HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   Tips/Tricks/Mods (http://www.howtoforge.com/forums/forumdisplay.php?f=29)
-   -   email->global filter->content filter help (http://www.howtoforge.com/forums/showthread.php?t=49168)

Turbanator 30th September 2010 16:52

email->global filter->content filter help
 
I can't seem to get it right.

Using latest ISPC3.

Email->Global filters->Content filter-.Add New filter

Filter = Header filter
RegExp Pattern = /^From: *.info
Data = <blank>
Action = Reject
Save = Check

What I'm trying to do is block any email coming From an email address with .info .

I've tried different variations but it doesn't seem to work.

till 30th September 2010 17:23

The regex pattern seem to be incomplete. A regex has to end with the same char then it begins. If your regex starts with / it has to end with / too, please try e.g.

/^From: *.info/

Turbanator 30th September 2010 18:12

Till,
Tried that, didn't work.

This email still came through and it was well after I made the change so the system had time to update:

Code:

X-Greylist: delayed 623 seconds by postgrey-1.31 at dns.domain.com; Thu, 30 Sep 2010 09:08:17 PDT
Received: from aju112.onlyoffer.info (unknown [184.107.24.112])
        by dns.domain.com(Postfix) with ESMTP id DC7CB10B42C0
        for <user@domain.com>; Thu, 30 Sep 2010 09:08:17 -0700 (PDT)
From: "SwipeBids" <gianna@onlyoffer.info>
Date: Thu, 30 Sep 2010 11:30:06 -0400
Mime-Version: 1.0
Subject: WHAT?? iPhones for under 20?? Itís true!
Message-ID: <1624863331.7005481383406083446@aju112.onlyoffer.info>


till 30th September 2010 19:03

A * in a regex is no wildcard, it means only repeat the character before the * a unlimited time. As the character before the * in your regex is a whitespace, your regex will match only things like From: .info and not .info email addresses. I guess what you wanted is something like that:

/From:.*\.info/

Wich means that the line starts with "From:" Then there may be any other characters as . is the placeholder for any character and .* means that any number of any character might be in that place and then the end is .info where the . has to be escaped with a backslash so that it is not interpreted as wildcard.

Turbanator 30th September 2010 22:00

I tnk you did it! Thanx Till. Another 10% of spam will be gone.

Johans 4th July 2012 05:11

Quote:

Originally Posted by till (Post 240643)
A * in a regex is no wildcard, it means only repeat the character before the * a unlimited time. As the character before the * in your regex is a whitespace, your regex will match only things like From: .info and not .info email addresses. I guess what you wanted is something like that:

/From:.*\.info/

Wich means that the line starts with "From:" Then there may be any other characters as . is the placeholder for any character and .* means that any number of any character might be in that place and then the end is .info where the . has to be escaped with a backslash so that it is not interpreted as wildcard.

Thank you for that information..
I have a question.. How do i block spam in content filter if i would like to reject a keyword "viagra"

I am using ISPConfig v. 3.0.2.1

Your immediate response is highly appreciated.

sjau 4th July 2012 15:35

keyword "viagra" in the email text somewhere?

Johans 5th July 2012 04:09

Quote:

Originally Posted by sjau (Post 281585)
keyword "viagra" in the email text somewhere?

Example if there is a subject or body message name "viagra" - key word how can i put this to spam folder directly or auto delete the emails received.

sjau 5th July 2012 08:25

ISPC can't do header checks or body checky (yet). However you could set that up manually (or I have created a little form to amend domains to header_checks):

http://www.postfix.org/header_checks.5.html

Code:

/^Subject:.*=\?(big5|euc-kr|ks_c_5601-1987|koi8)\?/ REJECT Spam not tolerated here  - hc 1
/^Subject: offizielle sieger/ REJECT Spam not tolerated here  - hc 2
/^Content-Type:.*charset="?(GB2312|big5|euc-kr|ks_c_5601-1987|koi8|iso-2022-jp)/ REJECT Spam not tolerated here  - hc 3
/^Subject: Sie haben gewonnen/ REJECT Spam not tolerated here  - hc 4

/@usa\.com/            REJECT Spam not tolerated here  - hc 1000
/@mail\.disatel\.com/          REJECT Spam not tolerated here  - hc 1001
/@cantv\.net/          REJECT Spam not tolerated here  - hc 1002
/@infotrading\.it/              REJECT Spam not tolerated here  - hc 1003
/@rafamt\.org/          REJECT Spam not tolerated here  - hc 1004

I also added some info: hc 1000 --> header_checks entry 1000 --> that makes it easier to find out by which rule an email was rejected.


All times are GMT +2. The time now is 13:53.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.