[Rspamd-Users] Control rspamd depending on subject content

[Andreas]

Am Samstag, 20. Januar 2024, 13:56:33 CET schrieb Gerald Galster:
> See https://rspamd.com/doc/modules/multimap.html
> 
> Example:
> 
> /etc/rspamd/local.d/multimap.conf
> 
> BLOCK_SUBJECT {
>         type = "header";
>         header = "Subject";
>         map = "https://or file:// [1]";
>         multi = true;
>         regexp = true;
>         prefilter = true;
>         action = "reject";
>         # message = "Spammy subject blocked";
>         # score = 1.0;
> }
> 
> --> action = "reject" will reject immediately, otherwise score will be added
> 
> 
> [1] Content of map file:
> # /regex/ SYMBOL:SCORE
> /Bitcoin-Effekt/ BLOCK_SUBJECT:4.5
> 
> 
> /etc/rspamd/local.d/metrics.conf
> 
> symbol "BLOCK_SUBJECT" {
>         weight = 1.0;
> }

I've now tried to implement it like this:
In /etc/rspamd/local.d/multimap.conf I have

BLOCK_SUBJECT {
         type = "header";
         header = "Subject";
         map = "file:///etc/rspamd/local.d/maps.d/banned_subjects.map";
         multi = true;
         regexp = true;
         prefilter = true;
         action = "reject";
}

inserted and created /etc/rspamd/local.d/maps.d/banned_subjects.map:

/*recipe-for-egg*/ BLOCK_SUBJECT:4.5

with the rights
-rw-r--r-- 1 _rspamd _rspamd 57 Feb 29 12:16 banned_subjects.map

additionally I have /etc/rspamd/local.d/metrics.conf

symbol "BLOCK_SUBJECT" {
         weight = 1.0;
}
created and then restarted the service rspamd.service.

However, emails with “info prescription-free pharmacy” are still allowed 
through.

I would also be interested in the syntax
“map = “file:///etc/rspamd/local.d/maps.d/banned_subjects.map”;”
must be or whether
“map = “/etc/rspamd/local.d/maps.d/banned_subjects.map”;”
correct is?

Best regards

Andreas