Cpanel email filters - possible to have one THEN another?

[electric]

I am trying to figure out how to have two cpanel email filters that run consecutively.

ie:

First filter: discard anything with number of spam assassin "stars" higher then 10.

$spam_header contains "**********" = /dev/null

Second filter: move anything with spam assassin header set to YES to "[email protected]" mailbox.

$spam_header equals "YES" = move to [email protected]



The idea here is that anything with a spam score of 10 or higher (10 stars) will disappear. This leaves only spam with a score of 6 to 9 left over... and I want that to go to a [email protected] inbox.

The problem is that I can't get cpanel to run one filter first and THEN the other. I can only get BOTH of them to run seperately on ALL incoming email.

Is this possible?

 

[electric]

Anyone have any thoughts on this?

 

[luminate]

I'm not sure if this will work (untested), but I think it's roughly what you're after.

Edit the filter file for your domain in /etc/vfilters.

if
  $h_X-Spam-Level: contains "**********"
 then
  save "/dev/null" 660
 elif
  $h_X-Spam-Flag: is "YES"
 then
  deliver "[email protected]"
endif

Actually, scratch that. You should be able to accomplish the same thing with basic cPanel rules.

Give these two a try:

1. Filter Any Header that contains ********** Destination Discard.

2. Filter SpamAssassin Spam Header that contains Yes Destination [email protected].

 

[electric]

You should be able to accomplish the same thing with basic cPanel rules.

Give these two a try:

1. Filter Any Header that contains ********** Destination Discard.

2. Filter SpamAssassin Spam Header that contains Yes Destination [email protected].

This is almost identical to what I specified in my starting post above. The problem is that both filters are activated by cpanel. So a copy of the email is discarded, and a copy is sent to [email protected]

Which is pointless.... since I only want the second filter to run against anything that is "left over" after the first filter runs.

The else / if example you gave also did not work. I wish there was a way to do this...

 

[electric]

I just submitted this as a feature request to cpanel bugzilla.

If anyone else wants the ability to have "sequential" filtering ability, just post your "yea" here in this thread.

 

[Devil Inside]

yeah - oh hell yeah

a big concern with clients is that they don't trust spam filters and fear losing legit email.

This would be great to remove absolute spam - while letting some in for them to sift through...

But then again...isn't that what the spam score setting is for anyhow?...

 

[electric]

yeah - oh hell yeah

But then again...isn't that what the spam score setting is for anyhow?...

Not really. The spam score is useful, but it's really the number of "stars" that is most useful. With this, you can create mail rules that depend on the number of stars. So if there are 10 stars, then delete it. If there are 8 stars, then move to "[email protected]" mailbox. If there are 5 stars, then move to "[email protected]" mailbox. etc....

With the ability to set filter sequence (one AFTER the other), this is easily possible. However, without this ability.. we are limited to EITHER OR scenario. (if spam assassin is "yes" then delete, otherwise move to "[email protected]" mailbox.) So we wind up with tons of highly probable spam mixed in with the "need to check before deleting" spam...



Besides the spam issue, I can also think of several handy reasons why sequential filtering ability would be very useful.

 

[chirpy]

Did you read through the exim filtering spec?
http://www.exim.org/exim-html-4.50/doc/html/filter_3.html#CHAP3

 

[electric]

Did you read through the exim filtering spec?
http://www.exim.org/exim-html-4.50/doc/html/filter_3.html#CHAP3

I'm hoping that the cpanel people will make this something that actual users can do without requiring them to become unix admins.

 

[wookiee]

I just submitted this as a feature request to cpanel bugzilla.

If anyone else wants the ability to have "sequential" filtering ability, just post your "yea" here in this thread.

yea!


I would use it quite often

 

[fochi]

Real filtering MUST be implemented

Of course it is increadble that it is not that way yet.

The CPanel for resellers does not allows you to edit filters, just a ".forward" file that in fact it names .filter. (In exim documentation you will see it as .forward).
As in Exim documentation: the forwards are executed after exim finishes its job and so, it delivers to ALL matches in the ".forward" file.
Inshort: in fact it is just a forward file and NOT a filter.

Possible solutions:

1) A REAL filter file (that is the reason the else if did not work as ). Remember; resellers do not have access to /etc/vfilters.

2) A filter in spamassassin

I think we must "make pressure" to this feature added by the cpanel guys, I just do not know how to do it.

Thanks,

Fochi

 

[electric]

I think we must "make pressure" to this feature added by the cpanel guys, I just do not know how to do it.

Yes, good idea. If you figure out how to make pressure on the cpanel people... be sure to let everyone else who has ever made a good suggestion know.

 

[godyn]

Wel it seems I have a similar problem.
The discard function does not work at all.
I've made some filters with it. (with header and yes, and with header [SPAM] etc;
But everytime I get them in my spamfolder.
Disabling the Spambox gives result that I get it in my inbox...

Also I can't just switch of my catch-all, because I loose some aliased emails.
(f.e. [email protected] goes to my [email protected] but is not an account.)
Any idea's on that?

 

[fochi]

Workaround on this problem

I have sucessfully made an workaround on this problem.

As I said, it is a work around, and not an official solution. It really works fine for me, but not everyone will be able to do the same. See why bellow:

I am a cpanel reseller, and so I do NOT have root acess. So my only solution was to make a workaround.

I have a few websites registered. Three of them did not have any email account. I created the following accounts:
[email protected]
[email protected]
[email protected]

In the official domain I configured spamassassin and edited by hand the blacklist as well the whitelist and INCREASED the score for obvious items like Drugs etc.etc.

I also made 1 (YES, JUST ONE) filter :
$h_X-Spam-Status: begins "Yes"[email protected]

In the sparedomain1.com I made 1 filter:$message_headers contains "***************"[email protected]

In the sparedomain2.com I made 1 filter:$message_headers contains "********************"[email protected]

What it does: First it sends all spam to sparedomain1, then it send all above 15stars to sparedomain2 and them, from there it sends all above 20stars to sparedomain3

As soon as I conclude that there are absolutely no false positives above 20stars, I will blackhole the emails in sparedomain3.

High now I have most false positives in sparedomain1, and I had one false positive so far in the sparedomain2. No falsepositives yet in sparedomain3.

The sum of emails in sparedomain1 and 2 are less than 10% of those in sparedomain3. so, now I have to check for false positives in less than 10% of all spam sent to my company.

Hope this helps

And still wait for the official solution by cpanel.
Please someone file the bug (bugzilla?) for me as I do not speak English and this takes too much effort from me.

 

[godyn]

Hi Fochi,

I must say this is a brilliant but for most users not realistic workaround.
I can only get the discard filter work on normal adresses, not related to spamassassin.

 

[rossh_cp]

I found you can do some tricks on the .filter file. As an end user we cannot get to the /etc/vfilters so the .filter is all we have.

The cpanel will auto create and load that .filter file, but the choices of paramaters and tests and limited. You can use ALL the string tests, expanded strings listed in help as follows.

Enter you unique tests into the .filter by hand, using the same format as the original. Copy your modified back to server and overwrite the original .filter with your own, and in the cpanel control, press Activate. This will load that file into the /etc/vfilters, and your all set. I have not found a way to do conditionals yet.

RossH

 

[fochi]

Hi Fochi,

I must say this is a brilliant but for most users not realistic workaround.
I can only get the discard filter work on normal adresses, not related to spamassassin.

Godyn,
I knew it was going to be very difficult for most people, but it was all I could do at that time.

NOW THE GOOD NEWS:

I am already able to make selective filters in just one site in a much more elegant and professional way. I am using the new email filtering system for more than a week and it is working very well, and ANYONE can just copy and paste my filters and it will work.

Please just wait till I have time to produce the "generic" filter without my private data so anyone can use it.

I promiss I will do it soon

All the Best and a happy new year

Fochi

 

[fochi]

I found you can do some tricks on the .filter file. ........ I have not found a way to do conditionals yet.

Rossh

I have good news to you:
I have alread figured out how to do conditional. As "if..then" just do not work in the .filter file, I am using "and"," or" instead.

I am also able to compare two integer numbers and check if one is equal, greater or lower than the other. (I can not do it with number with decimal places yet)

Fochi

 

[icoso]

RossH,

1. Where do I fnd the .filter file if I don't have access to my reseller account via SSH? Is this .filter in each account on the reseller account?

2. Where is the "Activate" button in the CPanel? I can't find it.

 

[wzd]

The following procmail script will delete mail with a score of 15 or higher. By moving the # (comment) mark up one line, it will save all mail with a score of 15 or higher in a separate folder rather than deleting. The general implementation then, is that mail with a score of less than 5 goes into the inbox, a client side rule triggering on "X-Spam-Status: YES" will cause mail scoring between 5 and 15 to go into a Junk Mail folder where it can regularly be checked, and mail of 15 or higher will be stored on the server or dropped on the floor.

Code:

#Uncomment the following lines and use tail -f procmail.log to debug
#LOGFILE=$HOME/procmail.log
#VERBOSE=yes
#LOGABSTRACT=all

# Feed redirected spam to sa-learn, and also store a copy in a folder called spam.
# This folder of false negatives could be useful if we needed to rebuild our Bayes
# database in the future.

:0
* ^To:.*[email protected]

   {
   * < 256000
   :0c: spamassassin.spamlock
   | sa-learn --spam

   :0: spamassassin.filelock
   spam
   }

# Send all other mail through SpamAssassin

:0fw: spamassassin.lock
* < 256000
| spamassassin


# Mail that is very likely spam (>15) can be saved on the server
# (not forwarded), or by moving the # down one line, even dropped
# on the floor.  Note that dropping mail on the floor is a *bad*
# idea unless you really, really believe no false positives will
# have a score greater than 15.  If you want all mail forwarded,
# just add #'s in front of each of these lines:

:0: spamassassin.filelock2
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
#/dev/null
almost-certainly-spam


# Forward all mail with a score less than 15 to my non-publicized address
:0
! [email protected]

By adding lines such as:

blacklist_from [email protected]
blacklist_from *@bonanzaoffers.com
blacklist_from *@deal-seeker.com
blacklist_from *@hispeedmediaoffers.com
blacklist_from *@jumpjive.com
blacklist_from *@*.ew01.com

to /etc/mail/spamassassin/local.cf or ~/.spamassassin/user_prefs , you tell spamassassin that mail from any of these domains gets a +100 spam score, effectively blocking them.

Then try whitelisting a specific domain?

Otherwise if you are concerned about spam why not check out this black list:

http://www.sa-blacklist.stearns.org/sa-blacklist/

http://wiki.apache.org/spamassassin...ilToForwardMail

Read that for more information

Let me know how it goes,