OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Sudheer MT (superuser_at_corecompt.com)
Date: Sun Nov 03 2002 - 02:28:26 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On 2002.11.02 23:50 Cybertime Hostmaster wrote:
    > > I suddenly realised that, postfix is not processing
    > > Body_check
    > > Header_check
    > > & other UCE parameters.
    > > To confirm I misspelled the filenames, then reloaded the postfix.
    > > Then I sent mailed from my hotmail ID, with an .scr file.
    >
    > What version of Postfix?
    >
    > --Eric
    >
    > -
    > To unsubscribe, send mail to majordomopostfix.org with content
    > (not subject): unsubscribe postfix-users
    >

    I typed some renadom characters in header_check, body check file, but still
    Mail log does not show any error message.
    Attached is Body_check & header_Check files.
     I even made spelling mistake ,
    eg: smtpd_sender_restrict = permit_mynetworks,regexp:/etc/postfix/forbid_from,reject_unknown_sender_domain

    but still I did not find any error message in mail log.
    when I completely renamed main.cf then is showed errors.

    Body_checks

    /^(.*)name=\"(.*)\.(exe|lnk|dll|shs|vbe|hta|vbs|vbe|js|jse|bat|cmd|vxd|scr|shm|pif|chm)\"$/
    REJECT
    /^(.*)name=(.*)\.(exe|lnk|dll|shs|vbe|hta|vbs|vbe|js|jse|bat|cmd|vxd|scr|shm|pif|chm)$/
    REJECT
    /^(.*)name=(.*)\.(bulk-mails|bulk mailer|mortgage|)$/ REJECT

    I even tried..

    ~^(.*)name=\"(.*)\.(exe|lnk|dll|shs|vbe|hta|vbs|vbe|js|jse|bat|cmd|vxd|scr|shm|pif|chm)\"$
    ~ REJECT
    ~^(.*)name=(.*)\.(exe|lnk|dll|shs|vbe|hta|vbs|vbe|js|jse|bat|cmd|vxd|scr|shm|pif|chm)$
    ~ REJECT
    ~^(.*)name=(.*)\.(bulk-mails|bulk mailer|mortgage|)$ ~ REJECT

    #~^[[:alnum:]+/]{60,}[:space:]*$~ OK

    Header_checks

    #nimda
    /^Content-Type: multipart\/related;.*type=\"multipart\/alternative\";.*boundary=\"====_ABC1234567890DEF_====\"*$/
    REJECT
    #spammers
    /^ Body content=\.*(MMailer|K-ML|GoldMine|MAGIC|bomber|expeditor|Brooklyn
    North|Broadcast|DMailer|Extractor|EMailing List Pro|Group|Fusion|News
    Breaker|dbMail|Unity|PG-MAILINGLIST PRO|Dynamic|
    Splio|Sarbacane|sMailing|JMail|Broadcst|WorkZ).*$/ REJECT
    #anonymizers
    /^Received: .*(barbarella\.super\.nu|cameleon.org|remailer\.privacy\.at).*$/
    REJECT
    #top-domains à spam
    /^Received: .*\.gt .*$/ REJECT
    /^Received: .*\.tw .*$/ REJECT
    /^Received: .*\.kr .*$/ REJECT
    /^Received: .*\.cr .*$/ REJECT
    /^Received: .*\.cn .*$/ REJECT
    /^Received: .*avoska\.net.*$/ REJECT
    /^Received: .*yourwebsite\.com.*$/ REJECT
    /^Received: .*gastone\.it.*$/ REJECT
    /^Received: .*waloa\.com.*$/ REJECT
    /^Received: .*cornut\.fr.*$/ REJECT
    /^Received: .*microtronique\.com.*$/ REJECT
    /^Received: .*caminarsoftware\.com.*$/ REJECT
    /^Received: .*\.lk.*$/ REJECT
    /^Received: .*\.quik\.com.*$/ REJECT
    /^Received: .*bluewin\.ch.*$/ REJECT
    /^Received: .*rootsystems\.net.*$/ REJECT
    /^Received: .*webhostingtalk\.com.*$/ REJECT
    /^Received: .*mail\.liekki\.com.*$/ REJECT
    -
    To unsubscribe, send mail to majordomopostfix.org with content
    (not subject): unsubscribe postfix-users