Cpanel email filters - possible to have one THEN another?

I'm not sure if this will work (untested), but I think it's roughly what you're after.

Edit the filter file for your domain in /etc/vfilters.

Code:

if
  $h_X-Spam-Level: contains "**********"
 then
  save "/dev/null" 660
 elif
  $h_X-Spam-Flag: is "YES"
 then
  deliver "spam@domain.com"
endif

Actually, scratch that. You should be able to accomplish the same thing with basic cPanel rules.

Give these two a try:

1. Filter Any Header that contains ********** Destination Discard.

2. Filter SpamAssassin Spam Header that contains Yes Destination spam@domain.com.

 

yeah - oh hell yeah

a big concern with clients is that they don't trust spam filters and fear losing legit email.

This would be great to remove absolute spam - while letting some in for them to sift through...

But then again...isn't that what the spam score setting is for anyhow?...

 

Did you read through the exim filtering spec?
http://www.exim.org/exim-html-4.50/doc/html/filter_3.html#CHAP3

 

yea!


I would use it quite often

 

Real filtering MUST be implemented

Of course it is increadble that it is not that way yet.

The CPanel for resellers does not allows you to edit filters, just a ".forward" file that in fact it names .filter. (In exim documentation you will see it as .forward).
As in Exim documentation: the forwards are executed after exim finishes its job and so, it delivers to ALL matches in the ".forward" file.
Inshort: in fact it is just a forward file and NOT a filter.

Possible solutions:

1) A REAL filter file (that is the reason the else if did not work as ). Remember; resellers do not have access to /etc/vfilters.

2) A filter in spamassassin

I think we must "make pressure" to this feature added by the cpanel guys, I just do not know how to do it.

Thanks,

Fochi

 

Wel it seems I have a similar problem.
The discard function does not work at all.
I've made some filters with it. (with header and yes, and with header [SPAM] etc;
But everytime I get them in my spamfolder.
Disabling the Spambox gives result that I get it in my inbox...

Also I can't just switch of my catch-all, because I loose some aliased emails.
(f.e. contact@ goes to my info@ but is not an account.)
Any idea's on that?

 

Workaround on this problem

I have sucessfully made an workaround on this problem.

As I said, it is a work around, and not an official solution. It really works fine for me, but not everyone will be able to do the same. See why bellow:

I am a cpanel reseller, and so I do NOT have root acess. So my only solution was to make a workaround.

I have a few websites registered. Three of them did not have any email account. I created the following accounts:
spam5@sparedomain1.com
spam15@sparedomain2.com
spam20@sparedomain3.com

In the official domain I configured spamassassin and edited by hand the blacklist as well the whitelist and INCREASED the score for obvious items like Drugs etc.etc.

I also made 1 (YES, JUST ONE) filter :
$h_X-Spam-Status: begins "Yes"+++++++spam5@sparedomain1.com

In the sparedomain1.com I made 1 filter:$message_headers contains "***************"++++++++spam15@sparedomain2.com

In the sparedomain2.com I made 1 filter:$message_headers contains "********************"++++++++spam20@sparedomain3.com

What it does: First it sends all spam to sparedomain1, then it send all above 15stars to sparedomain2 and them, from there it sends all above 20stars to sparedomain3

As soon as I conclude that there are absolutely no false positives above 20stars, I will blackhole the emails in sparedomain3.

High now I have most false positives in sparedomain1, and I had one false positive so far in the sparedomain2. No falsepositives yet in sparedomain3.

The sum of emails in sparedomain1 and 2 are less than 10% of those in sparedomain3. so, now I have to check for false positives in less than 10% of all spam sent to my company.

Hope this helps

And still wait for the official solution by cpanel.
Please someone file the bug (bugzilla?) for me as I do not speak English and this takes too much effort from me.

 

Hi Fochi,

I must say this is a brilliant but for most users not realistic workaround.
I can only get the discard filter work on normal adresses, not related to spamassassin.

 

I found you can do some tricks on the .filter file. As an end user we cannot get to the /etc/vfilters so the .filter is all we have.

The cpanel will auto create and load that .filter file, but the choices of paramaters and tests and limited. You can use ALL the string tests, expanded strings listed in help as follows.

Enter you unique tests into the .filter by hand, using the same format as the original. Copy your modified back to server and overwrite the original .filter with your own, and in the cpanel control, press Activate. This will load that file into the /etc/vfilters, and your all set. I have not found a way to do conditionals yet.

RossH

 

Godyn,
I knew it was going to be very difficult for most people, but it was all I could do at that time.

NOW THE GOOD NEWS:

I am already able to make selective filters in just one site in a much more elegant and professional way. I am using the new email filtering system for more than a week and it is working very well, and ANYONE can just copy and paste my filters and it will work.

Please just wait till I have time to produce the "generic" filter without my private data so anyone can use it.

I promiss I will do it soon

All the Best and a happy new year

Fochi

 

Rossh

I have good news to you:
I have alread figured out how to do conditional. As "if..then" just do not work in the .filter file, I am using "and"," or" instead.

I am also able to compare two integer numbers and check if one is equal, greater or lower than the other. (I can not do it with number with decimal places yet)

Fochi

 

RossH,

1. Where do I fnd the .filter file if I don't have access to my reseller account via SSH? Is this .filter in each account on the reseller account?

2. Where is the "Activate" button in the CPanel? I can't find it.

 

The following procmail script will delete mail with a score of 15 or higher. By moving the # (comment) mark up one line, it will save all mail with a score of 15 or higher in a separate folder rather than deleting. The general implementation then, is that mail with a score of less than 5 goes into the inbox, a client side rule triggering on "X-Spam-Status: YES" will cause mail scoring between 5 and 15 to go into a Junk Mail folder where it can regularly be checked, and mail of 15 or higher will be stored on the server or dropped on the floor.

Code:

Code:

#Uncomment the following lines and use tail -f procmail.log to debug
#LOGFILE=$HOME/procmail.log
#VERBOSE=yes
#LOGABSTRACT=all

# Feed redirected spam to sa-learn, and also store a copy in a folder called spam.
# This folder of false negatives could be useful if we needed to rebuild our Bayes
# database in the future.

:0
* ^To:.*spam@example.com

   {
   * < 256000
   :0c: spamassassin.spamlock
   | sa-learn --spam

   :0: spamassassin.filelock
   spam
   }

# Send all other mail through SpamAssassin

:0fw: spamassassin.lock
* < 256000
| spamassassin


# Mail that is very likely spam (>15) can be saved on the server
# (not forwarded), or by moving the # down one line, even dropped
# on the floor.  Note that dropping mail on the floor is a *bad*
# idea unless you really, really believe no false positives will
# have a score greater than 15.  If you want all mail forwarded,
# just add #'s in front of each of these lines:

:0: spamassassin.filelock2
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
#/dev/null
almost-certainly-spam


# Forward all mail with a score less than 15 to my non-publicized address
:0
! privateaddress@example.net

By adding lines such as:

blacklist_from sde@spledee.com
blacklist_from *@bonanzaoffers.com
blacklist_from *@deal-seeker.com
blacklist_from *@hispeedmediaoffers.com
blacklist_from *@jumpjive.com
blacklist_from *@*.ew01.com

to /etc/mail/spamassassin/local.cf or ~/.spamassassin/user_prefs , you tell spamassassin that mail from any of these domains gets a +100 spam score, effectively blocking them.

Then try whitelisting a specific domain?

Otherwise if you are concerned about spam why not check out this black list:

http://www.sa-blacklist.stearns.org/sa-blacklist/

http://wiki.apache.org/spamassassin...ilToForwardMail

Read that for more information

Let me know how it goes,