GAFE/GSFE: Stop users being able to email distribution lists

[Garacesh]

My guess is that a self-addressed email doesn't go through compliance rules. You could test that with some other compliance rule: a simple one to reject messages to a particular address, rather than one using any regex, etc.

 

My 'reject emails to distribution lists' filter works (Any envelope recipient // (test@domain|pupils@domain|classroom_teachers@domain|etc|etc|etc)

(Well partially.. Even though I've set a rejection message, there's no rejection message...)

[ADMaster]

I use regex to block sending to the groups. In the same compliance settings instead of contains text choose match regex.

This is applied to my students OU.

I prefix all distribution lists with list or slist, the 's' denotes a student distribution list such as [email protected]

then staff would be [email protected]

 

Here is the regex that will match both of these cases.

 

(?i)(list|slist)-[a-z0-9]+@(example\.com)

 

I have no need to update the rules year after year as long as it is prefixed it will be caught.

[Jaan]

Even though I've set a rejection message, there's no rejection message...)

 

The rejection message isn't in the form of a bounce email. When you click "send" you get a popup style notification (Gmail)

[Garacesh]

So I took out about 60% of the banned words, tested it, email wasn't flagged.

Added the banned words in 2 or 3 at a time, giving it a few minute and testing each time. All fine.

I've now added all of the banned words back in, just as they were previously. Normal emails are still not being flagged. WWWUUUUUUTTTTT?!?!?

 

Normal emails ("This is a normal email. It is boring. This email exists solely for the purpose of checking the profanity filter.") aren't getting [FLAGGED] added to the subject... Profanity (i.e b@st4rd) is getting [FLAGGED] added. So despite being no different, it's doing what it should do now.

>.<

Almost hometime. Almost hometime.

[Garacesh]

The rejection message isn't in the form of a bounce email. When you click "send" you get a popup style notification (Gmail)

 

That doesn't appear to happen here.. For example, I send a test email containing the f-bomb, the rule is set to "Reject message // Customize rejection notice: Please keep your emails free of profanity." and when I click Send, I get 'Your message has been sent. View message' and it appears in the sentbox, it just doesn't arrive in the recipients inbox.

[Jaan]

That doesn't appear to happen here.. For example, I send a test email containing the f-bomb, the rule is set to "Reject message // Customize rejection notice: Please keep your emails free of profanity." and when I click Send, I get 'Your message has been sent. View message' and it appears in the sentbox, it just doesn't arrive in the recipients inbox.

 

I've just doubled checked this. we no longer get the pop up and are having the same behavior as yourself. Interesting.

[Garacesh]

Damn, that would've been nice.. Would also help pin down any false-positives because people wouldn't have to wait to find out it didn't work.. Shame. Thanks for checking

I wonder why they still have the custom rejection message field if it doesn't do anything anymore..

 

Now for some reason, kids can't email the test mailing list.. even though (just for testing) the mailing list rule is set to append [DISTRIBUTIONLIST] rather than reject

[Ditto]

We use the "Compliance" section in Google admin panel. (apps--g-suite--settings for gmail-- advance settings)

 

We use this to stop any pupils e-mailing distribution lists or sending abusive emails directly to the head!

 

I know this thread has moved on, but when I sought to tackle much the same issue, Google support took me to the next section down after 'Compliance', namely 'Routing'. This is implemented for the various student OUs. What we have set up is a rule for internal sending and an envelope filter of 'Only affect specific envelope recipients'. We then select 'Group memberships' and add all the groups we wish block emails being sent to. For example, we block the parent groups and governor groups. As a rule, we don't want to block pupils emailing each other or teachers.

 

This approach using the compliance section is interesting and I'm trying to weigh up the pros and cons of Compliance versus Routing. What do you think? With regards a rude words list etc, we have not implemented anything in the GSuite, on the basis we use Smoothwall for that sort of thing. SmoothWall isn't my area and I'm wondering if it picks up on internal stuff?

[FN-GM]

I almost exclusively do this with group permissions rather than compliance rules (which is the other way but more effort). So for example all of our class Google Groups have the teacher as the owner and students as members. Posting is limited to owners of the group and only members can read messages but have no posign permissions. This is configured in "basic permissions" in the groups settings or but commandline using GAM.

 

Where about is this please @rogerdnixon I have been looking around but I cannot see it.

 

Thanks

[rogerdnixon]

Where about is this please @rogerdnixon I have been looking around but I cannot see it.

 

Thanks

In groups.google.com - click manage on the specific group. The basic permissions. You can get there on the admin console by client clicking on view in group services. Or set the permissions via command line in GAM.

[enjay]

We use the "Compliance" section in Google admin panel. (apps--g-suite--settings for gmail-- advance settings)

 

We use this to stop any pupils e-mailing distribution lists or sending abusive emails directly to the head!

 

Apologies for resurrecting a slightly old thread, but it is relevant.

 

I'm also trying to stop students email distribution groups, but I'm struggling to get the syntax right in the search. The email groups themselves have all sorts of addresses so I can't filter them but they all follow the same naming convention in the group name itself (ABC-Students-[class]). Can I create a rule to prevent students from emailing any group name which contains ABC-STudents and if so, how? I'm struggling to find the right syntax, plus it takes "up to an hour" to take effect, making trial-and-error testing a slow process.

[rogerdnixon]

I probably said this earlier on in this thread - rather than using compliance rules (where you would use the email address of the group), we use group permissions. So for example, out "students" group contains all students and members of the LG. Students are members and can only view posts and have no posting permissions to the group. Group permissions are pretty much instant when you change them and can be modified in bulk using the GAM commandline tool.

[enjay]

I probably said this earlier on in this thread - rather than using compliance rules (where you would use the email address of the group), we use group permissions. So for example, out "students" group contains all students and members of the LG. Students are members and can only view posts and have no posting permissions to the group. Group permissions are pretty much instant when you change them and can be modified in bulk using the GAM commandline tool.

 

You did say that earlier. It doesn't help in this instance because a) we have LOTS of groups, more than I want to change like that, and b) the groups are created by Salamander so those changes would get over-written.

[fiza]

@enjay - pm sent

[Garacesh]

What I ended up doing was creating a Content Compliance email rule that applied to the pupil OU's in G Suite (Admin console, Apps, G Suite, GMail, Advanced Settings)

 

Name: Silently reject emails to distribution lists

Email messages to affect: Internal - Sending

 

Expressions: Advance Content Match

Any envelope recipient

Matches regex

(?i)(^([email protected]))

Regex Description: Example mailing list

Minimum match count: Null

 

If matched, do the following: Reject message

 

This way I can limit what groups they get sent to. So the kids can't email the big mailing lists (YearX@, Computing@, etc) but that allows teachers to create their own mailing lists that pupils can e-mail (which will admittedly probably happen like.. twice. Ever). You can put multiple expressions per mailing rule, so I just have each mailing list as its own expression as part of the same mail rule and it doesn't clutter up the UI at all.

 

This, obviously, isn't a feasible method if you're importing all of your SalamanderSoft groups into Google, but I have to ask: Why are you? You don't need to. If you have Salamander I can only assume you're pre-populating Google Classroom, in which case, you don't need a group/mailing list for every class, because they have Classroom. So what exactly are you trying to achieve? It may be there's a better way of going about it.

Edited February 26, 2018 by Garacesh

[ADMaster]

Apologies for resurrecting a slightly old thread, but it is relevant.

 

I'm also trying to stop students email distribution groups, but I'm struggling to get the syntax right in the search. The email groups themselves have all sorts of addresses so I can't filter them but they all follow the same naming convention in the group name itself (ABC-Students-[class]). Can I create a rule to prevent students from emailing any group name which contains ABC-STudents and if so, how? I'm struggling to find the right syntax, plus it takes "up to an hour" to take effect, making trial-and-error testing a slow process.

I provide my syntax in post 27 it should be a matter of putting ABC in place of my slist and adding students [a-z0-9] like this.

 

(?i)abc-students-[a-z0-9]+@example\.com

The rule is also set on internal sending matching all envelope recipients.

 

The rule has its own regex tester, but here is another one to try.

https://regex101.com/

[enjay]

The ABC-Students isn't in the email address, though, only the group name. For example, I have a group called ABC-Students-7x1-En with the address [email protected]. Would you regex syntax still work if I just put (?i)abc-students- ?

[Garacesh]

You can get into the really nitty-gritty of Regex if you want. Nesting capture groups and using the OR flag | lets you do a lot.

Something like.. (Assuming x is a form or other, and not always an x)

 

(?i)(^((7|8|9|10|11)(v|w|x|y|z)(1|2|3|4|5|6|7)-(en|mfl|art|sci|com)@yourdomain.gtld))

 

[email protected]

[email protected]

[email protected]

etc will all match, you just gotta populate the expression with all possible variations.

 

 

Edit: If your naming convention is sequential, you can condense it to something like (?i)(^((7|8|9|10|11)([v-z])([1-9])-(en|mfl|art|sci|com)@yourdomain.gtld))

Unfortunately, you can't do [7-11], apparently.

Edited February 26, 2018 by Garacesh

[fiza]

https://regex101.com/

 

regex101 is invaluable to test syntax out.

[enjay]

You can get into the really nitty-gritty of Regex if you want. Nesting capture groups and using the OR flag | lets you do a lot.

Something like.. (Assuming x is a form or other, and not always an x)

 

(?i)(^((7|8|9|10|11)(v|w|x|y|z)(1|2|3|4|5|6|7)-(en|mfl|art|sci|com)@yourdomain.gtld))

 

[email protected]

[email protected]

[email protected]

etc will all match, you just gotta populate the expression with all possible variations.

 

 

Edit: If your naming convention is sequential, you can condense it to something like (?i)(^((7|8|9|10|11)([v-z])([1-9])-(en|mfl|art|sci|com)@yourdomain.gtld))

Unfortunately, you can't do [7-11], apparently.

 

Looks like that might be how I'll need to do it. The class groups all follow the same basic syntax, so I'm sure I could come up with a regex that would match them, then add a few more rules for the year7@, allstudents@ and so forth.

[Garacesh]

It's probable, but I still reckon you're making more work for yourself

 

Why does each class require its own mailing list when their teacher can just make an announcement in Classroom? As long as you allow emails to come in from @google.com, Classroom will notify all the students when the teacher(s) do something.

 

Edit: Of course you don't have to answer that, keeping your setup private is understandable, I just can't see a situation where anybody who wasn't their teacher would want to email all the members of Class X. That might be common your neck of the woods. I dunno.

Edited February 26, 2018 by Garacesh

[enjay]

Why does each class require its own mailing list when their teacher can just make an announcement in Classroom? As long as you allow emails to come in from @google.com, Classroom will notify all the students when the teacher(s) do something.

 

The email groups exist so teachers can invite the students to join the Classrooms in the first place. Also for instances where a Classroom doesn't exist, e.g. emailing all Year 9s about GCSE options or something.

[enjay]

Okay, making some headway here. Next problem is the group names are not all the same format, e.g. there is [email protected] and also [email protected]. Can I enter a wildcard value in a regex, so it will accept anything regardless of length? My groups all start with the year group, so can I create a regex which will fire on [7|8|9|10|11] followed by any text of any length?

 

I'm wondering now if I'm better off adding "ABC-Students-" to the start of all the email groups, but I'd still need a wildcard for what follows that. Unless I could specify any address starting with that string, is that possible?

[ADMaster]

I'd look at your software to see if there was any way to prefix abc-students or something similar that you can match on.

If these were user created groups there is a setting to add a prefix to any user created group. However I think you will need to look into your sync software for this.

 

The syntax I posted above will match abc-students-any length of letters or numbers then @example.com.

Since you have the dashes in there this will need modified a bit.

try this, providing you have a prefix to match on.

The parenthesis adds grouping and the pipe indicates OR.

match abc-students-any length letters and numbers or dash @example.com

(?i)abc-students-([a-z0-9]|-) @example\.com

[Garacesh]

The email groups exist so teachers can invite the students to join the Classrooms in the first place. Also for instances where a Classroom doesn't exist, e.g. emailing all Year 9s about GCSE options or something.

 

Salamander already does that. At least, they did for us? Kids are automatically added to the right classes in Classroom whether they like or not (and this happens daily to re-add leavers.. wish you could turn unenrolling off...)

It creates the groups in AD, yeah, but you don't have to upload those groups to Google. We don't. The only Salamander groups we push up to Google are Year-X-Pupils and All-Staff.

 

Might be worth having a chat with their support and re-clarifying what needs to be done.

 

 

As for your regex, kinda.

By combining * (Zero or more repetitions), . (Any Character) and ? (Optional character) you might be able to rig something. I know I've used that in Powershell, but I don't know if Google will like that.

I can't remember the exact order but I can get it for you tomorrow.

Edited February 26, 2018 by Garacesh