OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Policy Server Protocol - Enhancement Request #1

From: mouss (usebsdfree.fr)
Date: Fri Dec 01 2006 - 17:03:29 CST


Ronald F. Guilmette wrote:
> [snip]
> Both parts of this overall task would be greatly facilitated by the ability
> to pass certain mail message headers from the current (incoming) message
> from Postfix to the external policy server.
>

The policy server mechanism is mostly for doing access control based on
envelope. if you want to check data, then you should use a content
filter (possibly as a proxy_filter to be able to reject the transaction).
> [snip]
>
> Content-Type: multipart/report;...
> User-Agent: Vacation/...
> X-MS-Embedded-Report:...
> From: Mail Delivery Subsystem...
> Subject: MDaemon Notification...
>

a look at spamassassin rules shows that trying to do such analysis is at
least a hard problem...

maybe you could explain how you would detect backscatter without talking
of implementation.