Using one Account level filtering file across my VPS

[StoneyCreeker]

I am on a vps using whm and cpanel and have root access.

I found my account level filters in root/ect/vfilters.

Is there a way to use one account level filter for all my accounts? I have 31 and would like to not have to edit them all when new mass spams come through.

Thank You!

Curtis Walter

 

[cPanelMichael]

Hello

You can use a custom system filter for Exim to ensure it's applied to all accounts. To start, you would copy over the existing Exim filter to the new location:

cp -a /etc/cpanel_exim_system_filter /etc/cpanel_exim_system_filter_custom

Then, configure the custom filter file as the default filter via the "System Filter File" option under the "Filters" tab in:

"WHM Home » Service Configuration » Exim Configuration Manager"

Within the "/etc/cpanel_exim_system_filter_custom" file, you can add the entries for your custom filter rules.

Thank you.

 

[StoneyCreeker]

Hello

You can use a custom system filter for Exim to ensure it's applied to all accounts. To start, you would copy over the existing Exim filter to the new location:

cp -a /etc/cpanel_exim_system_filter /etc/cpanel_exim_system_filter_custom

Then, configure the custom filter file as the default filter via the "System Filter File" option under the "Filters" tab in:

"WHM Home » Service Configuration » Exim Configuration Manager"

Within the "/etc/cpanel_exim_system_filter_custom" file, you can add the entries for your custom filter rules.

Thank you.

Thank You!

I made the copy of the file and renamed it to cpanel_exim_system_filter_custom using smart ftp.
I am not very savy about editing this file. I have it open in a text editor. Can I copy and paste the contents of one of my current exim account level filters from root/etc/vfilters/~user.com? Where do I paste it in the the cpanel_exim_system_filter_custom file?

Will this now be the exclusive filter serverwide or will exim also still pick up the individual filters in /vfilters for each account? I do not want the "generated spamassassin Discard Rules" to be global. Would this new filter be run before the individual filters?

Sorry I am not good at this yet.

Thank You!

 

[cPanelMichael]

Individual filters are still utilized just as they were before. You can add additional rules at the bottom of the file. Here is one example:

if "${if def:header_X-Spam-Subject: {there}}" is there
then
    headers remove Subject
    headers add "Subject: $h_X-Spam-Subject:"
    headers remove X-Spam-Subject
endif

Thank you.

 

[StoneyCreeker]

Thank You!

I will add a few rules copied from the root/etc/vfilters/~user.com files and play with it after I make the change in the WHM.

I have been looking for this answer with google for a while.

You are a guru!
Thank You!
Have a great day

 

[StoneyCreeker]

I have added a few lines to the bottom of the file and it appears to be working.
Would you look at it and see if you see if you think I am on track?

This is the last line in cpanel_exim_system_filter_custom:

# END - Included from /usr/local/cpanel/etc/exim/sysfilter/options/spam_rewrite

I added:

#Viagra Subject
if
 $header_subject: contains "Viagra"
then
  save "/dev/null" 660
endif

#Viagra body
if
 $message_body contains "Viagra"
then
  save "/dev/null" 660
endif

#viagraonline
if
 $header_subject: contains "viagraonline"
then
 save "/dev/null" 660
endif

=================

Should this work or does it need to be formatted differently?
Thank You!

 

[cPanelMichael]

It looks okay, but feel free to test it out and ensure it works as you expect it to.

Thank you.

 

[StoneyCreeker]

I found a good example at: "http://webscriptsdebugging.wordpress.com/2012/10/04/discard-spam-emails-in-exim/"

Instead of using a copied and pasted rule from the /vfilters/domain.com files, I need to change it a little:

#viagraonline
if
$header_subject: contains "viagraonline"
then
save "/dev/null" 660
endif

I found this code to be more recommended:

#viagraonline
if
$header_subject: contains "viagraonline"
then
seen finish
endif

I don't know where the "save "/dev/null" 660" is... but the "seen finish" seems to be working.
It apparently says the email has been seen and does not deliver it. I am not sure where it is going, , hopefully to null or the either, but it seems to be working across all my resold accounts in my VPS.

The spam messages I am filtering with this method are getting through spamassassin and have a score of 3.0 or less and I do not want to turn it down any lower to prevent false positives so this is my attempt to further stop spam. I wish a better solution was available I could afford.

I realize this will not stop all spam but the ones that come through multiple times per day/hour with a spamassassin score of 3.0 or less can now be squelched.

Thank You for your time and help. I hope this helps others as well.