MCP not working

Daniel Eiland daniel at bokko.nl
Thu Aug 9 13:22:42 IST 2007 

Thanx!

This looks far more intelligent than the rules i came up with.
I tested it, but still the MCP score is 0.

I is just like mailscanner or spamassassin does not find the cf i created.


On Thu, 9 Aug 2007 12:58:22 +0100 (BST), UxBoD <uxbod at splatnix.net> wrote:
> You are redefining your rule each time. try :-
> 
> header   __MCP_W32_ZHELATIN_GEN1    Subject =~ /received a greeting
> (card|ecard|postcard) from a/i
> header   __MCP_W32_ZHELATIN_GEN2    Subject =~ /received a postcard from
> a/i
> header   __MCP_W32_ZHELATIN_GEN3    Subject =~ /received an ecard from a/i
> meta     MCP_W32_ZHELATIN_GEN       __MCP_W32_ZHELATIN_GEN1 ||
> __MCP_W32_ZHELATIN_GEN2 || __MCP_W32_ZHELATIN_GEN3
> describe MCP_W32_ZHELATIN_GEN       Banned Subject
> score    MCP_W32_ZHELATIN_GEN       10
> 
> Regards,
> 
> --[ UxBoD ]--
> // PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
> // Fingerprint: C759 8F52 1D17 B3C5 5854  36BD 1FB1 B02F 5DB5 687B
> // Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
> // Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net
> 
> ----- Original Message -----
> From: "Daniel Eiland" <daniel at bokko.nl>
> To: mailscanner at lists.mailscanner.info
> Sent: Thursday, August 9, 2007 11:30:02 AM (GMT) Europe/London
> Subject: MCP not working
> 
> 
> Hello,
> 
> I hope someone can help me out.
> 
> I have a question regarding MCP. It works, but rules never match.
> I am running MailScanner 4.61.7 on FreeBSD. Everything works fine except
> for MCP.
> In my maillog i can see MCP is enabled and is scanning:
> 
> Aug  9 12:10:55 panther MailScanner[44602]: New Batch: Found 3 messages
> waiting
> Aug  9 12:10:55 panther MailScanner[44602]: New Batch: Scanning 1
> messages, 9602 bytes
> Aug  9 12:10:55 panther MailScanner[44602]: MCP Checks: Starting
> Aug  9 12:10:57 panther MailScanner[44602]: MCP Checks completed at 8542
> bytes per second
> Aug  9 12:10:57 panther MailScanner[44602]: Spam Checks: Starting
> Aug  9 12:10:57 panther MailScanner[44620]: Virus Scanning completed at
> 2586 bytes per second
> Aug  9 12:10:57 panther MailScanner[44620]: Requeue: F134C11713.526DA to
> D4F5A119A2
> Aug  9 12:10:57 panther MailScanner[44620]: Uninfected: Delivered 1
> messages
> Aug  9 12:10:57 panther MailScanner[44620]: Virus Processing completed at
> 319425 bytes per second
> Aug  9 12:10:57 panther MailScanner[44620]: Batch completed at 630 bytes
> per second (6453 / 10)
> Aug  9 12:10:57 panther MailScanner[44620]: Batch (1 message) processed in
> 10.24 seconds
> 
> I defined af cf file named 10_w32_zhelatin_gen.cf that is located in
> %mcp-dir% for catching email with specific subjects.
> The subjects i want to catch are in the form of: You've received a
> greeting card from a friend!
> 
> header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a greeting card from
> a/i
> describe MCP_W32_ZHELATIN_GEN    Banned Subject
> score    MCP_W32_ZHELATIN_GEN    10
> header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a greeting ecard
> from a/i
> describe MCP_W32_ZHELATIN_GEN    Banned Subject
> score    MCP_W32_ZHELATIN_GEN    10
> header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a greeting postcard
> from a/i
> describe MCP_W32_ZHELATIN_GEN    Banned Subject
> score    MCP_W32_ZHELATIN_GEN    10
> header   MCP_W32_ZHELATIN_GEN    Subject =~ /received a postcard from a/i
> describe MCP_W32_ZHELATIN_GEN    Banned Subject
> score    MCP_W32_ZHELATIN_GEN    10
> header   MCP_W32_ZHELATIN_GEN    Subject =~ /received an ecard from a/i
> describe MCP_W32_ZHELATIN_GEN    Banned Subject
> score    MCP_W32_ZHELATIN_GEN    10
> 
> 
> My MCP config in MailScanner.conf is:
> 
> 
> %mcp-dir% = /usr/local/etc/MailScanner/mcp
> 
> MCP Checks = yes
> First Check = mcp
> 
> MCP Required SpamAssassin Score = 1
> MCP High SpamAssassin Score = 10
> MCP Error Score = 1
> 
> MCP Header = X-%org-name%-MailScanner-MCPCheck:
> Non MCP Actions = deliver
> MCP Actions = %rules-dir%/spam.actions.rules
> High Scoring MCP Actions = %rules-dir%/spam.actions.rules
> Bounce MCP As Attachment = no
> 
> MCP Modify Subject = yes
> MCP Subject Text = {Evil?}
> High Scoring MCP Modify Subject = yes
> High Scoring MCP Subject Text = {Evil?}
> 
> Is Definitely MCP = %rules-dir%/spam.blacklist.rules
> Is Definitely Not MCP = %rules-dir%/spam.whitelist.rules
> Definite MCP Is High Scoring = no
> Always Include MCP Report = yes
> Detailed MCP Report = yes
> Include Scores In MCP Report = yes
> Log MCP = yes
> 
> MCP SpamAssassin Prefs File = %mcp-dir%/mcp.spam.assassin.prefs.conf
> MCP SpamAssassin User State Dir =
> MCP SpamAssassin Local Rules Dir = %mcp-dir%
> MCP SpamAssassin Default Rules Dir = %mcp-dir%
> MCP SpamAssassin Install Prefix = %mcp-dir%
> Recipient MCP Report = %report-dir%/recipient.mcp.report.txt
> Sender MCP Report = %report-dir%/sender.mcp.report.txt
> 
> 
> In my email these are the headers:
> 
> 
> Subject: You've received an ecard from a Class-mate!
> Message-Id: <20070809093143.DFAD711920 at panther>
> Date: Thu,  9 Aug 2007 11:31:39 +0200 (CEST)
> From: bla at bla.com
> To: undisclosed-recipients:;
> 
> X-Panther-MailScanner-Information: Please contact ISP for more information
> X-Panther-MailScanner: Found to be clean
> X-Panther-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (score=0,
> 	required 1)
> X-Panther-MailScanner-SpamCheck: not spam, SpamAssassin (score=0,
> 	required 5)
> X-Panther-MailScanner-From: bla at bla.com
> X-Spam-Status: No, No
> X-MailScanner: Found to be clean
> X-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
> 	score=1.618, required 5, BAYES_40 -0.18, DK_POLICY_SIGNSOME 0.00,
> 	NO_REAL_NAME 0.96, UNDISC_RECIPS 0.84)
> X-MailScanner-SpamScore: 1
> 
> 
> 
> --
> :wq!
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
> 
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
--
:wq!

More information about the MailScanner mailing list