# apt-get install sieve-connect

$ sieve-connect -s localhost -p 4190 -u julien -m plain
connecting to localhost                                   
Please enter your password:                               

> ls                                                      
filters_julien.sieve  <- active script                    

> get filters_julien.sieve Filtre_Sieve_Julien                            
require                                                   
["fileinto","envelope","reject","vacation","imapflags","relational","comparator-i;ascii-numeric","regex","notify"];
}                                                                                                                  
if header :contains "X-Spam-Flag" "YES" {                                                                          
  fileinto "user.julien.Spam";
  stop;
}

> quit

Explanation: connect to the sieve shell with your username and password. The ls command (or list) lists the available scripts and shows the one that is active (one at a time). get allows you to download the script you want (the second argument is the output file).

Locally, with a text editor, modify the filter file.

Each filter script must start with the require line, as follow:

require                                                   
["fileinto","envelope","reject","vacation","imapflags","relational","comparator-i;ascii-numeric","regex","notify"];

Then, write your rules. Follow example below (used to filter spam detected by spamassassin)

if header :contains "X-Spam-Flag" "YES" {
  fileinto "user.julien.Spam";
  stop;
}

examples (from the RFC) :

if header :contains "from" "coyote" {
   discard;
} elsif header :contains ["subject"] ["$$$"] {
   discard;
} else {
   fileinto "INBOX";
}

if header :contains ["From"] ["coyote"] {
   redirect "acm@example.edu";
} elsif header :contains "Subject" "$$$" {
   redirect "postmaster@example.edu";
} else {
   redirect "field@example.edu";
}

Available testing parameters are available here : http://rfc-ref.org/RFC-TEXTS/3028/chapter5.html

You can also add actions, like addflag “\\Seen” that is going to mark the message as read in the IMAP server.

if header :contains "X-Spam-Flag" "YES" {
  addflag "\\Seen";
  fileinto "user.julien.Spam";
  stop;
}

$ sieve-connect -s localhost -p 4190 -u julien -m plain
connecting to localhost                           
Please enter your password:
                       
> put filter_sieve                                

> list                                            
filters  <- active script                         
filter_sieve                                      

> activate filter_sieve                           

> list                                            
filters                                           
filter_sieve  <- active script                    

> quit  

1. The put command upload the script on the server
2. activate mark a script to be usable by the server

In /etc/cyrus.conf, verify that sieve is listed in the services section:

SERVICES {
[...]
       sieve		cmd="timsieved" listen="sieve" prefork=0 maxchild=100
[...]
}

Then, make sure sieve listens on port 2000 (by default):

# grep sieve /etc/services
sieve		2000/tcp			# Sieve mail filter daemon

# netstat -tpan |grep 2000
tcp        0      0 0.0.0.0:2000            0.0.0.0:*               LISTEN      3336/cyrmaster  
tcp6       0      0 :::2000                 :::*                    LISTEN      3336/cyrmaster