[Mimedefang] Help With Filter (Mark Penkower)

[Cormack, Ken]

> One more question.  I want to reject emails (with a Fully RFC Compliant 
> Error Code) that have certain keywords in the subject line.  I don't want 
> to have to have an exact match - I want the emails rejected any keyword in

> the banned list is in the subject body.  Please help with this filter.

I do this directly with sendmail, rather than in MIMEDefang.

Just add the following to the LOCAL_RULESETS section of your sendmail.mc,
substituting a tab in the lines that have "[TAB]" in them.

######################################################################
###
###  Email Virus and Anti-SPAM stuff...
###
###  Add exact-match subject lines to /etc/mail/subjects_full
###  Add substrings to match in subject lines to /etc/mail/subjects_part
###  In both files, all spaces MUST be replaced with periods (.)
###
###  Create two files called /etc/mail/subjects_full and
###  /etc/mail/subjects_part.  The former has complete
###  unwanted 'subject' lines, while the latter has only
###  substrings within 'subject' lines.
###
###  As an example, suppose you want to filter out 'viagra'
###  spam.  The following entry in your subjects_part
###  file would do it:
###    viagra
###
###  In the case of multi-word entries, all spaces MUST be
###  replaced with periods.  For example:
###    herbal.viagra
###
###  These filters are not case-sensitive.
###
###  - Ken Cormack - 11 MARCH 2003
###
######################################################################
F{FullSubjects} -o /etc/mail/subjects_full
F{PartSubjects} -o /etc/mail/subjects_part
HSubject:[TAB]$>CheckSubject

SCheckSubject
R$={FullSubjects}$*[TAB]$: REJECTSUBJECT
R$* $={PartSubjects} $*[TAB]$: REJECTSUBJECT
R$* REJECTSUBJECT $*[TAB]$#error $: "553 Access Denied - MSG may contain
SPAM/WORM/VIRUS/HOAX."



KEN CORMACK, RHCE
Sr. UNIX Systems Analyst,
    Open Systems Group
Sr. Software Analyst,
    TSG Midrange Systems Group
AFFILIATED COMPUTER SERVICES, INC.
    557 E. Tallmadge Ave., Akron, OH  44310
    mailto:kcormack at acs.roadway.com
    mailto:ken.cormack at acs-inc.com
    Phone: (330) 643-6372
    Fax: (330) 643-6367
    Pager: (800) 946-4646 Pin 1412819

"If that that is 'is' is that that is not 'not is', is that that is 'not is'
that that is not 'is'?  It is!" - Ken Cormack

"Sendmail administration is not black magic.  There are legitimate technical
reasons why it requires the sacrificing of a live chicken." - Unknown