Fixing excessive user whitelisting

Kerio® allows user created whitelists. The user simply adds addresses through their webmail interface, but internally rules are added to a "filter.siv" file in the Kerio mail store directory for that user.

A problem can arise when users whitelist people within their own organization. That's usually unnecessary because spam tests are normally not applied to "trustworthy relay agents" - in otherwords, the people who you allow to send email outside of your own domain. The "Enable rating of messages sent from trustyworthy relay agents" is NOT checked, which means that email sent by those users will not be processed by the spam filtering.

Further, local networks are also automatically whitelisted from and RBL blocking (not that these ever should be on RBL's anyway).

If users do add other users to their filter.siv whitelist, it would not matter unless outside spammers are sending mail impersonating as local users - if they do this and the user they impersonate is in the filter.siv file's whitelist, the message won't be seen as spam no matter how spammy it is!

One way to avoid some of that impersonation is to use Caller-ID and/or SPF for your own domain. You would then set the Invalid Action (in Content Filter->Spam Filter) to Add Spam Score to email that fails these tests.

However, that still leaves you with the problem of the filter.siv file. You could ask people to clean up their files, but if that's not likely to be done, you may need to do something about it yourself.

One thought would be to overwrite each user's filter.siv with a fresh and basically empty version. You can obtain one easily enough: simply create a new user, snag their filter.siv file and copy it to other users. However, that also wipes out vacation settings and any other rules they may have - it's drastic action.

A Perl script

It's possible to write a Perl script to only remove certain addresses. I wrote such a script, and accidentally introduced an error which caused people to get messages like this:

Hello,

The following error occured in your mail sorting script on mail server 
at mail.xxx.com:

line 2: Bad token: string expected

All your mail will be delivered to your INBOX folder until you fix the error.
 

I had to quickly write another script to fix those errors - we had done some testing, but were not rigorous enough.

I THINK the following script will work correctly. You'd need to adjust the STORE directory and of course the domain name(s) you want removed. My concern is that there may be some examples of filter.siv where this script could fail - you'd need to check thoroughly and be prepared to revert if there is something I did not think of.

#!/usr/bin/perl
$STORE="/opt/kerio/mailserver/store/mail/aplawrence.com";
chdir($STORE) or die "No $store!\n";
opendir(DIR,".") or die "Can't open $store";
while (defined($file=readdir(DIR))) {
  if (open(SIV, "$file/filter.siv" )) {
  @stuff=<SIV>; close SIV;
  open(ORIG,">$file/filter.ORIG");
  open(SIV,">$file/filter.siv");
  foreach (@stuff) {
    print ORIG;
    if (/spamtest, not address :all :is "From"/) {
      s/"[^ ]*yourdomain.com", *//g;
      s/\[ *"[^ ]*yourdomain.com", */\[/g;
      s/, * "[^ ]*yourdomain.com"]/\]/g;
    }
    print SIV;
   
  }
}
}
 

If you do find conditions where this fails, please let me know and we'll post fixes here.

Comments?

More Articles by Anthony Lawrence - Find me on Google+

My Unix/Linux Troubleshooting Book

My Hard Truths about Easy Money Book

My Self Employment Book

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here