adding filtering by subject / attachment filename/ recipient ?

[fgilain]

Hi all,

Plesk 7.5.4 under Red hat ES3.0

Is there a way to add a way to filter emails depending on :

1) Known spam mails recipients of my domain (exemple : [email protected] that doesn't exists but is often tested by spam emails robots...)

2) known subjects

3) known "at the moment" virus/spam attachment filename ?

NB : my goal is to log all of the deleted emails somewhere in case where...i should have to debug a detectino error...

thanks, i really am afraid of breaking something ;-((

NB : for the moment, when someone sends an email to an unexistent mailbox, i have a catchall account with a message sent to sender, i suppose that i should sto psending a message and use this message to catch all this spam based on subject content/sender rule from me ?

Florent

 

[fgilain]

up ;-))

 

[ShadowMan@]

Originally posted by fgilain
1) Known spam mails recipients of my domain (exemple : [email protected] that doesn't exists but is often tested by spam emails robots...)

2) known subjects

3) known "at the moment" virus/spam attachment filename ?

NB : my goal is to log all of the deleted emails somewhere in case where...i should have to debug a detectino error...

thanks, i really am afraid of breaking something ;-((

NB : for the moment, when someone sends an email to an unexistent mailbox, i have a catchall account with a message sent to sender, i suppose that i should sto psending a message and use this message to catch all this spam based on subject content/sender rule from me ?

Florent

Non-existent users: You can set the domain - mail - preferences 'Mail to nonexistent user' for 'Reject', definitely do NOT use the 'Bounce' option. Ah, but you want to keep copies for reviewing later, so Reject won't work for you.

I would recommend you install/configure/use the qmail-scanner package from ART (atomicrocketturtle.com)

Using a catchall (do not send message to sender!) is fine for keeping copies of mails for reviewing later.

Use RulesDuJour for Spamassassin, this for your #2, #3 above.

Also for #3 above, if you are using DrWeb, I would recommend trashing it and using clamav instead. I personally like to use both clamav and odieavir for antivirus, along with spamassassin (with RulesDuJour), qmail-scanner, etc.

Definitely stop sending a message to the sender...

As to 'breaking things', there is never any guarantee, but when making changes, if they are planned and installed properly, there is usually no 'breakage'. Depends on your level of expertise as a linux admin.