0

We have an anti-spam system that sometimes create false-positives. When reported, we verify and whitelist the domains or IPs that have been wrongly triggered. However, I'd like to automate this by making a script that do the following when someones from our server sends a message:

-> if the sender is hosted on our server -> grab the sender and recipient -> type the command 'spfbl superwhite add "recipient@domain.tld>sender@domain.tld" '.

Its very important that the system filters only senders hosted on our cPanel servers (so we may use the /etc/localdomains file).. but I have no idea on how to start this.

Anyone have any ideas?

Much appreciated.

UPDATE

I've managed to do that with the script provided by kondybas with some changes:

Section: PREROUTERS
whitelister:
  driver    = accept
  domains    = !+local_domains
  condition = ${if match_domain{$sender_address_domain}{+local_domains}}
  transport = whlist
no_more

-

Section: TRANSPORTSTART
whlist:
  driver  = pipe
  command = /var/spool/exim/autoWH $local_part@$domain 

And the /var/spool/exim/autoWH file:

#!/bin/sh

# Debug:
echo "Args recebidos: \$1 = $1" >> /var/spool/exim/log-transport.log

# Magica:
/var/spool/exim/spfbl.sh white sender $1
####

Everything in exim owned folder so I dont have permissions problems.

Oops.. problem: using those parameters, exim is not delivering the mail as its trying to make a localdelivery: local delivery failed

  • Have you already configured SMTP authentication for clients from hosted domains? – Kondybas Jul 21 '16 at 17:38
  • Hi, yes, only authenticated mail is enabled on our server. – user366494 Jul 22 '16 at 19:07
  • What do you mean with sender is hosted on our server? Sender is local on your host? Or, maybe, sender is remote/authenticated but have return-path from domain hosted on our server? – Kondybas Jul 23 '16 at 9:23
  • I mean, every message local or remote/authenticated, or, every message legit being sent from users on my server.. – user366494 Jul 25 '16 at 12:44
0

Just add the router and transport like this:

begin routers
whitelister:
  driver    = accept
  domain    = !+local_domains
  condition = ${if inlist{$sender_address_domain}{+local_domains}}
  transport = whlist
  unseen

and transport:

begin transports
whlist:
  driver  = pipe
  command = spfbl superwhite add "$address_data > $sender_address_data"

UPDATE

The better approach is to invoke some shell script instead of direct utility invocation. At least you haven't restart exim each time you modify the script:

begin transports
whlist:
  driver  = pipe
  command = /path/to/script $address_data $sender_address_data

Then the script should be like this:

#!/bin/sh

# Debugging info:
echo "Received args are: \$1 = $1 and \$2 = $2" >> /path/to/transport.log

# The magic:
/path/to/spfbl superwhite add "$1 > $2"
####
  • Much appreciated! i'll try out!! – user366494 Jul 26 '16 at 19:18
  • May be you have to invoke spfbl via sudo because of permissions. In some cases you can set desired EUID directly in the transport: user = spbfl or similar. – Kondybas Jul 27 '16 at 8:29
  • Hi, thanks for help. Unfortunately, didn't worked the way I did: prntscr.com/byre5r and prntscr.com/byrfrf – user366494 Jul 28 '16 at 19:41
  • I changed the transport to this but it seems that it isnt being triggered: prntscr.com/bys1zv – user366494 Jul 28 '16 at 20:25
  • I've edit my answer – Kondybas Jul 29 '16 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.