Block specific subject line?

[ViAdCk]

Hello:

Some of our servers have been abused sending spam through smtp. All the spam mails have the same subject. Is it possible to create some kind of filter in the exim.conf file in order to block all outgoing mail with a specific subject line? This way we can easily block this kind of automatic spam from our servers.

Thanks!

 

[scsi]

Well how are they sending spam from your server. You should only be allowing authenticated relaying. You should check your logs to see if you can find out who is abusing your server.

 

[nobaloney]

By default DirectAdmin's included exim.conf file, and my latest SpamBlocker Technology exim.conf files, do not allow unauthenticated relaying. However you can inadvertently open holes in the authentication system:

If you whitelist a domain, that domain can relay through your server. If you whitelist a sender, that sender can relay through your server.

You should be very careful with your whitelists.

Jeff

 

[ViAdCk]

Spam is being sent through a valid email account. There appers to be an exploit in some email programs which causes this issue. We can't rely on our customers because to have all their computer software up-to-date hence we need preventive measures on our servers.

This hasn't got much to do with the original question though. Is there an option to block emails based on the subject line?

 

[floyd]

Use the exim system filter.

 

[nobaloney]

We can't rely on our customers because to have all their computer software up-to-date hence we need preventive measures on our servers.

This hasn't got much to do with the original question though. Is there an option to block emails based on the subject line?

This of course is only going to work as long as the spammer never changes the subject line.

I believe the only way to do this would be by writing custom code in the exim filter. But you can certainly check exim documentation for the exim.conf file to see if there's a way to do it there. A quick google returns nothing applicable.

Jeff

 

[floyd]

In the exim system filter usually located at /etc/system_filter.exim

if

        $header_subject: contains "Spammer subject line"

then

        seen finish

endif