Blocking email from blank sender

[lampcisco]

Hi ALl,

I want to block email from blank sender ,i followed the below link,i tried running the command in cli but i am getting an error.

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117814-configure-esa-00.html

Error.

Welcome to the Cisco C170 Email Security Appliance

NOTE: This session will expire if left idle for 30 minutes. Any uncommitted
configuration changes will be lost. Commit the configuration changes as soon as
they are made.

smpt1com> block_null_from_headers: if (NOT header("From")) {

Unknown command or missing feature key: block_null_from_headers:
smpt1com> drop();

Unknown command or missing feature key: drop();
smpt1com> block_null_bounce_headers: if (header("From") == "^$") {

Unknown command or missing feature key: block_null_bounce_headers:
smpt1com> drop();

Unknown command or missing feature key: drop();
smpt1.com> }

Regards

Lam

[Libin Varghese · Accepted solution]

Hi Lam,

In order to add message filters you would first need to issue command "filters" followed by "new" as shown below.

cisco.lab> filters

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
[]> new

Enter filter script. Enter '.' on its own line to end.
block_null_from_headers: if (NOT header("From")) {
drop();
}
.

1 filters added.

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
[]>

cisco.lab> commit

Please enter some comments describing your changes:
[]> Added nessage filter

Do you want to save the current configuration for rollback? [Y]>

Changes committed: Wed Jan 04 07:06:49 2017 GMT

cisco.lab>

Follow the same steps to add any additional message filters one at a time using sub-command "new".

cisco.lab> filters

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
[]> new

Enter filter script. Enter '.' on its own line to end.
block_null_bounce_headers: if (header("From") == "^$") {
drop();
}
.

1 filters added.

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
[]>

cisco.lab> commit

Please enter some comments describing your changes:
[]> Added nessage filter

Do you want to save the current configuration for rollback? [Y]>

Changes committed: Wed Jan 04 07:06:49 2017 GMT

cisco.lab>

Note: After adding a filter press "enter" to return to the main prompt in order to commit changes.

Regards,
Libin Varghese

[Frank Osberg]

so if you are making this filter in the CLI, will you be able to see it in the gui afterwords or not?? 

I have made the filter in the cli, but mails coming with a blank sender is still coming through.... 

This is my CLI:

[]> list

Num Active Valid Name
1 Y Y block_null_from_headers
2 Y Y block_null_bounce_headers

and my message tracking is telling me this

Envelope Sender: (no sender)

27 May 2019 14:24:57 (GMT +02:00) Message 23981422 Sender Domain:
27 May 2019 14:24:57 (GMT +02:00) Start message 23981422 on incoming connection (ICID 56088196).
27 May 2019 14:24:57 (GMT +02:00) Message 23981422 enqueued on incoming connection (ICID 56088196) from .
27 May 2019 14:24:57 (GMT +02:00) Message 23981422 direction: incoming

I would like to block this type of mails ASAP. 

[Libin Varghese]

Envelope sender is different from From header, the message tracking shows the envelope sender so you may want to review your exact requirement and modify the filter accordingly.

Message filters cannot be reviewed from the GUI, you can however view reports for message filters under the Monitor tab.

Regards,

Libin