ideas on why this rule isn't working?

["Johnson, S" <sj...@edina.k12.mn.us>]

I have to admit... Some people are actually trying to help me keep bad
material out of our school district.  They are attaching a
"sexually-explicit: text text text" in the subject line.  So I thought
that I'd write a rule to catch that and re-route the mail to the
blackhole.  Any ideas on why this isn't working?  Thanks!

 

header ZXS_SEXUALLY_EXPLICIT  Subject =~ /\bsexually-explicit/i

describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad...

score ZXS_SEXUALLY_EXPLICIT 10



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Confidentiality Notice

If the information in this electronic communication relates to an individual pupil, it is a confidential pupil record under Minnesota Law and may not be reviewed, distributed, or copied by any person other than the individual(s) to whom it is addressed. This electronic communication is intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient, any further review, dissemination, distribution, or copying of this electronic communication or any attachment thereto is strictly prohibited. If you have received an electronic communication in error, you should immediately return it to the sender and delete it from your system.

Re: ideas on why this rule isn't working?

[Kevin Peuhkurinen <ke...@meridiancu.ca>]

Johnson, S wrote:

> I have to admit… Some people are actually trying to help me keep bad 
> material out of our school district. They are attaching a 
> “sexually-explicit: text text text” in the subject line. So I thought 
> that I’d write a rule to catch that and re-route the mail to the 
> blackhole. Any ideas on why this isn’t working? Thanks!
>
> header ZXS_SEXUALLY_EXPLICIT Subject =~ /\bsexually-explicit/i
>
> describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad...
>
> score ZXS_SEXUALLY_EXPLICIT 10
>
> ------------------------------------------------------------------------

Sorry, but I have no idea why this doesn't work for you. I copied and 
pasted the rule into a test.cf file and tried it out and it worked fine. 
My only guess is that the spam may have multiple subject lines or is in 
some way encoding the subject in a way that SA cannot easily decode.

In any case, SA already has a rule that would catch this subject plus 
obfuscations of it, "SUBJECT_SEXUAL". Is this rule hitting the emails in 
question?

Re: ideas on why this rule isn't working?

[Matt Kettler <mk...@evi-inc.com>]

Johnson, S wrote:
> I have to admit… Some people are actually trying to help me keep bad
> material out of our school district.  They are attaching a
> “sexually-explicit: text text text” in the subject line.  So I thought
> that I’d write a rule to catch that and re-route the mail to the
> blackhole.  Any ideas on why this isn’t working?  Thanks!
> 
>  
> 
> header ZXS_SEXUALLY_EXPLICIT  Subject =~ /\bsexually-explicit/i
> 
> describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad...
> 
> score ZXS_SEXUALLY_EXPLICIT 10

Where did you add the rule?

Do you use spamd?

Did you restart spamd?

Have you run spamassassin --lint to check for syntax errors?

Re: ideas on why this rule isn't working?

[Loren Wilton <lw...@earthlink.net>]

> Any ideas on why this isn't working?  Thanks!

header ZXS_SEXUALLY_EXPLICIT  Subject =~ /\bsexually-explicit/i
describe ZXS_SEXUALLY_EXPLICIT bad...bad...bad...
score ZXS_SEXUALLY_EXPLICIT 10

Looks good to me.  Did you remember to restart spamd after you put this in a
rules file somewhere?

Actually you will eventually want to add a number of minor variations to
that rule.  Leave the dash out, put spaces each side of the dash, spell
explicit with et, two x's in sex, etc.  Or grab the SARE rule that has
already been reworked a half dozen times as these little clever twists have
been found.

        Loren