Block spam based on Subject or Body

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Vien
Posts: 2
Joined: Tue Sep 13, 2016 3:59 am

Block spam based on Subject or Body

Postby Vien » Fri Mar 09, 2018 9:09 am

Im using ZCS 8.5, and received many fishing email with subject "Re-Validate" which sent from Nigeria.
I did as this article: https://wiki.zimbra.com/wiki/Improving_Anti-spam_system but eveything dit not efficient.
Is there any way to block spam via Subject or Body ?
Thanks in advances !


dipeshmehta
Advanced member
Advanced member
Posts: 169
Joined: Sat Sep 13, 2014 1:18 am

Re: Block spam based on Subject or Body

Postby dipeshmehta » Fri Mar 09, 2018 12:32 pm

Edit /opt/zimbra/conf/sa/sauser.cf and put something like this:

Code: Select all

header LocalFilterName Subject =~ /(re\-validate)/i
score LocalFiltername 12

body LocalFilterName2 /(click here to unsubscribe|unlist me|remove from mailing list)/i
score LocalFilterName2 4

Replace 'LocalFiltername' with anything you wish, put filter expressions as needed and apply score something higher than your threshold. Save file and restart mta & amavisd services:

Code: Select all

su - zimbra
zmmtactl restart && zmamavisdctl restart


Hope this helps
Vien
Posts: 2
Joined: Tue Sep 13, 2016 3:59 am

Re: Block spam based on Subject or Body

Postby Vien » Mon Jun 11, 2018 4:32 am

thank for you help.
I'wll revert the result after trying.
Dymx
Posts: 9
Joined: Wed Oct 18, 2017 9:17 am
Location: Russian Federation
ZCS/ZD Version: 8.8.9_GA_3798.FOSS
Contact:

Re: Block spam based on Subject or Body

Postby Dymx » Tue Dec 03, 2019 1:16 pm

It is not worked for me in 8.8.9 FOSS.
I try edit /opt/zimbra/conf/salocal.cf.in
and /opt/zimbra/conf/sa/salocal.cf
How to solve same simple problem?
User avatar
Ghosto
Posts: 14
Joined: Tue Feb 19, 2019 12:45 am
Contact:

Re: Block spam based on Subject or Body

Postby Ghosto » Tue Dec 03, 2019 11:33 pm

1. Uncomment line in /opt/zimbra/data/spamassassin/localrules/v310.pre
loadplugin Mail::SpamAssassin::Plugin::TextCat

2. use "zmprov mcf zimbraMtaBlockedExtensionWarnRecipient FALSE" from zimbra user.

3. create new file /opt/zimbra/data/spamassassin/localrules/myrules.cf with content like:

body MY_RULE_1 /sales/
score MY_RULE_1 2

body MY_RULE_2 /bitcoin/
score MY_RULE_2 1

after that, "zmmtactl restart && zmamavisdctl restart"

4. try to send mail to your account from external address with triggered words sales or bitcoin.
Open recieved email content (RMB - content) and try to find your tag MY_RULE in tests=

X-Spam-Status: Yes, score=4.202 required=4 tests=[ALL_TRUSTED=-1,
BAYES_40=-0.001, HTML_MESSAGE=0.001, JMQ_IPINFROM=2.5,
KAM_DMARC_STATUS=0.01, MISSING_MIMEOLE=1.899, RDNS_NONE=0.793]

+

You can change spam or block score rating in web administation UI. Web Admin - Configure - Global Settings - AS/AV



With that method, you can create your custom rules, that emails will be tagged. And score they will have. You can add like "5" for mark it spam or "999" to drop it. But be careful, do not drop any value emails.

Another problem, how to control that emails, drop it manually or redirect to another address? I already create another topic https://forums.zimbra.org/viewtopic.php?f=15&t=67423
Dymx
Posts: 9
Joined: Wed Oct 18, 2017 9:17 am
Location: Russian Federation
ZCS/ZD Version: 8.8.9_GA_3798.FOSS
Contact:

Re: Block spam based on Subject or Body

Postby Dymx » Wed Dec 04, 2019 1:23 pm

Ghosto wrote:1. Uncomment line in /opt/zimbra/data/spamassassin/localrules/v310.pre
loadplugin Mail::SpamAssassin::Plugin::TextCat

2. use "zmprov mcf zimbraMtaBlockedExtensionWarnRecipient FALSE" from zimbra user.

3. create new file /opt/zimbra/data/spamassassin/localrules/myrules.cf with content like:

body MY_RULE_1 /sales/
score MY_RULE_1 2

body MY_RULE_2 /bitcoin/
score MY_RULE_2 1

after that, "zmmtactl restart && zmamavisdctl restart"

4. try to send mail to your account from external address with triggered words sales or bitcoin.
Open recieved email content (RMB - content) and try to find your tag MY_RULE in tests=

Thanks! I try to do this, but nothing changes :(
headers:
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=x required=5 WHITELISTED tests=[]
autolearn=unavailable
imanudin11
Outstanding Member
Outstanding Member
Posts: 297
Joined: Sat Sep 13, 2014 2:23 am
ZCS/ZD Version: Release 8.8.15.GA.3829.UBUNTU16.64
Contact:

Re: Block spam based on Subject or Body

Postby imanudin11 » Mon Dec 09, 2019 4:52 am

Vien wrote:Im using ZCS 8.5, and received many fishing email with subject "Re-Validate" which sent from Nigeria.
I did as this article: https://wiki.zimbra.com/wiki/Improving_Anti-spam_system but eveything dit not efficient.
Is there any way to block spam via Subject or Body ?
Thanks in advances !

Hello,
Please try this one : https://imanudin.net/2015/02/13/zimbra- ... ody-email/ :)
Blisk
Posts: 37
Joined: Tue May 21, 2019 7:47 am

Re: Block spam based on Subject or Body

Postby Blisk » Fri Jan 31, 2020 1:20 pm

Is there a way to block mails regarding header or body text?
Because nothing of this works, I still get alot of spam.
User avatar
zimico
Advanced member
Advanced member
Posts: 187
Joined: Mon Nov 14, 2016 8:03 am
Location: Vietnam
ZCS/ZD Version: 8.8.15 P3
Contact:

Re: Block spam based on Subject or Body

Postby zimico » Fri Jan 31, 2020 2:15 pm

Hello,
JDunphy has a very good and well explained wiki about howto write a spamassasin rule at https://wiki.zimbra.com/wiki/JDunphy-SA-RuleWriting
Best regards,
Minh.

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 10 guests