Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Exim filter to rewrite 'From' address on certain incoming mail

Discussion in 'E-mail Discussions' started by _jman, Sep 28, 2017.

Tags:
  1. _jman

    _jman Active Member

    Joined:
    Jan 17, 2007
    Messages:
    33
    Likes Received:
    1
    Trophy Points:
    158
    Have an Exim filter added into Exim's Basic Editor / Filters section (actual domains sanitized):

    if $h_from: is "test@mydomain.com" then
    headers add "Actual-From: [Filter-Rewrite] $h_from:"
    headers remove from
    headers add "From: My Re-Written From Address <test-rewritten@myotherdomain.com>"
    endif

    This is intended only for inbound mail, acting upon messages from sales reps that use their own, personal email for company business. We're in process of corralling all of them to use actual company domain email; this is just a temp workaround. We understand at present there's no controlling messages they send from their personal accounts to customers or other recipients outside of our domain.

    We already have aliases for outbound mail, so anything sent to "john@mydomain.com" is forwarded to whatever their personal account is, i.e., "john@mypersonaldomain.com"

    The intent is to force messages they send to us to appear to be from the "mydomain.com" aliases, as opposed to their own "mypersonaldomain.com" address.

    However, the above filter does not appear to be working.

    It does show up in WHM, and is enabled. We have access to "test@mydomain.com" (say, some gmail address), so can send from there, but upon receipt the "From" address is unchanged.

    We thought about using straight Exim rewrite examples such as:
    john@mypersonaldomain.com john@mydomain.com Sfw
    but weren't sure how to add that in via WHM. (Obviously don't want to manually edit exim.conf as it'll just get rewritten)

    Are there more commands to add into that filter, or are we going about it the wrong way?

    Any ideas would be most appreciated. Thanks!
     
    #1 _jman, Sep 28, 2017
    Last edited: Sep 28, 2017
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,658
    Likes Received:
    1,424
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you clarify how the messages are being sent? For instance, are they sent from the cPanel server, or from a remote mail server? Is "mypersonaldomain.com" hosted on the cPanel server in this scenario?

    Thank you.
     
  3. _jman

    _jman Active Member

    Joined:
    Jan 17, 2007
    Messages:
    33
    Likes Received:
    1
    Trophy Points:
    158
    Hi, thanks for the reply.

    They are external emails - say, someone's gMail or Yahoo account - being sent to a domain on our cPanel server.

    We wish to re-write the "From" address header of these received emails to show their alias (john@mydomain.com) as opposed to their actual address (john@mypersonaldomain.com).

    When we send to these people we use the domain alias - john@mydomain.com - which forwards the message to john@mypersonaldomain.com
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,658
    Likes Received:
    1,424
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Custom filter rules like that are unsupported, but you may find the following Exim document helpful:

    31. Address rewriting

    Otherwise, the Exim Users mailing list is a good resource for assistance with this type of customization:

    Exim-users Info Page

    Thank you.
     
  5. _jman

    _jman Active Member

    Joined:
    Jan 17, 2007
    Messages:
    33
    Likes Received:
    1
    Trophy Points:
    158
    Hi, thanks for the reply.

    This issue is PARTIALLY solved. Would like a little more info though. Will get to that.

    Again, the goal was to make sales reps using personal addresses appear to be using company addresses for any messages from them to the company. We already have valiases for dealing with messages to them coming from the company.

    Not sure why you pointed me to the Exim docs & list, as I was more interested in using something like the system filters. I only mentioned an Exim-specific way to solve the problem in case sysfilters (a cPanel thing, not Exim) weren't up to the task.

    (Turned out though that my original Exim-only solution had a bug in it, shown below.)

    You guys have a page on
    How to Customize the Exim System Filter File - cPanel Knowledge Base - cPanel Documentation
    but it's pretty sparse. It doesn't show any header re-writing, just "fail". (Perhaps that's why you didn't mention it.)

    Seems like employing sysfilters would be a better solution, but without better documentation haven't yet gotten them to work.

    The other, pure Exim solution was pretty simple, though not sure what extra load it's adding to the system. This company only has a dozen or so sales reps, but it's also not the only account on the server. Seems like overhead in all this testing and potential rewriting could become a problem if there were too many reps.

    Here's the bug in my original Exim-only solution: When re-writing, you can't use the S flag as it expects a regex. Somehow I glossed over that in reading the docs, so was trying to use hard-coded addresses, and didn't snap to it until testing the conf with
    exim -C /etc/exim.conf -bV

    Had thought I needed to specify S just to be safe, so as not to cause an infinite loop with outbound messages and the valias file, but magically it just works, so thankfully didn't need it.

    So, the Exim-only solution:
    edit /etc/exim.conf
    Find the section that has a comment containing REWRITE CONFIGURATION.
    Begin adding your code after the line that says "begin rewrite".
    For each address you want to rewrite, do something like this:
    email@personaldomain.com "First Last <email@yourdomain.com>" fw

    This will force anything coming into exim with a "From:" header of "email@personaldomain.com" to be rewritten as whatever name and address you have put into the quoted section.

    The 'f' flag controls rewriting the "from" addresses, and the "w" flag is needed because you're rewriting the entire address rather than just part of it (see 31.7, 31.8, and 31.10 in the Exim docs).

    You don't have to specify the person's name if you don't want to. You also don't have to use the same prefix (part before the ampersand). It's just literally matching "email@personaldomain.com" then changing it to whatever you put in the second part.

    Pursuant to that, you have to be careful to exactly match case in the original "from" address. If someone uses mixed-case in their address, replicate that or the re-write won't get triggered.

    The Return-path header won't change, though. It'll still have the original "from" address.

    !!! IMPORTANT !!!
    To make your changes persist (in case Exim gets updated):
    edit /etc/exim.conf.local
    Put the same code as above immediately after the line that says @REWRITE@

    As said above, I'd be more interested in using the system filters, so I could re-write the return path, etc., wrapped up in an "if" based on the From header. (Hopefully the filter could help with forcing case on the test of the from address, too, simplifying the search criteria.)

    Would appreciate more info on the sysfilter capability than what was in the above link.

    The system filters are in /usr/local/cpanel/etc/exim/sysfilter/options

    Any file in that folder will be treated as a system filter.

    Found a file there called "spam_rewrite"
    if "${if def:header_X-Spam-Subject: {there}}" is there
    then
    headers remove Subject
    headers add "Subject: $rh_X-Spam-Subject:"
    headers remove X-Spam-Subject
    endif

    Not sure if this file is cPanel's doing, or something from ConfigServer's Mailscanner addon that I loaded a while back.

    (BTW, that {there} and is there stuff isn't anywhere to be found in the Exim docs, so it must be something you, spamassassin, or ConfigServer have crafted.)

    Anyway, that spam_rewrite file clearly intimates I should be able to remove and add headers. But making up another file containing:
    if ($h_from: is "email@mypersonaldomain.com")
    then
    headers add "Actual-From: [From-Rewrite] $h_from:"
    headers remove From
    headers add "From: First Last <email@mydomain.com>"
    headers remove Return-path
    headers add "Return-path: <email@mydomain.com>"
    endif

    Didn't do squat. (If it did, presumably one would have individual "if's" for each rep to handle the rewriting.)

    So, what all can one do with these sysfilters?

    Please advise. It would be very helpful to have more specific documentation on what can be done with them.

    Thanks!
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    38,658
    Likes Received:
    1,424
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Can you confirm that browsed to "WHM Home » Service Configuration » Exim Configuration Manager » Basic Editor" and clicked "Save" after creating that custom filter file in "/usr/local/cpanel/etc/exim/sysfilter/options/"? This ensures the Exim configuration is rebuilt with that new filter rule.

    Thank you.
     
  7. _jman

    _jman Active Member

    Joined:
    Jan 17, 2007
    Messages:
    33
    Likes Received:
    1
    Trophy Points:
    158
    Hi, thanks for the reply.

    Yes. Have done that, and I do see the "Your changes have been saved" and "exim restarted successfully" messages after clicking "Save".

    Am wondering though: When you say "This ensures the Exim configuration is rebuilt", are you saying that the contents of the filter would be incorporated into exim.conf?

    After saving, the contents of the filter are not present in exim.conf itself. Is Exim instead reading the filter like some sort of include file, ala something inside /etc/cron.d for cron jobs?

    This is the content of a file in /usr/local/cpanel/etc/exim/sysfilter/options:

    if ($h_from: is "First Last <user@mypersonaldomain.com>")
    then
    headers add "Actual-From: [From-Rewrite] $h_from:"
    headers remove From
    headers add "From: First Last <user@mydomain.com>"
    headers remove Reply-To
    headers add "Reply-To: First Last <user@mydomain.com>"
    endif

    Actual names and email addresses above have been sanitized.

    Have verified the name and email address match the filter condition.

    Have also tried without the name, using just the email address, with "$h_from: contains user@mypersonaldomain.com" as well as "$h_from: contains <user@mypersonaldomain.com>"

    Have verified the filter shows up in Exim Configuration Manager -> Filters, and is marked as "On".

    Have tested by sending from the "mypersonaldomain.com" address to the "mydomain.com" address, which is under an account on the cPanel server.

    Headers do not get changed.

    Please advise. Thanks!
     
Loading...

Share This Page