I have recently taken over a spam elimination project at my work. We're
doing well, and so far has been very successful, but we are expecting a
lot of growth in the amount of mail hitting the filters, so I thought it
may be a good idea to pre-process a the mail and drop some of the more
common crap before letting spamassassin handle the rest.

Milter-regex seemed like a good solution, and I have mocked up the
following config file as a trial:

reject "Spam not welcome"
header /Subject:/ /\b(PHA)+([a-zA-Z]+(RMA))\b/

reject "Spam not welcome"
header /Subject:/ /\b(PHA)+([a-zA-Z]+(RMACY))\b/

discard
header /Subject:/ /TESTSTRING45819203/

# reject "Spam not welcom"
# body ^\S(ubject\:|UBJECT\ \b(PHA)+([a-zA-Z]+(RMACY))\b

# reject "Spam not welcom"
# body ^\S(ubject\:|UBJECT\ \b(PHA)+([a-zA-Z]+(RMA))\b

I have tried sending mails with the test string (TESTSTRING45819203) but
they get through. Are my rules wrong? I am very much a regex newbie, so
I suspect my rules are wrong, but I need someone's !

Thanks,

Chris

Chris Martin wrote:
> I have recently taken over a spam elimination project at my work. We're
> doing well, and so far has been very successful, but we are expecting a
> lot of growth in the amount of mail hitting the filters, so I thought it
> may be a good idea to pre-process a the mail and drop some of the more
> common crap before letting spamassassin handle the rest.
>
> Milter-regex seemed like a good solution, and I have mocked up the
> following config file as a trial:
>
> reject "Spam not welcome"
> header /Subject:/ /\b(PHA)+([a-zA-Z]+(RMA))\b/
>
> reject "Spam not welcome"
> header /Subject:/ /\b(PHA)+([a-zA-Z]+(RMACY))\b/
>
> discard
> header /Subject:/ /TESTSTRING45819203/
>
> # reject "Spam not welcom"
> # body ^\S(ubject\:|UBJECT\ \b(PHA)+([a-zA-Z]+(RMACY))\b
>
> # reject "Spam not welcom"
> # body ^\S(ubject\:|UBJECT\ \b(PHA)+([a-zA-Z]+(RMA))\b
>
> I have tried sending mails with the test string (TESTSTRING45819203) but
> they get through. Are my rules wrong? I am very much a regex newbie, so
> I suspect my rules are wrong, but I need someone's !
>
> Thanks,
>
> Chris

I ran the milter with the "-d" option, and it started passing mails
through the milter, but none got picked up. I then trimmed the colon
from the Subject entries, and all was well!

Here is my basic ruleset:

reject "Spam not welcome"
header /Subject/ /\b(PHA)+([a-zA-Z]+(RMA))\b/

reject "Spam not welcome"
header /Subject/ /\b(PHA)+([a-zA-Z]+(RMACY))\b/

reject "Testing: it works!"
header /Subject/ /TESTSTRING45819203/

Debug option saves the day!