Solved

Block cyrillic emails in sendmail

Posted on 2009-07-13
3
850 Views
Last Modified: 2013-12-18
Hi,
I have a linux mailserver (CentOS 5.3) with sendmail, I use DNS blacklisting for filtering spam and clamav-milter for viruses. The level of spam is ok with the exception of a few users that receive around 50-100 spam messages/day and all of them in koi8-r encoding (it's cyrillic characters). I need a simple method of blocking or rejecting emails written in cyrillic characters if possible without applying other antispam rules.

Thank you
0
Comment
Question by:aligigi
3 Comments
 
LVL 26

Accepted Solution

by:
jar3817 earned 500 total points
ID: 24961430
Without applying other antispam rules? I don't think so. The only thing I can think of is to use a milter like mimedefang (http://mimedefang.org) and test for the encoding of the body in the filter() section.

This site has an example using the subject instead of the body:
http://lists.roaringpenguin.com/pipermail/mimedefang/2009-April/034698.html

This is not for the faint-of-heart and you really need to know some perl, or be able to figure it out.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 25374021
Not sure about how to do this with sendmail, but if you had Vamsoft ORF (www.vamsoft.com), then you could do this easily.  I use this amongst it's other features and so far in 19 days, have had Zero spam.
It is very well priced too and I am now recommending this to all my customers.
0
 
LVL 3

Author Comment

by:aligigi
ID: 25435650
Hi,
I finally resolved it, I tried simpler solutions, none worked so in the end I used mimedefang. I installed mimedefang using yum, I added the following line to sendmail.mc:
INPUT_MAIL_FILTER(`mimedefang', `S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=T, T=C:30m;S:30m;R:30m;E:30m')
and I added this to mimedefang-filte in the filter procedurer:
    $head = $entity->head;
    $charset = $head->mime_attr("content-type.charset");
    if (defined($charset)) {
      $charset =~ tr/A-Z/a-z/;
      if ($charset eq "koi8-r" or
          $charset eq "euc-kr" or
          $charset eq "koi8-u" or
          $charset eq "3deu-kr" or
          $charset eq "windows-1251") {
          syslog('alert',"MIMEDefang rejected an E-Mail using charset $charset");
         
          return action_bounce("CONTENT VIOLATION: Mail using character set $charset not accepted here");
          }
    }
I had some problems with mimedefang not finding the antivirus (I use clamav) so I commented out that part of the code since I use clamav-milter directly in sendmail.mc.
Thanks for the help.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There was an incident about the POP3 issue for the double read receipts and delivery receipts in Exchange 2013.  There was huge research been done and found solution for the duplicate mails. Especially when the user gets  duplicate mails.
Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question