Using MCP to block offensive content

Questions and answers about how to do stuff
Post Reply
User avatar
shawniverson
Posts: 2611
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Using MCP to block offensive content

Post by shawniverson » 25 Jan 2014 15:58

(Outdated as of 9/3/16 -- MailScanner recommends using Spamassassin instead of MailScanner MCP for content scanning)

Sometimes, despite all the efforts to thwart spam, a message with offensive content will slip through.

You can use Message Content Protection to thwart these emails. You can also delete them completely so that they do not appear at all.

By default, MCP is disabled. Here's an example configuration.

To enable, edit the following lines

/etc/MailScanner/MailScanner.conf

Code: Select all

First Check = mcp
MCP Checks = yes

MCP Actions = store-mcp 
High Scoring MCP Actions = store-mcp
Rules are stored in /etc/MailScanner/mcp

Remove the example file

Code: Select all

rm /etc/MailScanner/mcp/10_example.cf
Create your ruleset, for example
/etc/MailScanner/mcp/10_offensive.cf

Code: Select all

header   OFFENSIVE_RULE1    Subject =~ /sexy/i
describe OFFENSIVE_RULE1    Banned Subject sexy
score    OFFENSIVE_RULE1    5

body     OFFENSIVE_RULE2    /sexy/i
describe OFFENSIVE_RULE2    Banned body text sexy
score    OFFENSIVE_RULE2    5
Add rules as needed and adjust scores accordingly

Reload MailScanner

Code: Select all

service MailScanner reload
Version 3.0.2.6 released! Update now to keep your eFa secure!

buzzzo
Posts: 94
Joined: 03 Feb 2014 09:09

Re: Using MCP to block offensive content

Post by buzzzo » 13 Feb 2014 10:17

Works but if i try to release from quarantine the mail is not delivered to mailbox as with other blocked stuff (like spam)

User avatar
shawniverson
Posts: 2611
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Re: Using MCP to block offensive content

Post by shawniverson » 13 Feb 2014 15:40

Change the following and reload mailscanner:

Code: Select all

Is Definitely Not MCP = &SQLWhitelist
Version 3.0.2.6 released! Update now to keep your eFa secure!

buzzzo
Posts: 94
Joined: 03 Feb 2014 09:09

Re: Using MCP to block offensive content

Post by buzzzo » 13 Feb 2014 16:07

Thx it works.

microcore
Posts: 7
Joined: 10 Mar 2014 20:51

Re: Using MCP to block offensive content

Post by microcore » 20 Mar 2014 11:14

When the MCP active in the EFA did not deliver the mail ....
Because I happen?

thanks

User avatar
shawniverson
Posts: 2611
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Re: Using MCP to block offensive content

Post by shawniverson » 20 Mar 2014 22:16

When an email is flagged as MCP, it is set to store-mcp in this example but not deliver the mail.

Is this what is happening? Or is all mail not being delivered?
Version 3.0.2.6 released! Update now to keep your eFa secure!

DemonRok
Posts: 25
Joined: 02 Apr 2014 06:26

Re: Using MCP to block offensive content

Post by DemonRok » 03 Apr 2014 08:46

shawniverson wrote:When an email is flagged as MCP, it is set to store-mcp in this example but not deliver the mail.

Is this what is happening? Or is all mail not being delivered?
This is my conf:

Code: Select all

MCP Checks = yes
First Check = mcp
MCP Required SpamAssassin Score = 1
MCP High SpamAssassin Score = 10
MCP Header = X-%org-name%-MailScanner-EFA-MCPCheck:
Non MCP Actions = deliver
MCP Actions = deliver
High Scoring MCP Actions = deliver
...but email with MCP score doesn't delivered

DemonRok
Posts: 25
Joined: 02 Apr 2014 06:26

Re: Using MCP to block offensive content

Post by DemonRok » 03 Apr 2014 09:08

DemonRok wrote:
...but email with MCP score doesn't delivered
the same thing happens for tagged Spam with enabled MCP

User avatar
shawniverson
Posts: 2611
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Re: Using MCP to block offensive content

Post by shawniverson » 04 Apr 2014 00:39

That's interesting. I am going to do some testing and see if I can figure out what is happening here.
Version 3.0.2.6 released! Update now to keep your eFa secure!

DemonRok
Posts: 25
Joined: 02 Apr 2014 06:26

Re: Using MCP to block offensive content

Post by DemonRok » 04 Apr 2014 20:34

shawniverson wrote:That's interesting. I am going to do some testing and see if I can figure out what is happening here.
Thank You!

TNightster
Posts: 2
Joined: 15 Jul 2014 15:36

Re: Using MCP to block offensive content

Post by TNightster » 15 Jul 2014 17:55

All,
Is it possible to config MCP from the Webmin GUI? I've looked through the modules and didn't see a way.

Thanks for any info.

B

User avatar
shawniverson
Posts: 2611
Joined: 13 Jan 2014 23:30
Location: Rushville, Indiana, USA
Contact:

Re: Using MCP to block offensive content

Post by shawniverson » 17 Jul 2014 03:33

Not currently, although we are working on testing out MSRE (MailScanner Rule Editor) support in MailWatch.
Version 3.0.2.6 released! Update now to keep your eFa secure!

User avatar
pdwalker
Posts: 1135
Joined: 18 Mar 2015 09:16

Re: Using MCP to block offensive content

Post by pdwalker » 02 Sep 2015 10:09

*bump*

Is this covered by https://github.com/E-F-A/v3/issues/26, or does it need its own issue?

maciekh
Posts: 27
Joined: 25 Aug 2015 10:20

Re: Using MCP to block offensive content

Post by maciekh » 04 Sep 2015 07:53

header OFFENSIVE_RULE7 To =~ /all@domain.com/i
describe OFFENSIVE_RULE7 Banned header text all@domain.com
score OFFENSIVE_RULE7 5


Whill this be ok to quarantine all messages to: all@domain.com ?

User avatar
pdwalker
Posts: 1135
Joined: 18 Mar 2015 09:16

Re: Using MCP to block offensive content

Post by pdwalker » 04 Sep 2015 10:48

it looks ok.

test it, see if messages to all@domain.com are quarantined properly.

testing will only take a couple of minutes

maciekh
Posts: 27
Joined: 25 Aug 2015 10:20

Re: Using MCP to block offensive content

Post by maciekh » 04 Sep 2015 10:52

messages were scored without MCP score :(

MCP: N
High Scoring MCP: N
SpamAssassin MCP: N
MCP Whitelisted: N
MCP Blacklisted: N
MCP Score: 0.00
MCP Report: MCP-Clean, MCP-Checker (score=0, required 1)

User avatar
pdwalker
Posts: 1135
Joined: 18 Mar 2015 09:16

Re: Using MCP to block offensive content

Post by pdwalker » 04 Sep 2015 11:37

ok, so we need to diagnose the problem.

Did you reload MailScanner after changing the rules?

What file did you edit and put your rules into?

Can you create a rule using just the subject (like my example above) and see if that triggers MCP?

We need to figure out where it is failing before we can fix it.

maciekh
Posts: 27
Joined: 25 Aug 2015 10:20

Re: Using MCP to block offensive content

Post by maciekh » 04 Sep 2015 13:01

I have:
- edited MailScanner.conf with Your guide,
- created file file.cf in /etc/mailscanner/mcp with rules,
- checked 3times both files,
- reloaded mailscanner,
- rebooted

Still the same - nothing

Message with subject was quarantined :) so Your rule worked fine:
MCP: Y
High Scoring MCP: N
SpamAssassin MCP: Y
MCP Whitelisted: N
MCP Blacklisted: N
MCP Score: 5.00
MCP Report: "."
Score Matching Rule Description
OFFENSIVE_RULE2

So my question now is: how should look like proper rule for scoring TO: email@adress.com ?

User avatar
pdwalker
Posts: 1135
Joined: 18 Mar 2015 09:16

Re: Using MCP to block offensive content

Post by pdwalker » 04 Sep 2015 13:15

ok, that's good news. It means MCP is working.

All we have to do is figure out a correct rule for handling "To:" in the header.

Give me a few minutes to test this.

User avatar
pdwalker
Posts: 1135
Joined: 18 Mar 2015 09:16

Re: Using MCP to block offensive content

Post by pdwalker » 04 Sep 2015 14:00

Code: Select all

header   MCP_TEST2         To: =~ /pdwtest\@ddguidelines.com/i
describe MCP_TEST2         testing header To checking
score    MCP_TEST2         10
You have to "escape" the @ symbol in order to get the match to work correctly.

That's why it didn't work for you initially (or for me :D )

Remember this rule only works for "To:" It doesn't work for "Cc:" or "Bcc:"

maciekh
Posts: 27
Joined: 25 Aug 2015 10:20

Re: Using MCP to block offensive content

Post by maciekh » 04 Sep 2015 16:41

thank You :)

IT WORKS :)

User avatar
pdwalker
Posts: 1135
Joined: 18 Mar 2015 09:16

Re: Using MCP to block offensive content

Post by pdwalker » 05 Sep 2015 01:47

Don't forget to test "releasing" the message to see if it will get sent correctly.

Post Reply