Exim filter to rewrite 'From' address on certain incoming mail

[_jman]

Have an Exim filter added into Exim's Basic Editor / Filters section (actual domains sanitized):

if $h_from: is "[email protected]" then
headers add "Actual-From: [Filter-Rewrite] $h_from:"
headers remove from
headers add "From: My Re-Written From Address <[email protected]>"
endif

This is intended only for inbound mail, acting upon messages from sales reps that use their own, personal email for company business. We're in process of corralling all of them to use actual company domain email; this is just a temp workaround. We understand at present there's no controlling messages they send from their personal accounts to customers or other recipients outside of our domain.

We already have aliases for outbound mail, so anything sent to "[email protected]" is forwarded to whatever their personal account is, i.e., "[email protected]"

The intent is to force messages they send to us to appear to be from the "mydomain.com" aliases, as opposed to their own "mypersonaldomain.com" address.

However, the above filter does not appear to be working.

It does show up in WHM, and is enabled. We have access to "[email protected]" (say, some gmail address), so can send from there, but upon receipt the "From" address is unchanged.

We thought about using straight Exim rewrite examples such as:
[email protected] [email protected] Sfw
but weren't sure how to add that in via WHM. (Obviously don't want to manually edit exim.conf as it'll just get rewritten)

Are there more commands to add into that filter, or are we going about it the wrong way?

Any ideas would be most appreciated. Thanks!

 

[cPanelMichael]

The intent is to force messages they send to us to appear to be from the "mydomain.com" aliases, as opposed to their own "mypersonaldomain.com" address.

Hello,

Could you clarify how the messages are being sent? For instance, are they sent from the cPanel server, or from a remote mail server? Is "mypersonaldomain.com" hosted on the cPanel server in this scenario?

Thank you.

 

[_jman]

Hi, thanks for the reply.

They are external emails - say, someone's gMail or Yahoo account - being sent to a domain on our cPanel server.

We wish to re-write the "From" address header of these received emails to show their alias ([email protected]) as opposed to their actual address ([email protected]).

When we send to these people we use the domain alias - [email protected] - which forwards the message to [email protected]

 

[cPanelMichael]

Hello,

Custom filter rules like that are unsupported, but you may find the following Exim document helpful:

31. Address rewriting

Otherwise, the Exim Users mailing list is a good resource for assistance with this type of customization:

Exim-users Info Page

Thank you.

 

[_jman]

Hi, thanks for the reply.

This issue is PARTIALLY solved. Would like a little more info though. Will get to that.

Again, the goal was to make sales reps using personal addresses appear to be using company addresses for any messages from them to the company. We already have valiases for dealing with messages to them coming from the company.

Not sure why you pointed me to the Exim docs & list, as I was more interested in using something like the system filters. I only mentioned an Exim-specific way to solve the problem in case sysfilters (a cPanel thing, not Exim) weren't up to the task.

(Turned out though that my original Exim-only solution had a bug in it, shown below.)

You guys have a page on
How to Customize the Exim System Filter File - cPanel Knowledge Base - cPanel Documentation
but it's pretty sparse. It doesn't show any header re-writing, just "fail". (Perhaps that's why you didn't mention it.)

Seems like employing sysfilters would be a better solution, but without better documentation haven't yet gotten them to work.

The other, pure Exim solution was pretty simple, though not sure what extra load it's adding to the system. This company only has a dozen or so sales reps, but it's also not the only account on the server. Seems like overhead in all this testing and potential rewriting could become a problem if there were too many reps.

Here's the bug in my original Exim-only solution: When re-writing, you can't use the S flag as it expects a regex. Somehow I glossed over that in reading the docs, so was trying to use hard-coded addresses, and didn't snap to it until testing the conf with
exim -C /etc/exim.conf -bV

Had thought I needed to specify S just to be safe, so as not to cause an infinite loop with outbound messages and the valias file, but magically it just works, so thankfully didn't need it.

So, the Exim-only solution:
edit /etc/exim.conf
Find the section that has a comment containing REWRITE CONFIGURATION.
Begin adding your code after the line that says "begin rewrite".
For each address you want to rewrite, do something like this:
[email protected] "First Last <[email protected]>" fw

This will force anything coming into exim with a "From:" header of "[email protected]" to be rewritten as whatever name and address you have put into the quoted section.

The 'f' flag controls rewriting the "from" addresses, and the "w" flag is needed because you're rewriting the entire address rather than just part of it (see 31.7, 31.8, and 31.10 in the Exim docs).

You don't have to specify the person's name if you don't want to. You also don't have to use the same prefix (part before the ampersand). It's just literally matching "[email protected]" then changing it to whatever you put in the second part.

Pursuant to that, you have to be careful to exactly match case in the original "from" address. If someone uses mixed-case in their address, replicate that or the re-write won't get triggered.

The Return-path header won't change, though. It'll still have the original "from" address.

!!! IMPORTANT !!!
To make your changes persist (in case Exim gets updated):
edit /etc/exim.conf.local
Put the same code as above immediately after the line that says @[email protected]

As said above, I'd be more interested in using the system filters, so I could re-write the return path, etc., wrapped up in an "if" based on the From header. (Hopefully the filter could help with forcing case on the test of the from address, too, simplifying the search criteria.)

Would appreciate more info on the sysfilter capability than what was in the above link.

The system filters are in /usr/local/cpanel/etc/exim/sysfilter/options

Any file in that folder will be treated as a system filter.

Found a file there called "spam_rewrite"
if "${if def:header_X-Spam-Subject: {there}}" is there
then
headers remove Subject
headers add "Subject: $rh_X-Spam-Subject:"
headers remove X-Spam-Subject
endif

Not sure if this file is cPanel's doing, or something from ConfigServer's Mailscanner addon that I loaded a while back.

(BTW, that {there} and is there stuff isn't anywhere to be found in the Exim docs, so it must be something you, spamassassin, or ConfigServer have crafted.)

Anyway, that spam_rewrite file clearly intimates I should be able to remove and add headers. But making up another file containing:
if ($h_from: is "[email protected]")
then
headers add "Actual-From: [From-Rewrite] $h_from:"
headers remove From
headers add "From: First Last <[email protected]>"
headers remove Return-path
headers add "Return-path: <[email protected]>"
endif

Didn't do squat. (If it did, presumably one would have individual "if's" for each rep to handle the rewriting.)

So, what all can one do with these sysfilters?

Please advise. It would be very helpful to have more specific documentation on what can be done with them.

Thanks!

 

[cPanelMichael]

Hello,

Can you confirm that browsed to "WHM Home » Service Configuration » Exim Configuration Manager » Basic Editor" and clicked "Save" after creating that custom filter file in "/usr/local/cpanel/etc/exim/sysfilter/options/"? This ensures the Exim configuration is rebuilt with that new filter rule.

Thank you.

 

[_jman]

Hi, thanks for the reply.

Yes. Have done that, and I do see the "Your changes have been saved" and "exim restarted successfully" messages after clicking "Save".

Am wondering though: When you say "This ensures the Exim configuration is rebuilt", are you saying that the contents of the filter would be incorporated into exim.conf?

After saving, the contents of the filter are not present in exim.conf itself. Is Exim instead reading the filter like some sort of include file, ala something inside /etc/cron.d for cron jobs?

This is the content of a file in /usr/local/cpanel/etc/exim/sysfilter/options:

if ($h_from: is "First Last <[email protected]>")
then
headers add "Actual-From: [From-Rewrite] $h_from:"
headers remove From
headers add "From: First Last <[email protected]>"
headers remove Reply-To
headers add "Reply-To: First Last <[email protected]>"
endif

Actual names and email addresses above have been sanitized.

Have verified the name and email address match the filter condition.

Have also tried without the name, using just the email address, with "$h_from: contains [email protected]" as well as "$h_from: contains <[email protected]>"

Have verified the filter shows up in Exim Configuration Manager -> Filters, and is marked as "On".

Have tested by sending from the "mypersonaldomain.com" address to the "mydomain.com" address, which is under an account on the cPanel server.

Headers do not get changed.

Please advise. Thanks!

 

[cPanelMichael]

Hi,

Could you open a support ticket using the link in my signature so we can take a closer look at this?

Thank you.

 

[_jman]

Opened a ticket with cPanel and they reported an internal ticket - CPANEL-16503 - wherein if the system filter in WHM's Exim configuration manager is set to anything but the default "/usr/local/cpanel/etc/exim/sysfilter/options", then even if your custom filter in that folder shows to be active, cPanel causes Exim to ignore the filter.

In my case, the system filter was showing to be "/etc/antivirus.empty"

Turns out that I had purchased Way To The Web's MailScanner add-on a few years ago as a replacement for cPanel's default spam and anti-virus handling, and that during installation they updated Exim's configuration to refer to that file instead (thus purposefully disabling any internal filters supplied by cPanel).

So, per Way To The Web, the solution is simply to put your custom filters inside /etc/antivirus.empty and let MailScanner handle them.

After making that change, custom filters should work as expected.

Thanks for all your help!

 

[cPanelMichael]

Hello,

I'm glad to see it's now working well. Thank you for updating us with the outcome.