The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Cpanel email filters - possible to have one THEN another?

Discussion in 'E-mail Discussions' started by electric, Apr 29, 2005.

  1. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
    I am trying to figure out how to have two cpanel email filters that run consecutively.

    ie:

    First filter: discard anything with number of spam assassin "stars" higher then 10.

    $spam_header contains "**********" = /dev/null

    Second filter: move anything with spam assassin header set to YES to "spam@domain.com" mailbox.

    $spam_header equals "YES" = move to spam@domain.com



    The idea here is that anything with a spam score of 10 or higher (10 stars) will disappear. This leaves only spam with a score of 6 to 9 left over... and I want that to go to a spam@domain.com inbox.

    The problem is that I can't get cpanel to run one filter first and THEN the other. I can only get BOTH of them to run seperately on ALL incoming email.

    Is this possible?
     
  2. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
    Anyone have any thoughts on this?

    :)
     
  3. luminate

    luminate Registered

    Joined:
    Feb 1, 2005
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    I'm not sure if this will work (untested), but I think it's roughly what you're after.

    Edit the filter file for your domain in /etc/vfilters.

    Code:
    if
      $h_X-Spam-Level: contains "**********"
     then
      save "/dev/null" 660
     elif
      $h_X-Spam-Flag: is "YES"
     then
      deliver "spam@domain.com"
    endif
    Actually, scratch that. You should be able to accomplish the same thing with basic cPanel rules.

    Give these two a try:

    1. Filter Any Header that contains ********** Destination Discard.

    2. Filter SpamAssassin Spam Header that contains Yes Destination spam@domain.com.
     
    #3 luminate, May 6, 2005
    Last edited: May 6, 2005
  4. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
    This is almost identical to what I specified in my starting post above. :) The problem is that both filters are activated by cpanel. So a copy of the email is discarded, and a copy is sent to spam@domain.com

    Which is pointless.... since I only want the second filter to run against anything that is "left over" after the first filter runs.

    The else / if example you gave also did not work. :( I wish there was a way to do this...
     
  5. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
    I just submitted this as a feature request to cpanel bugzilla. :cool:

    If anyone else wants the ability to have "sequential" filtering ability, just post your "yea" here in this thread.
     
  6. Devil Inside

    Devil Inside Well-Known Member

    Joined:
    Apr 4, 2003
    Messages:
    277
    Likes Received:
    0
    Trophy Points:
    16
    yeah - oh hell yeah :)

    a big concern with clients is that they don't trust spam filters and fear losing legit email.

    This would be great to remove absolute spam - while letting some in for them to sift through...

    But then again...isn't that what the spam score setting is for anyhow?...
     
  7. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
    Not really. The spam score is useful, but it's really the number of "stars" that is most useful. With this, you can create mail rules that depend on the number of stars. So if there are 10 stars, then delete it. If there are 8 stars, then move to "spam_probable@domain.com" mailbox. If there are 5 stars, then move to "maybe_spam@domain.com" mailbox. etc....

    With the ability to set filter sequence (one AFTER the other), this is easily possible. However, without this ability.. we are limited to EITHER OR scenario. (if spam assassin is "yes" then delete, otherwise move to "spam@domain.com" mailbox.) So we wind up with tons of highly probable spam mixed in with the "need to check before deleting" spam...

    :(

    Besides the spam issue, I can also think of several handy reasons why sequential filtering ability would be very useful.
     
  8. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
  9. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
  10. wookiee

    wookiee Well-Known Member

    Joined:
    Feb 28, 2005
    Messages:
    48
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Las Vegas

    yea!


    I would use it quite often
     
  11. fochi

    fochi Registered

    Joined:
    Sep 28, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Real filtering MUST be implemented

    Of course it is increadble that it is not that way yet.

    The CPanel for resellers does not allows you to edit filters, just a ".forward" file that in fact it names .filter. (In exim documentation you will see it as .forward).
    As in Exim documentation: the forwards are executed after exim finishes its job and so, it delivers to ALL matches in the ".forward" file.
    Inshort: in fact it is just a forward file and NOT a filter.

    Possible solutions:

    1) A REAL filter file (that is the reason the else if did not work as ). Remember; resellers do not have access to /etc/vfilters.

    2) A filter in spamassassin

    I think we must "make pressure" to this feature added by the cpanel guys, I just do not know how to do it.

    Thanks,

    Fochi
     
  12. electric

    electric Well-Known Member

    Joined:
    Nov 5, 2001
    Messages:
    697
    Likes Received:
    1
    Trophy Points:
    18
    Yes, good idea. If you figure out how to make pressure on the cpanel people... be sure to let everyone else who has ever made a good suggestion know.

    :eek:
     
  13. godyn

    godyn Member

    Joined:
    Apr 25, 2005
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Wel it seems I have a similar problem.
    The discard function does not work at all.
    I've made some filters with it. (with header and yes, and with header [SPAM] etc;
    But everytime I get them in my spamfolder.
    Disabling the Spambox gives result that I get it in my inbox...

    Also I can't just switch of my catch-all, because I loose some aliased emails.
    (f.e. contact@ goes to my info@ but is not an account.)
    Any idea's on that?
     
  14. fochi

    fochi Registered

    Joined:
    Sep 28, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Workaround on this problem

    I have sucessfully made an workaround on this problem.

    As I said, it is a work around, and not an official solution. It really works fine for me, but not everyone will be able to do the same. See why bellow:

    I am a cpanel reseller, and so I do NOT have root acess. So my only solution was to make a workaround.

    I have a few websites registered. Three of them did not have any email account. I created the following accounts:
    spam5@sparedomain1.com
    spam15@sparedomain2.com
    spam20@sparedomain3.com

    In the official domain I configured spamassassin and edited by hand the blacklist as well the whitelist and INCREASED the score for obvious items like Drugs etc.etc.

    I also made 1 (YES, JUST ONE) filter :
    $h_X-Spam-Status: begins "Yes"+++++++spam5@sparedomain1.com

    In the sparedomain1.com I made 1 filter:$message_headers contains "***************"++++++++spam15@sparedomain2.com

    In the sparedomain2.com I made 1 filter:$message_headers contains "********************"++++++++spam20@sparedomain3.com

    What it does: First it sends all spam to sparedomain1, then it send all above 15stars to sparedomain2 and them, from there it sends all above 20stars to sparedomain3

    As soon as I conclude that there are absolutely no false positives above 20stars, I will blackhole the emails in sparedomain3.

    High now I have most false positives in sparedomain1, and I had one false positive so far in the sparedomain2. No falsepositives yet in sparedomain3.

    The sum of emails in sparedomain1 and 2 are less than 10% of those in sparedomain3. so, now I have to check for false positives in less than 10% of all spam sent to my company.

    Hope this helps

    And still wait for the official solution by cpanel.
    Please someone file the bug (bugzilla?) for me as I do not speak English and this takes too much effort from me.
     
  15. godyn

    godyn Member

    Joined:
    Apr 25, 2005
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Hi Fochi,

    I must say this is a brilliant but for most users not realistic workaround. :cool:
    I can only get the discard filter work on normal adresses, not related to spamassassin.
     
  16. rossh_cp

    rossh_cp Member

    Joined:
    May 31, 2005
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    1
    I found you can do some tricks on the .filter file. As an end user we cannot get to the /etc/vfilters so the .filter is all we have.

    The cpanel will auto create and load that .filter file, but the choices of paramaters and tests and limited. You can use ALL the string tests, expanded strings listed in help as follows.

    Enter you unique tests into the .filter by hand, using the same format as the original. Copy your modified back to server and overwrite the original .filter with your own, and in the cpanel control, press Activate. This will load that file into the /etc/vfilters, and your all set. I have not found a way to do conditionals yet.

    RossH
     
  17. fochi

    fochi Registered

    Joined:
    Sep 28, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Godyn,
    I knew it was going to be very difficult for most people, but it was all I could do at that time.

    NOW THE GOOD NEWS: :)

    I am already able to make selective filters in just one site in a much more elegant and professional way. I am using the new email filtering system for more than a week and it is working very well, and ANYONE can just copy and paste my filters and it will work.

    Please just wait till I have time to produce the "generic" filter without my private data so anyone can use it.

    I promiss I will do it soon

    All the Best and a happy new year

    Fochi
     
  18. fochi

    fochi Registered

    Joined:
    Sep 28, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Rossh

    I have good news to you:
    I have alread figured out how to do conditional. As "if..then" just do not work in the .filter file, I am using "and"," or" instead.

    I am also able to compare two integer numbers and check if one is equal, greater or lower than the other. (I can not do it with number with decimal places yet)

    Fochi
     
  19. icoso

    icoso Member

    Joined:
    Jul 23, 2004
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Indy
    RossH,

    1. Where do I fnd the .filter file if I don't have access to my reseller account via SSH? Is this .filter in each account on the reseller account?

    2. Where is the "Activate" button in the CPanel? I can't find it.
     
  20. wzd

    wzd Well-Known Member

    Joined:
    Dec 16, 2005
    Messages:
    118
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    South Africa
    cPanel Access Level:
    Root Administrator
    The following procmail script will delete mail with a score of 15 or higher. By moving the # (comment) mark up one line, it will save all mail with a score of 15 or higher in a separate folder rather than deleting. The general implementation then, is that mail with a score of less than 5 goes into the inbox, a client side rule triggering on "X-Spam-Status: YES" will cause mail scoring between 5 and 15 to go into a Junk Mail folder where it can regularly be checked, and mail of 15 or higher will be stored on the server or dropped on the floor.

    Code:

    Code:
    
    #Uncomment the following lines and use tail -f procmail.log to debug
    #LOGFILE=$HOME/procmail.log
    #VERBOSE=yes
    #LOGABSTRACT=all
    
    # Feed redirected spam to sa-learn, and also store a copy in a folder called spam.
    # This folder of false negatives could be useful if we needed to rebuild our Bayes
    # database in the future.
    
    :0
    * ^To:.*spam@example.com
    
       {
       * < 256000
       :0c: spamassassin.spamlock
       | sa-learn --spam
    
       :0: spamassassin.filelock
       spam
       }
    
    # Send all other mail through SpamAssassin
    
    :0fw: spamassassin.lock
    * < 256000
    | spamassassin
    
    
    # Mail that is very likely spam (>15) can be saved on the server
    # (not forwarded), or by moving the # down one line, even dropped
    # on the floor.  Note that dropping mail on the floor is a *bad*
    # idea unless you really, really believe no false positives will
    # have a score greater than 15.  If you want all mail forwarded,
    # just add #'s in front of each of these lines:
    
    :0: spamassassin.filelock2
    * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
    #/dev/null
    almost-certainly-spam
    
    
    # Forward all mail with a score less than 15 to my non-publicized address
    :0
    ! privateaddress@example.net
    By adding lines such as:

    blacklist_from sde@spledee.com
    blacklist_from *@bonanzaoffers.com
    blacklist_from *@deal-seeker.com
    blacklist_from *@hispeedmediaoffers.com
    blacklist_from *@jumpjive.com
    blacklist_from *@*.ew01.com

    to /etc/mail/spamassassin/local.cf or ~/.spamassassin/user_prefs , you tell spamassassin that mail from any of these domains gets a +100 spam score, effectively blocking them.

    Then try whitelisting a specific domain?

    Otherwise if you are concerned about spam why not check out this black list:

    http://www.sa-blacklist.stearns.org/sa-blacklist/

    http://wiki.apache.org/spamassassin...ilToForwardMail

    Read that for more information :)

    Let me know how it goes,
     
Loading...

Share This Page