Questions tagged [filter]
Usually related with text filtering of some kind, like logs. This may also refer to email filtering. Note that there are other tags that are more appropriate for network and spam filtering.
184
questions
0
votes
0
answers
22
views
How to assign filtered column data to a variable using Set in VBA excel?
I am newbie to VBA excel. I am trying to use Set to assign some data from a filtered column (through AutoFilter) to a variable (X in this case). Below shows the code and image of the table.
Sub Test()
...
0
votes
0
answers
7
views
Reordering Apache Output Filters
Is there a way to reorder the output filters for Apache 2.4? I am forced to use something like this because DEFLATE runs before SUBSTITUTE:
AddOutputFilterByType INFLATE;SUBSTITUTE;DEFLATE text/html
(...
- 111
0
votes
1
answer
79
views
Nexus docker repository - anonymous access to selected artefacts
Use case: allow to pull selected (e.g. tagged as *-public) Docker Images anonymously. Otherwise credentials are required.
Given: latest Nexus 3.52.0, it works with a docker login and LDAP credentials ...
0
votes
0
answers
76
views
apply header check for specific machine (IP)
I'm new to postfix (and also linux world)
My goal is to add a custom subject for a different machine (IP) who contacts my relay.
I use header_check to replace the subject of mails and it works but for ...
- 1
0
votes
0
answers
110
views
Fail2ban make a custom fail regex filter for Nginx error log
I am new to regex. How do I write a Fail2Ban filter to match with these nxinx error log lines?
2022/11/30 00:46:19 [crit] 57811#57811: *8911 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:...
0
votes
0
answers
94
views
Filter report in PDQ based on number of application versions
I have a semi-large user base (approx 600 clients), all of them with standardized and individual applications. We manage most of the software with PDQ, but users are allowed to install their own ...
- 137
0
votes
0
answers
28
views
Is it possible to configure default email filters for users?
We have about 500 students and 50 personel. We use Outlook email.
Students and personel have different domains. Students' domain contains "edu." but personels domain doesn't.
Is it possible ...
- 141
2
votes
1
answer
42
views
How to skip a message matching a certain pattern if it repeats more often than a limit?
Is it possible to stop a matching message if it appears more frequently than a given limit? I'd like to achieve something like this:
if $programname == "foo" and
$msg contains "bar&...
- 581
0
votes
0
answers
35
views
Postfix, bounce per-RCPT based on mail content
With Postfix, is it possible to manually or otherwise bounce messages per-RCPT based on the mail content body (e.g. RFC5322.From headers).
For example,
Mail with 5 RCPT TO envelope headers is queued
...
- 141
23
votes
3
answers
10k
views
What is the difference between 0.0.0.0/0 and 0.0.0.0/1?
In the history, I mostly used 0.0.0.0/0 for "match every IP address". Recently, I saw a 0.0.0.0/1 subnet filter.
What is the difference between 0.0.0.0/0 and 0.0.0.0/1 and what's the ...
- 351
1
vote
2
answers
211
views
What Ansible filter can I use on 'hostvars' to extract string?
"{{ hostvars['DUMMY_HOST']['iosengineID'] }}"
value returns this
{'msg': [['80000009045B575A5032333331303055565D']], 'failed': False, 'changed': False}
Which filter can I use extract or ...
- 11
1
vote
1
answer
67
views
Could someone please explain the difference between these expressions
drop proto tcp and not (dst port 80)
pass proto tcp and dst port 80
Is there a difference between them?
- 13
2
votes
2
answers
253
views
rsync all pdfs except in certain directories?
I'm trying hard to understand the rsync filter system, and it's completely baffling me.
I have the following "test" directory structure to try to make sense of it. With no filter options ...
- 131
1
vote
1
answer
808
views
Create own filter for fail2ban fails
I'm playing around with fail2ban in kubernetes. For that I created a pod that creates fake log messages: 2021-08-04 18:33:13 Authentication failed 15.15.15.15 I created a custom filter, to test if ...
- 111
0
votes
3
answers
164
views
Tag External Emails from NEW external addresses
We work with a giant company that prepends an email tag to every externally originating (to them) email that goes something like:
"Warning, this email originated outside your organization - don't ...
1
vote
0
answers
104
views
LVM filter does not stop when rule matches?
I have a problem with a lvm filter configuration.
I want to filter out certain devices/partitions from lvm scan. I can do it by making filter like so:
filter = ["a|/dev/disk/by-partuuid/<uuid&...
- 121
1
vote
0
answers
186
views
How to replace multiple letters in an variable in Sieve?
I want to use my catch-all-email to put emails in their corresponding folders. So if I were to sign up for twitter I'd use twitter@example.com.
Currently I have this script:
if address :matches ["...
- 11
0
votes
1
answer
81
views
Compare url link and url text in email body and reject as SPAM
Email body:
... <a href="url">text</a> ...
Is it possible check if text is url in email body, then compare url and text and reject as SPAM if they differ?
0
votes
1
answer
2k
views
rsyslog single filter conditional syntax
I'm looking for a way to write a single rule with multiple match values, don't write those rows to logfile if the message contain first word or second word.
This works but isn't DRY:
if $msg contains &...
- 131
1
vote
1
answer
2k
views
Fail2ban how to configure custom fail regex filter
I am running fail2ban on Debian 9 and am trying to create a custom filter to ban an ip after 4 failed attempts. Can someone help to figure out what I need to put in filter.d and jail.conf in order ...
- 13
1
vote
1
answer
467
views
Allow certain users to only send emails to specific domains
I have an email server with several domain and users.
I need block certain users from sending emails, but allow them to email specific domains.
Example:
user@domain.com block all outgoing emails ...
- 11
0
votes
1
answer
157
views
Postfix: processing incoming mail for virtual user
This discussion on Dovecot ML suggests to use for filtering mail for foo user foo: | /path/to/the/external/program in /etc/aliases. But aliases work only for local user. How to filter with script mail ...
- 288
0
votes
1
answer
795
views
Powershell Select-String on a File Adds Unwanted Metadata
I'm trying to filter out service accounts in a file containing user accounts, one per line:
"svc.test"
"test.user"
"test.user2"
Select-String adds unwanted metadata:
C:\...
- 77
0
votes
1
answer
39
views
Spam filtering based on average ascii score
I'm trying to come up with a new spam filter based on what has been coming through our filter lately. A lot of the messages have subject lines like: "Re: ᴢᴀɴᴛᴀᴄ 【ʜᴀs】 ʙᴇᴇɴ ʟɪɴᴋᴇᴅ 【ᴛo】 ᴄᴀɴᴄᴇʀ&...
2
votes
0
answers
938
views
Using tc to delay packets to several ports
After reading several pages like this this and without having a really deep knowledge about the kernel Linux, I am able to filter up to 3 ports using just the three first leaves of the tree.
tc qdisc ...
- 71
2
votes
0
answers
642
views
TC Filter With BPF and NFTables Packet Marking
I made a TC BPF ingress program and I want it to process specific packets only marked by NFTables. Here's my NFTables table that marks the specific packets:
table ip compressor_tc {
chain ...
0
votes
2
answers
2k
views
How to write a complex filter in tomcat web.xml to accept partially a URL?
I am new to tomcat and I need to filter the URLs on a server to accept all clients for some URLs and accept only a specific IP for other URLs.
In details, I want to accept ALL clients for for this ...
- 3
0
votes
0
answers
230
views
how to apply TC htb class to each of IPs in an IP range separately?
I use HTB for TC and mark packets with iptables. First I mark a range of IPs (like 192.168.1.0/24). Now I want to apply a htb class to each of these IPs separately. If I add a class and a filter for ...
0
votes
1
answer
204
views
How to filter by status information column in Thruk
I am using Thruk as a monitoring interface. At the top left corner of the page there is a button which opens a stack with filters of which hosts/services etc. you want to apply.
You can easily add ...
- 296
0
votes
1
answer
4k
views
Microsoft AD - Negative OU= LDAP filter
I am trying to produce a LDAP Filter for MS AD which filters users based on some OUs (in my case excluding a specific OU but also including does not work):
(&(cn=Testuser1)(|(ou:dn:=Included1)(ou:...
- 845
1
vote
1
answer
547
views
Spamassasin rule to flag certain MX IPs
I've noticed a flood of spam that is related to the same range of IPs.
All the spam email has different HTML text (which is english but meaningless) and a few embedded pictures (which I block) but ...
- 368
0
votes
1
answer
239
views
Filter ss process output without using grep
ss -p can give the process name, process id (PID) and the file descriptor associated with the connection.
Example: ss -tuanp
[...]
tcp ESTAB 0 0 x.x.x.x:59594 x.x.x.x:993 users:(("...
- 291
0
votes
1
answer
2k
views
Not logic in docker filter
I have a named container that may or may not be up and if it is up I want to be able to kill all the containers but that one by name.
Basically what I want is:
docker kill $(docker ps -aq --filter="...
- 123
0
votes
0
answers
90
views
Why can't block specified string with iptables command?
I want to block any packages flow into my pc which contains the string porn.
iptables -A INPUT -m string --algo bm --string "porn" -j DROP
Open my firefox and iniput keyword porn in google search ...
- 337
0
votes
1
answer
115
views
tc filter ... ht HANDLE ... does not allow buckets of 8 bits
TC-u32 man page states that HANDLE is:
HANDLE := { u12_hex_htid:[**u8_hex_hash:[u12_hex_nodeid]** | 0xu32_hex_value }
so the size of the bucket should range from 0x00 to 0xff as it is a u8 value.
...
- 11
0
votes
1
answer
129
views
How to configure postfix/dovecot setup to reject certain mail for certain users/accounts
I'd like to be able to reject email from certain users or if it contains certain strings or if the title matches something for certain users.
I'm in a multidomain enviroment.
Is this possible? ...
0
votes
1
answer
416
views
exim filter not working on long emails
I was trying to set a file extension based filter in exim.
if
$message_body contains "pdf.gz"
or $message_body contains "pdf.arj"
This filter does work on small mail, such as mail with only test ...
0
votes
1
answer
284
views
Is it possible to redirect DNS quries to different URL/DNS like opendns
I have an unbound DNS Resolver in my office lab. I m using this service to block ads and unwanted domains.
Is there any possibilities to redirect DNS quires to a specific URL/DNS that shows the site/...
- 81
1
vote
1
answer
2k
views
How to debug Mikrotik bridge filter forward rules not having any effect?
As part of diagnosing a different problem were trying to add a bridge filter rule that will stop all traffic from forwarding between two interfaces on a bridge.
The router has two interfaces ether1 ...
- 3,239
0
votes
1
answer
223
views
fail2ban filter matches no lines for xmlrpc attack
I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form
[Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
0
votes
1
answer
571
views
exim filter regex discard rule
We are trying to discard all emails with a matching subject, example of subject:
Subject: DOMAIN.COM Alert: NAME We have NOT received your payment
We are trying to match any domain, Alert, and "We ...
- 77
0
votes
1
answer
894
views
Apply Network Filter to Ovirt Guest without Rebooting
I am trying to change the clean-traffic IP address for a oVirt Guest VM.
It works as long as I reboot the VM. ( Changed from within the Guest Virtual Machine Network Settings )
But for a production ...
- 133
0
votes
1
answer
632
views
Exim filter - Matching FROM and TO
I have been receiving a lot of mailer-daemon spam lately ... It's obvious the spammer is spoofing the to & from fields so that mailer-daemon kicks in and delivers the actual message to me.
I ...
- 1
1
vote
1
answer
372
views
fail2ban filter for common apache exploits
Every day I see hackers/script kiddies looking for url's like:
/webdav
/site.tar
/admin
/htdocs.php
etc. They sometimes hit my sites for several minutes looking for common exploits. Is there a ...
- 1,674
0
votes
1
answer
2k
views
Get mac address based on ip in filter wireshark
i am a test engineer writing some test cases.
I am trying to write a test which has to be performed in wireshark.
However, my collegues aren't that "into wireshark" and i would like to keep it as ...
- 101
0
votes
1
answer
378
views
Exim filter TLD block is blocking more than just the TLD
Need to discard emails to and from ending in a specific TLD but having an issue, example of a filter:
if first_delivery
and ("$h_to:, $h_cc:" contains ".win$")
or ("$h_from:" contains ".win$")
then
...
- 77
2
votes
1
answer
912
views
tc/netem filter explenation
Iam new to tc and i find it mighty confusing, i was able to find and bit understand little command flow, to issue delay on specific IP, but i dont tink it works properly - delaying all traffic ...
- 93
0
votes
1
answer
398
views
Filter log for a location but allow passing request to proxy
I know how to filter logs for a location:
# inside a http block
log_format filter '0.0.0.0 - $remote_user [$time_local] "$request"'
'$status $body_bytes_sent '
'"$...
- 477
1
vote
1
answer
323
views
Filtering dpkg logs in syslog-ng
I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
- 121
1
vote
1
answer
57
views
Fold burst of many emails into one?
We are running an SGE job scheduling system. Users can let SGE send out emails in case of jobs being cancelled. In the case of a user having large array jobs (say 100'000k entries) and killing all of ...
- 111