OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
body_checks

From: Jason Williard (jwilliardpcsafe.com)
Date: Mon May 02 2005 - 16:14:09 CDT


Today all mail users on one of my systems started receiving a large number
of emails with attachments with names that end in (secret.zip, info.zip &
text.zip). I've been trying to find a way to drop these mails quickly. The
solution that I came up with was enabling body_checks. However, the way I
have it set up does not appear to be working. I am hoping someone can catch
what I am doing wrong here.

## main.cf
body_checks = regexp:/etc/postfix/body_checks
body_checks = pcre:/etc/postfix/body_checks

## body_checks
/(filename|name)="?.*info\.zip.*"?/ DISCARD
/(filename|name)="?.*text\.zip.*"?/ DISCARD
/(filename|name)="?.*secret\.zip.*"?/ DISCARD

After editing body_checks, I run "postmap body_checks".

Is there anything that I am missing or doing wrong here?

---
Thank You
Jason Williard
Systems Administrator
PCSafe, Inc.