You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by jikke <ji...@gmail.com> on 2007/12/20 22:44:24 UTC
spam rules
Hi,
I'm new to SpamAssassin and have checked the web on spam rules. I just can't
seem to find the info I'm looking for. I want to create a rule where all
mail to help@helpdesk.nl with a certain text like 'new message' is passed
through and all other mail is considered spam. This quite a different rule
from what I've found so far. All rules I have found just block email and I
need a rule that actually let's just that mail through.
Any ideas?
Thanks!
Jikke
--
View this message in context: http://www.nabble.com/spam-rules-tp14445787p14445787.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: spam rules
Posted by "John D. Hardin" <jh...@impsec.org>.
On Mon, 24 Dec 2007, jikke wrote:
> I will also look into procmail, it's installed, but again that's
> completely new to me.
I'll be happy to help with procmail if you contact me directly
off-list.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
"Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
does quite what I want. I wish Christopher Robin was here."
-- Peter da Silva in a.s.r
-----------------------------------------------------------------------
Tomorrow: Christmas
Re: spam rules
Posted by jikke <ji...@gmail.com>.
Hee, thanks for your replies. I'm starting to understand the concept. I'm a
she by the way :-D
If I penalize using this rule
header NOT_TO_HELPDESK To !~ /help\@helpdesk\.nl/
score NOT_TO_HELPDESK 100
I will have a problem, because we do use multiple email adresses and if I
make a separate rule for each mail address, then a legitimate mail may not
get thru. What's the syntax to specify multiple mail adresses in one rule?
Or what's the syntax for an 'or' statement?
I will also look into procmail, it's installed, but again that's completely
new to me.
Thanks so far!
Matt Kettler-3 wrote:
>
> Yet Another Ninja wrote:
>> On 12/20/2007 10:44 PM, jikke wrote:
>>> Hi,
>>>
>>> I'm new to SpamAssassin and have checked the web on spam rules. I
>>> just can't
>>> seem to find the info I'm looking for. I want to create a rule where all
>>> mail to help@helpdesk.nl with a certain text like 'new message' is
>>> passed
>>> through and all other mail is considered spam. This quite a different
>>> rule
>>> from what I've found so far. All rules I have found just block email
>>> and I
>>> need a rule that actually let's just that mail through.
>>>
>>> Any ideas?
>>
>> lots.. but for starters:
>>
>> header __TOHELPDESK To =~ /help\@helpdesk\.nl/
>> body __NEWMSG /new message/i
>> meta PASS_HELPDESK (__TOHELPDESK && __NEWMSG)
>> score PASS_HELPDESK -50.0
> Well, that would work, but to get the affect he wants you'd also have to
> heavily drop the required_score. He's not looking for a whitelist rule,
> but a blacklist..
>
> An even simpler approach would be to treat each problem separately, and
> penalize anything not matching. i.e.: heavily penalize all mail that's
> not to the help desk, and speparately, penalize all mail that doesn't
> have "new message" in it.
>
> header NOT_TO_HELPDESK To !~ /help\@helpdesk\.nl/
> score NOT_TO_HELPDESK 100
>
> body __NEWMSG /new message/i
> meta NOT_NEWSMG (!_NEWMSG)
> score NOT_NEWMSG 100
>
>
>
> But as others have said, procmail would do this much faster and lighter.
> Heck, the To part can probably be dealt with at the MTA layer and save a
> lot of trouble..
>
>
>
--
View this message in context: http://www.nabble.com/spam-rules-tp14445787p14491614.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: spam rules
Posted by Matt Kettler <mk...@verizon.net>.
Yet Another Ninja wrote:
> On 12/20/2007 10:44 PM, jikke wrote:
>> Hi,
>>
>> I'm new to SpamAssassin and have checked the web on spam rules. I
>> just can't
>> seem to find the info I'm looking for. I want to create a rule where all
>> mail to help@helpdesk.nl with a certain text like 'new message' is
>> passed
>> through and all other mail is considered spam. This quite a different
>> rule
>> from what I've found so far. All rules I have found just block email
>> and I
>> need a rule that actually let's just that mail through.
>>
>> Any ideas?
>
> lots.. but for starters:
>
> header __TOHELPDESK To =~ /help\@helpdesk\.nl/
> body __NEWMSG /new message/i
> meta PASS_HELPDESK (__TOHELPDESK && __NEWMSG)
> score PASS_HELPDESK -50.0
Well, that would work, but to get the affect he wants you'd also have to
heavily drop the required_score. He's not looking for a whitelist rule,
but a blacklist..
An even simpler approach would be to treat each problem separately, and
penalize anything not matching. i.e.: heavily penalize all mail that's
not to the help desk, and speparately, penalize all mail that doesn't
have "new message" in it.
header NOT_TO_HELPDESK To !~ /help\@helpdesk\.nl/
score NOT_TO_HELPDESK 100
body __NEWMSG /new message/i
meta NOT_NEWSMG (!_NEWMSG)
score NOT_NEWMSG 100
But as others have said, procmail would do this much faster and lighter.
Heck, the To part can probably be dealt with at the MTA layer and save a
lot of trouble..
Re: spam rules
Posted by Yet Another Ninja <sa...@alexb.ch>.
On 12/20/2007 10:44 PM, jikke wrote:
> Hi,
>
> I'm new to SpamAssassin and have checked the web on spam rules. I just can't
> seem to find the info I'm looking for. I want to create a rule where all
> mail to help@helpdesk.nl with a certain text like 'new message' is passed
> through and all other mail is considered spam. This quite a different rule
> from what I've found so far. All rules I have found just block email and I
> need a rule that actually let's just that mail through.
>
> Any ideas?
lots.. but for starters:
header __TOHELPDESK To =~ /help\@helpdesk\.nl/
body __NEWMSG /new message/i
meta PASS_HELPDESK (__TOHELPDESK && __NEWMSG)
score PASS_HELPDESK -50.0
h2h
AXB
Re: spam rules
Posted by Evan Platt <ev...@espphotography.com>.
At 01:44 PM 12/20/2007, jikke wrote:
>Hi,
>
>I'm new to SpamAssassin and have checked the web on spam rules. I just can't
>seem to find the info I'm looking for. I want to create a rule where all
>mail to help@helpdesk.nl with a certain text like 'new message' is passed
>through and all other mail is considered spam. This quite a different rule
>from what I've found so far. All rules I have found just block email and I
>need a rule that actually let's just that mail through.
What do you intend to do with all that mail that's considered SPAM?
This sounds like something that would be better suited to be handled
by your MTA or procmail than by SpamAssassin.
Re: spam rules
Posted by "John D. Hardin" <jh...@impsec.org>.
On Thu, 20 Dec 2007, jikke wrote:
> I'm new to SpamAssassin and have checked the web on spam rules. I
> just can't seem to find the info I'm looking for. I want to create
> a rule where all mail to help@helpdesk.nl with a certain text like
> 'new message' is passed through and all other mail is considered
> spam. This quite a different rule from what I've found so far. All
> rules I have found just block email and I need a rule that
> actually let's just that mail through.
Do you happen to already be using procmail? That would be a simpler
solution for this problem.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
"Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
does quite what I want. I wish Christopher Robin was here."
-- Peter da Silva in a.s.r
-----------------------------------------------------------------------
5 days until Christmas