Mails with the string SPAM in their 
> subject are correctly detected.
>
> But (something made me crazy) Mails with in their subject [SPAM] are 
> send in the user's mailboxes *without* the string [SPAM] in their 
> subject ....
>
> I have also test, for same effect, with this :
>    describe UDES_HEADER Check_header_content_SPA
>    header UDES_HEADER Subject =~ /\[SPAM\]/i
>    score UDES_HEADER 100.0
>
>    describe UDES_HEADER Check_header_content_SPA
>    header UDES_HEADER Subject =~ /.*SPAM.*/i
>    score UDES_HEADER 100.0
>
> Any idea please ?
> thank you in advance
>
> Regards,
>
Benoit,

Make sure you don't have many SA rules with the same name.  I use 
UDES_RULE1, UDES_RULE2, and so on to make sure they are all different 
from one another.  BTW, UDES is the name of our University (Université 
de Sherbrooke) so you may use something more local to you.

Now for your rules: the first one will match every time the others do.  
So no need to use any other rule than the first.

If those mails are being delivered to your users it must be because:
High Scoring Spam Actions = deliver

Set it to delete and it should do so.  You can also use «store delete» 
to quarantine them or «delete forward me at some.address».

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045



------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, "S/MIME Cryptographic Signature"  ]
    [ Application/X-PKCS7-SIGNATURE  4.4KB. ]
    [ Unable to print this part. ]