Rspamd Many "bad search filter: top" messages

Support
1

Maybe during my tests learning how to configure the filters, I did something wrong; I really don’t remember if from the beginning these errors have appeared.

Where could I check and correct this problem?

image
image833×156 17.3 KB

Thank you in advance.

2

It seems a top filter is configured for a filter type that doesn’t support it.
I’d search for filter = "top"; in the rspamd config, usually the files /etc/rspamd/local.d/multimap.conf and /etc/rspamd/modules.d/multimap.conf, to find the possibly wrong filter.

Here you can find the supported filters for the filter types:

https://rspamd.com/doc/modules/multimap.html#map-filters

Similar issue:

2 Likes
3

Thank you @mrmarkuz

Found it in the file “etc/rspamd/local.d/multimap.conf”, there I created the template that you suggest in a post:

And it’s working great, with those messages mentioned.

Reading the docs, I don’t know which type and/or filter to change it for, I found several options.
How to correct it without losing this protection?

#
# configure tld list
#

FROM_BLACKLIST_TLD { #change to SOMETHING_BLACKLIST_TLD ?
    type = "from"; # change to: "helo" or "hostname" ?
    map = [
    "${CONFDIR}/blacklist_from_tld.map", #blacklist_something_tld.map ?
    ];
    action = "reject";
    filter = "top";
    symbol = "FROM_BLACKLIST_TLD"; # SOMETHING_BLACKLIST_TLD ?
    regexp = true;
    description = "Refused list of FROM TLD";

It’s an idea, and I could be very wrong:

FIXED_BLACKLIST_TLD {
    type = "helo";  # or "hostname" ?
    map = [
    "${CONFDIR}/blacklist_fixed_tld.map",
    ];
    action = "reject";
    filter = "top";
    symbol = "FIXED_BLACKLIST_TLD";
    regexp = true;
    description = "Refused list of FIXED TLD";
}

Reading all the configured maps and documents, I’m already getting an idea but I can’t find the correct solution.

image
image1112×541 89.6 KB

image
image1090×534 73.6 KB

image

Regards

4

I’d suggest to change the filter and not the type:

filter = "email:domain:tld"

instead of

filter = "top"

to block the mail address domain tld and not the mailserver tld so the “From” type is needed.

3 Likes
5

I need to ask you:

Will the change continue to block these spam cases (with viruses)?
Lately, this is the most dangerous type of mail we have managed to block, as they pretend to be from “legitimate” domains and it is not possible to block them with the “from” address.

image
image380×528 37.7 KB

Luckily, when they try to impersonate my server, with the symbol DMARC_POLICY_REJECT (20) they can no longer get in (from your tips).

6

Yes as other filters or customized symbols shouldn’t be affected by the change.
Please test if the tld reject really works, I didn’t try it.

2 Likes
7

Filter it’s working but the message still appears:

image
image922×110 11.1 KB

image
image936×99 9.19 KB

8

Did you run

signal-event nethserver-mail-filter-update

to write the config files and restart rspamd?

1 Like
9

Yes @mrmarkuz, I forgot to tell.

image

(10:03pm) No, wait a minute. I edited the WRONG .conf file and the changes were not saved. :man_facepalming:t3:

(10:14pm) I reverted the changes…

10

This day I have a lot of attention lapses… I start all over again:

cat /etc/e-smith/templates-custom/etc/rspamd/local.d/multimap.conf/90tld

#
# configure tld list
#

{
if ($rspamd{SpamCheckStatus} eq 'enabled') {

$OUT .= << 'EOF'
FROM_BLACKLIST_TLD {
    type = "from";
    map = [
    "${CONFDIR}/blacklist_from_tld.map",
    ];
    action = "reject";
    #filter = "top";
    filter = "email:domain:tld"
    symbol = "FROM_BLACKLIST_TLD";
    regexp = true;
    description = "Refused list of FROM TLD";
}
EOF
}
}

(10:22pm) I am no longer getting errors, but I have to wait for spam.
…
(11:15pm) @mrmarkuz It is working and no error messages!

image
image1387×160 17.3 KB

Thank you!

1 Like