Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Spam Zimlet

  1. #1
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default Spam Zimlet

    If you were going to create a spam management Zimlet how would it behave? Please post your Ideas here, maybe we can get one built.

    I have posted a feature request in the bugzilla for an admin Zimlet for editing config files, please vote for it.

    http://bugzilla.zimbra.com/show_bug.cgi?id=14337
    EricX

  2. #2
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default Pie in the Sky

    Data base whitelisting

    We have all of your contacts in a central database with email addresses, we use dotProject but many are using SugarCRM. What if the whitelist could be auto generated form that database. In the zimlet under whitelist just point to a mysql data base, with fields for database, table, and fields, or even a simple sql query box. But' I'm sure this would take more backend programming.
    Last edited by Ericx; 02-05-2007 at 10:22 AM.
    EricX

  3. #3
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default Limit by domain extensions

    Limit top level domains to
    .com
    .net
    .gov
    .uk
    EricX

  4. #4
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default Mime Scanning

    Mime parsing.
    Using show all from Zimbra web client shows the attachment serialized as text.

    Can that text be processed?

    If I were to copy and paste the first 50 characters of that attachment and add a rule that if a serialized mime type matches this string, score it as 5 or 10, something high. I think this would be much more efficient than OCR filtering.

    We are getting spam that has one embeded image that is exactly the same, but the from, to, and body text is always changing. The image is the common variable.

    I think greylisting may filter it out, but I'd like to be able to do some parsing and scoring of mime attachments.
    Last edited by Ericx; 02-05-2007 at 10:21 AM.
    EricX

  5. #5
    Join Date
    Feb 2007
    Posts
    33
    Rep Power
    8

    Post Ocr

    Quote Originally Posted by Ericx View Post
    Mime parsing.
    If I were to copy and paste the first 50 characters of that attachment and add a rule that if a serialized mime type matches this string, score it as 5 or 10, something high. I think this would be much more efficient than OCR filtering.

    We are getting spam that has one embeded image that is exactly the same, but the from, to, and body text is always changing. The image is the common variable.
    We have been getting spam that the from, to, and body text is always changing -- along with the image. Using a PHP package such as gd, it's pretty easy to randomly change images... just the same way that a lot of websites have you type in the letters you see in an image. They are doing the same thing with spam because computers have a hard time reading the image.

    Anyway -- I'm just saying that we get spam where the image is changing slightly as well -- so the solution may have to be a little more robust.

    It's only a matter of time before the spammers figure out that they just need to send the same message 10 minutes later to get around greylisting as well.

  6. #6
    Join Date
    Dec 2005
    Posts
    94
    Rep Power
    10

    Default Contacts

    I would like to see a whitelist generated from the Contacts and Emailed Contacts. or the other way around, have incoming email checked against the live Contacts and Emailed Contacts.

    This way the end user doesn't have to be trained how to flag or whitelist (learning to use the Junk/Not Junk button is hard enough for some).

    Also to have a contact whitelisted for the everyone in that same domain and not just for the single user with the contact.

  7. #7
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default Rules and PM upload

    Rules Editor and a PM upload.

    If we find a rule on the web that we like, we can
    1. upload the rule
    2. upload the .pm file to /zimbra/zimbramon/lib/Mail/SpamAssassin/Plugin - I think this is the correct location, please correct me if I'm wrong

    3. Maybe even edit the rule files.
    Last edited by Ericx; 02-05-2007 at 12:30 PM.
    EricX

  8. #8
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default amavisd.conf.in

    /opt/zimbra/conf/amavisd.conf.in

    Whitelist and some other scoring settings.

    The zimlet may have to start and stop the service after the file is edited.
    zmamavisdctl stop; zmamavisdctl start

    We need to add this to the list of files that the editor can edit.

    Note: If the amavisd.conf is edited directly it's overwritten at some point. I'm not sure of the trigger for overwriting, maybe upgrade or restart of service. But it gets overwritten.
    Last edited by Ericx; 02-05-2007 at 02:40 PM.
    EricX

  9. #9
    Join Date
    Feb 2007
    Posts
    33
    Rep Power
    8

    Thumbs up Good idea!

    Quote Originally Posted by brained View Post
    I would like to see a whitelist generated from the Contacts and Emailed Contacts. or the other way around, have incoming email checked against the live Contacts and Emailed Contacts.

    This way the end user doesn't have to be trained how to flag or whitelist (learning to use the Junk/Not Junk button is hard enough for some).

    Also to have a contact whitelisted for the everyone in that same domain and not just for the single user with the contact.
    I agree with all of these suggestions.
    Whitelisted contacts per domain if they are in anyone's address book (or at least that option) is useful for many companies/organizations. It wouldn't work so well for a school campus -- so maybe allow that to be turned on/off.

  10. #10
    Join Date
    Jul 2006
    Location
    Virginia Beach, VA
    Posts
    97
    Rep Power
    9

    Default Bugzilla post

    I made a post to bugzilla, the answer I got made me chuckle. I did not communicate very well. Iņigo Martinez clarified things a bit better.

    http://bugzilla.zimbra.com/show_bug.cgi?id=14337
    EricX

Similar Threads

  1. Replies: 21
    Last Post: 02-04-2010, 10:06 AM
  2. Replies: 5
    Last Post: 01-11-2008, 05:34 AM
  3. Replies: 13
    Last Post: 07-20-2007, 04:21 AM
  4. Domain Admin Error: Permission Denied
    By shanson in forum Administrators
    Replies: 3
    Last Post: 05-29-2007, 06:48 AM
  5. Post instsallation problems
    By Assaf in forum Installation
    Replies: 14
    Last Post: 01-29-2007, 11:38 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •