Use Mailscanner to Filter Subject Text

[nootkan]

I've been trying to stop a bot from sending email with a subject like:

(proper_name) some random porn sentence

by creating filters in cPanel>>Global Email Filters but I am seeing this error in my logs:

[2016-09-01 11:43:45 -0700] warn [Email::has_spam_as_acl] Encountered error
in Email::has_spam_as_acl: Email::has_spam_as_acl(1) failed: This feature
requires the “spamassassin” option and is not enabled on your account.

I seem to remember that Mailscanner disables spamassassin and incorporates it in the actual script of Mailscanner so I was just wondering if there was a way for using mailscanner to create these filters as the normal mailscanner process is missing the spam. Mailscanner catches everything else that is classified as spam but not these emails with subject lines like above.

Hope this makes sense and I appreciate any help or direction to figure this out.

[Sarah]

You might have better luck creating your own spamassassin rule(s), which you can add to your own .cf file in /etc/mail/spamassassin/. More info here:
http://wiki.apache.org/spamassassin/WritingRules

[Sergio]

@nootkan
Go to /etc/mail/spamassassin/ and create a file called blacklist.cf
inside that file copy and paste the following rule:

Code: Select all

header		SUBJ_PORN1	Subject =~ /write here what to search for/i
score		SUBJ_PORN1	11
describe		SUBJ_PORN1	Subject PORN

That code will check any email that enters into your server with a subject that contains the phrase that you want to block and will assign an score of 11 that is to high and that way it will be flagged as spam and your users will not receive them.

If you want to block "garbish" porn subjects, check if you have the latest KAM rules.

Sergio

[andyhans]

Hi @Sergio, what about if I need to find a word inside the "body".

Thanks in advice

P.S. the file must still be created in the folder "/etc/mail/spamassassin/"

Thanks

[Sergio]

Hi @andyhans,
to create a body rule you can do this:
1. Create a folder at /etc/spamassasin/blackbody.cf
2. Create your own rule following the next example:

Code: Select all

body       ASECMAS_BLOCKBDY /any phrase1|another phrase|word/i
score      ASECMAS_BLOCKBDY 22
describe  ASECMAS_BLOCKBDY BlockBdy

On the body line you can use the "or" pipe as in my example "|" to separte words or phrases that SpamAssassin will block.
Try not to add a lot of "or's".

[andyhans]

Thanks @Sergio!

[Sergio]

Your welcome.

[andyhans]

Hi @Sergio, if we have multiple subjects to block how do we manage that?

Thanks

[Sergio]

Hi @andyhans,
in your rule you use the or command "|" (the pipe sign means "or") and add two or more subjects in the rule, per example:

Code: Select all

header		SUBJ_XAMPLE	Subject =~ /subject one|subject two|subject three/i
score		SUBJ_XAMPLE	11
describe		SUBJ_XAMPLE	Subject XAMPLE

Or you can use the "or", like this:

Code: Select all

header		SUBJ_XAMPLE	Subject =~ /subject (one|two|three)/i
score		SUBJ_XAMPLE	11
describe		SUBJ_XAMPLE	Subject XAMPLE

Word of caution, don't use to a lot of OR's, try to construct your rules with about 9 or's or fewer.

Sergio

[jameswang]

Hi @andyhans,
in your rule you use the or command "|" (the pipe sign means "or") and add two or more subjects in the rule, per example:

Code: Select all

header		SUBJ_XAMPLE	Subject =~ /subject one|subject two|subject three/i
score		SUBJ_XAMPLE	11
describe		SUBJ_XAMPLE	Subject XAMPLE

Or you can use the "or", like this:

Code: Select all

header		SUBJ_XAMPLE	Subject =~ /subject (one|two|three)/i
score		SUBJ_XAMPLE	11
describe		SUBJ_XAMPLE	Subject XAMPLE

Word of caution, don't use to a lot of OR's, try to construct your rules with about 9 or's or fewer.

Sergio

Or you can stack them:

Code: Select all

header		SUBJ_XAMPLE1	Subject =~ /subject (one|two|three)/i
score		SUBJ_XAMPLE1	11
describe		SUBJ_XAMPLE1	Subject XAMPLE1

header		SUBJ_XAMPLE2	Subject =~ /subject (four|five|six)/i
score		SUBJ_XAMPLE2	10
describe		SUBJ_XAMPLE2	Subject XAMPLE2

header		SUBJ_XAMPLE3	Subject =~ /subject (seven)/i
score		SUBJ_XAMPLE3	5
describe		SUBJ_XAMPLE3	Subject XAMPLE3
...