Page 1 of 2
Use Mailscanner to Filter Subject Text
Posted: 02 Sep 2016, 02:27
by nootkan
I've been trying to stop a bot from sending email with a subject like:
(proper_name) some random porn sentence
by creating filters in cPanel>>Global Email Filters but I am seeing this error in my logs:
[2016-09-01 11:43:45 -0700] warn [Email::has_spam_as_acl] Encountered error
in Email::has_spam_as_acl: Email::has_spam_as_acl(1) failed: This feature
requires the “spamassassin” option and is not enabled on your account.
I seem to remember that Mailscanner disables spamassassin and incorporates it in the actual script of Mailscanner so I was just wondering if there was a way for using mailscanner to create these filters as the normal mailscanner process is missing the spam. Mailscanner catches everything else that is classified as spam but not these emails with subject lines like above.
Hope this makes sense and I appreciate any help or direction to figure this out.
Re: Use Mailscanner to Filter Subject Text
Posted: 02 Sep 2016, 12:03
by Sarah
You might have better luck creating your own spamassassin rule(s), which you can add to your own .cf file in /etc/mail/spamassassin/. More info here:
http://wiki.apache.org/spamassassin/WritingRules
Re: Use Mailscanner to Filter Subject Text
Posted: 22 Sep 2016, 19:49
by Sergio
@nootkan
Go to /etc/mail/spamassassin/ and create a file called blacklist.cf
inside that file copy and paste the following rule:
Code: Select all
header SUBJ_PORN1 Subject =~ /write here what to search for/i
score SUBJ_PORN1 11
describe SUBJ_PORN1 Subject PORN
That code will check any email that enters into your server with a subject that contains the phrase that you want to block and will assign an score of 11 that is to high and that way it will be flagged as spam and your users will not receive them.
If you want to block "garbish" porn subjects, check if you have the latest KAM rules.
Sergio
Re: Use Mailscanner to Filter Subject Text
Posted: 07 Mar 2022, 14:52
by andyhans
Hi @Sergio, what about if I need to find a word inside the "body".
Thanks in advice
P.S. the file must still be created in the folder "/etc/mail/spamassassin/"
Thanks
Re: Use Mailscanner to Filter Subject Text
Posted: 07 Mar 2022, 16:20
by Sergio
Hi @andyhans,
to create a body rule you can do this:
1. Create a folder at /etc/spamassasin/blackbody.cf
2. Create your own rule following the next example:
Code: Select all
body ASECMAS_BLOCKBDY /any phrase1|another phrase|word/i
score ASECMAS_BLOCKBDY 22
describe ASECMAS_BLOCKBDY BlockBdy
On the body line you can use the "or" pipe as in my example "|" to separte words or phrases that SpamAssassin will block.
Try not to add a lot of "or's".
Re: Use Mailscanner to Filter Subject Text
Posted: 08 Mar 2022, 08:45
by andyhans
Thanks @Sergio!
Re: Use Mailscanner to Filter Subject Text
Posted: 06 Apr 2022, 06:34
by Sergio
Your welcome.
Re: Use Mailscanner to Filter Subject Text
Posted: 09 Oct 2023, 18:18
by andyhans
Hi @Sergio, if we have multiple subjects to block how do we manage that?
Thanks
Re: Use Mailscanner to Filter Subject Text
Posted: 09 Oct 2023, 22:19
by Sergio
Hi @andyhans,
in your rule you use the or command "|" (the pipe sign means "or") and add two or more subjects in the rule, per example:
Code: Select all
header SUBJ_XAMPLE Subject =~ /subject one|subject two|subject three/i
score SUBJ_XAMPLE 11
describe SUBJ_XAMPLE Subject XAMPLE
Or you can use the "or", like this:
Code: Select all
header SUBJ_XAMPLE Subject =~ /subject (one|two|three)/i
score SUBJ_XAMPLE 11
describe SUBJ_XAMPLE Subject XAMPLE
Word of caution, don't use to a lot of OR's, try to construct your rules with about 9 or's or fewer.
Sergio
Re: Use Mailscanner to Filter Subject Text
Posted: 10 Oct 2023, 15:44
by jameswang
Sergio wrote: ↑09 Oct 2023, 22:19
Hi @andyhans,
in your rule you use the or command "|" (the pipe sign means "or") and add two or more subjects in the rule, per example:
Code: Select all
header SUBJ_XAMPLE Subject =~ /subject one|subject two|subject three/i
score SUBJ_XAMPLE 11
describe SUBJ_XAMPLE Subject XAMPLE
Or you can use the "or", like this:
Code: Select all
header SUBJ_XAMPLE Subject =~ /subject (one|two|three)/i
score SUBJ_XAMPLE 11
describe SUBJ_XAMPLE Subject XAMPLE
Word of caution, don't use to a lot of OR's, try to construct your rules with about 9 or's or fewer.
Sergio
Or you can stack them:
Code: Select all
header SUBJ_XAMPLE1 Subject =~ /subject (one|two|three)/i
score SUBJ_XAMPLE1 11
describe SUBJ_XAMPLE1 Subject XAMPLE1
header SUBJ_XAMPLE2 Subject =~ /subject (four|five|six)/i
score SUBJ_XAMPLE2 10
describe SUBJ_XAMPLE2 Subject XAMPLE2
header SUBJ_XAMPLE3 Subject =~ /subject (seven)/i
score SUBJ_XAMPLE3 5
describe SUBJ_XAMPLE3 Subject XAMPLE3
...