reject at smtp time if headers contains
Really struggling with an email virus at the moment, clamav isn't always catching it.
I've identified a pettern in the message headers, which a global filter is doing a decent job of weeding out.
However, is it possible to create a filter that would reject at smtp time based on what's in the headers.
I've about four patterns which weeds out about 95% of them.
-
The only way to properly reject a message at SMTP time would be to do it within the exim.conf file. You would need to do this in the [font="courier new">acl_smtp_data section before the final accept. For information on header expansion in the conf file see: $header_ : or $h_ To actually make this kosher with cPanel, you would have to add the code into the proper [font="courier new">/usr/local/cpanel/etc/exim/acls and enable that customization file in [font="courier new">/etc/exim.conf.localopts ... easiest way is to use the Exim Configuration builder in WHM and note what files change in these directories/file after you make the changes. If you are using a filter to do all of this - then you can place the filter context in [font="courier new">/etc/cpanel_exim_system_filter or whatever file [font="courier new">system_filter is pointing to in the exim.conf file. The key here is that you can't reject mail in a filter (well... I mean... I guess you can, but your server is then going to be responsible for sending the bounce message). The filter doesn't run until after you have accepted the message. But you can blackhole it or send it to [font="courier new">/dev/null. Doesn't give necessarily the same effect, but it at least keeps messages from being delivered. There's probably a more kosher way of doing this in cPanel that involves modifying some files again in the [font="courier new">/usr/local/cpanel/etc/exim directory. Perhaps creating a file in [font="courier new">/usr/local/cpanel/etc/exim/sysfilter/options with the code and running [font="courier new">/scripts/buildeximconf ? Really not sure with this, never used this. You would also need to restart exim after [font="courier new">/scripts/buildeximconf because it doesn't restart exim.0 -
sounds far too compliacted for my skill set Thanks for responding though 0 -
i'm using a filter to a decent effect, which dicards the message. However, I would prefer to reject. You say " If you are using a filter to do all of this - then you can place the filter context in /etc/cpanel_exim_system_filter or whatever file system_filter is pointing to in the exim.conf file. " Would it be as simple as extracting the rule and literally just dropping these in to cpanel_exim_system_filter. I found the filter in etc/vfilters, and I'll not divulge my actual rules, but something along these lines. # Exim filter - auto-generated by cPanel. # # Do not manually edit this file; instead, use cPanel APIs to manipulate # email filters. MANUAL CHANGES TO THIS FILE WILL BE OVERWRITTEN. # headers charset "UTF-8" if not first_delivery and error_message then finish endif #Old Payments Email if $header_to: contains "zzz@mydomain.com"or $message_body contains "zzz@mydomain.com" endif0 -
@sparek-3 You've possibly put me on to something here. I use CSF Mailscanner, and I believe it to over write the exim_system_filter with a file named antivirus_empty. So I located this file and see a rule in there already if first_delivery and ("$h_to:, $h_cc:" contains ".icu") or ("$h_from:" contains ".icu") then seen finish endif so in the middle I added or ("$message_body" contains "blahblah") Now i've emailed myself from gmail with blahblah in the body and it got through, so I assume my context could be wrong on my entry. Any thoughts ?? 0 -
Yea, would really hope that someone else with more experience writing Exim filters like this would chime in - I'm not really the one to ask. You might want to make sure you're adding the filter code into the right file [font="courier new">cat /etc/exim.conf | grep "^system_filter = " Should tell you what system_filter file Exim is using. You might need a [font="courier new">save "/dev/null" 660 instead of [font="courier new">seen finish Again - it's not advisable to reject messages with these filters. Because these filters run AFTER your server has already accepted the message. So if you reject a message in a filter, YOUR server is going to tasked with sending the bounce rejection message. And if the envelope-sender of the message is faked, then you'll build up rejection messages in your mail queue or you will send a rejection message to an email address that did not send the message. After your server accepts a message - if you don't want your email users to see the message, your best (and safest) recourse is to send it to /dev/null 0 -
OK, understood. Ideally I want to reject at smtp time. Doing it this way isn't achieving anything that a global filter isn't doing already 0
Please sign in to leave a comment.
Comments
6 comments