Block spam based on Subject or Body

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Post Reply
Vien
Posts: 2
Joined: Tue Sep 13, 2016 3:59 am

Block spam based on Subject or Body

Post by Vien »

Im using ZCS 8.5, and received many fishing email with subject "Re-Validate" which sent from Nigeria.
I did as this article: http[url]s://wiki.zimbra.com/wiki/Improving_Anti-spam_system[/url] but eveything dit not efficient.
Is there any way to block spam via Subject or Body ?
Thanks in advances !
dipeshmehta
Advanced member
Advanced member
Posts: 169
Joined: Sat Sep 13, 2014 1:18 am

Re: Block spam based on Subject or Body

Post by dipeshmehta »

Edit /opt/zimbra/conf/sa/sauser.cf and put something like this:

Code: Select all

header LocalFilterName Subject =~ /(re\-validate)/i
score LocalFiltername 12

body LocalFilterName2 /(click here to unsubscribe|unlist me|remove from mailing list)/i
score LocalFilterName2 4
Replace 'LocalFiltername' with anything you wish, put filter expressions as needed and apply score something higher than your threshold. Save file and restart mta & amavisd services:

Code: Select all

su - zimbra
zmmtactl restart && zmamavisdctl restart
Hope this helps
Vien
Posts: 2
Joined: Tue Sep 13, 2016 3:59 am

Re: Block spam based on Subject or Body

Post by Vien »

thank for you help.
I'wll revert the result after trying.
Dymx
Posts: 9
Joined: Wed Oct 18, 2017 9:17 am
Location: Russian Federation
ZCS/ZD Version: 8.8.9_GA_3798.FOSS
Contact:

Re: Block spam based on Subject or Body

Post by Dymx »

It is not worked for me in 8.8.9 FOSS.
I try edit /opt/zimbra/conf/salocal.cf.in
and /opt/zimbra/conf/sa/salocal.cf
How to solve same simple problem?
User avatar
Ghosto
Posts: 14
Joined: Tue Feb 19, 2019 12:45 am
Contact:

Re: Block spam based on Subject or Body

Post by Ghosto »

1. Uncomment line in /opt/zimbra/data/spamassassin/localrules/v310.pre
loadplugin Mail::SpamAssassin::Plugin::TextCat

2. use "zmprov mcf zimbraMtaBlockedExtensionWarnRecipient FALSE" from zimbra user.

3. create new file /opt/zimbra/data/spamassassin/localrules/myrules.cf with content like:

body MY_RULE_1 /sales/
score MY_RULE_1 2

body MY_RULE_2 /bitcoin/
score MY_RULE_2 1

after that, "zmmtactl restart && zmamavisdctl restart"

4. try to send mail to your account from external address with triggered words sales or bitcoin.
Open recieved email content (RMB - content) and try to find your tag MY_RULE in tests=

X-Spam-Status: Yes, score=4.202 required=4 tests=[ALL_TRUSTED=-1,
BAYES_40=-0.001, HTML_MESSAGE=0.001, JMQ_IPINFROM=2.5,
KAM_DMARC_STATUS=0.01, MISSING_MIMEOLE=1.899, RDNS_NONE=0.793]

+

You can change spam or block score rating in web administation UI. Web Admin - Configure - Global Settings - AS/AV



With that method, you can create your custom rules, that emails will be tagged. And score they will have. You can add like "5" for mark it spam or "999" to drop it. But be careful, do not drop any value emails.

Another problem, how to control that emails, drop it manually or redirect to another address? I already create another topic viewtopic.php?f=15&t=67423
Dymx
Posts: 9
Joined: Wed Oct 18, 2017 9:17 am
Location: Russian Federation
ZCS/ZD Version: 8.8.9_GA_3798.FOSS
Contact:

Re: Block spam based on Subject or Body

Post by Dymx »

Ghosto wrote:1. Uncomment line in /opt/zimbra/data/spamassassin/localrules/v310.pre
loadplugin Mail::SpamAssassin::Plugin::TextCat

2. use "zmprov mcf zimbraMtaBlockedExtensionWarnRecipient FALSE" from zimbra user.

3. create new file /opt/zimbra/data/spamassassin/localrules/myrules.cf with content like:

body MY_RULE_1 /sales/
score MY_RULE_1 2

body MY_RULE_2 /bitcoin/
score MY_RULE_2 1

after that, "zmmtactl restart && zmamavisdctl restart"

4. try to send mail to your account from external address with triggered words sales or bitcoin.
Open recieved email content (RMB - content) and try to find your tag MY_RULE in tests=
Thanks! I try to do this, but nothing changes :(
headers:
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=x required=5 WHITELISTED tests=[]
autolearn=unavailable
imanudin11
Outstanding Member
Outstanding Member
Posts: 304
Joined: Sat Sep 13, 2014 2:23 am
ZCS/ZD Version: Release 8.8.15.GA.3829.UBUNTU16.64
Contact:

Re: Block spam based on Subject or Body

Post by imanudin11 »

Vien wrote:Im using ZCS 8.5, and received many fishing email with subject "Re-Validate" which sent from Nigeria.
I did as this article: http[url]s://wiki.zimbra.com/wiki/Improving_Anti-spam_system[/url] but eveything dit not efficient.
Is there any way to block spam via Subject or Body ?
Thanks in advances !
Hello,
Please try this one : https://imanudin.net/2015/02/13/zimbra- ... ody-email/ :)
Blisk
Posts: 44
Joined: Tue May 21, 2019 7:47 am

Re: Block spam based on Subject or Body

Post by Blisk »

Is there a way to block mails regarding header or body text?
Because nothing of this works, I still get alot of spam.
User avatar
zimico
Outstanding Member
Outstanding Member
Posts: 225
Joined: Mon Nov 14, 2016 8:03 am
Location: Vietnam
ZCS/ZD Version: 8.8.15 P3
Contact:

Re: Block spam based on Subject or Body

Post by zimico »

Hello,
JDunphy has a very good and well explained wiki about howto write a spamassasin rule at https://wiki.zimbra.com/wiki/JDunphy-SA-RuleWriting
Best regards,
Minh.
Post Reply