WHM option to filter mails by body count for Spam Assassin

[Kent Brockman]

Hi there people. I'm facing a big flow of spam coming to our server. The problem is that the spammers are using From addresses which domains are senderscore certified, thus not being blocked by the filters.
Sender verification is ON. Sender verification callout is OFF because it has blocked newsletters and registration mails from different services.

The problem is that spammers are sending mails thru certified servers and using actually existing accounts in the "From" field, and their spam is arriving to several different domains with a Spam score of -1.0 or lower!

The only way to block this I can figure out would be an option to add keywords to SpamAssassin or Exim that will work as Stop Words that trigger a filter. I obviously am able to setup mail filters in a per domain basis from each cPanel, but I need to setup this filter in about 78 domains. That's why I need a global filter of keywords.

My stop words by now are:

• "v a c a n c y - w u g . c o m"
• vacancia
• citizencompact.com
• horst-finanzen.com
• "ganar dinero de una manera simple"

and must be computed in a OR basis, looking at the body content.
Does anybody know if this kind of filtering is possible and how to do it?

[Kent Brockman]

Nobody knows?

[isdoo]

Did you ever find a way to do this?

[Kent Brockman]

Nope, by now I'm setting account filters one cpanel at a time. There are 60 domains affected, so I have to configure the filter in their 60 cPanels. This is why a global filter set from the WHM would be a time saver and could help to provide a better spam protection to all the accounts. This should be located in the Exim Configuration page, in the Access List section.

Hey staff guys! should this post be moved to Feature Requests?

[cPanelTristan]

As requested, I've moved the thread to the Feature Request forum. Thanks

[Kent Brockman]

ok thanks tristan. I hope to grab some attention on this because the facilities to ease spam blocking is also a nice feature to add. Take my post #4 as the final request.

[yosusito]

ok thanks tristan. I hope to grab some attention on this because the facilities to ease spam blocking is also a nice feature to add. Take my post #4 as the final request.

I have a solution:

Enable /etc/cpanel_exim_system_filter in WHM->Exim Configurations.

Add this lines to /etc/cpanel_exim_system_filter :

if $message_body: contains "TEXT" and not error_message
then
  seen finish
endif

Replace TEXT. For example: Viagra
Its done. You will not receive and send emails with TEXT in email body.

Josu

[Kent Brockman]

I have a solution:

Enable /etc/cpanel_exim_system_filter in WHM->Exim Configurations.

Add this lines to /etc/cpanel_exim_system_filter :

if $message_body: contains "TEXT" and not error_message
then
  seen finish
endif

Replace TEXT. For example: Viagra
Its done. You will not receive and send emails with TEXT in email body.

Josu

Nice. "TEXT" is the only part to replace and will it filter ALL the incoming and outcoming mails?

[rlesterphx]

Bump.

Server-level mail filtering is sorely missing from WHM.

[cpanelnick]

11.32 will allow you to drop custom filter snippets in /usr/local/cpanel/etc/exim/sysfilter/options and have them appear in the UI. There currently is no UI planned to add/remove them from this directory, however one could be added in the future if there was significant enough demand.

[cPanelDavidG]

11.32 will allow you to drop custom filter snippets in /usr/local/cpanel/etc/exim/sysfilter/options and have them appear in the UI. There currently is no UI planned to add/remove them from this directory, however one could be added in the future if there was significant enough demand.

This is now propagating with version 11.31.1.2. To see if this version has propagated to your update tier, visit Downloads - cPanel Inc.

If you would like an easier to use interface that just asks for stop words, please let us know.

[cPanelDavidG]

This functionality has propagated to all update tiers so I am now closing and archiving this thread.