OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: header_checks question

From: Justin Piszcz (jpiszczlucidpixels.com)
Date: Wed Sep 12 2007 - 15:57:08 CDT


On Wed, 12 Sep 2007, Noel Jones wrote:

> At 03:36 PM 9/12/2007, Justin Piszcz wrote:
>
>> Agree-- however, there are some nice regexp maps out their compiled for
>> anti-spam purposes
>
> Such as?

A couple:

#
# Malware Block List - http://www.malware.com.br
# List for Postfix MTA
# Generated at: 20070709224449 UTC
#
# http://www.malware.com.br/cgi/submit?action=list_postfix

# t29.dk postfix header_checks regexp file, rev. 28c (2006-12-08)
#
#
# Maintained by Niels Callesøe (dk pfy) <pfynntp.dk>
# No patterns have been added since dec 2004. It appears AV vendors have either gotten the message
# or these filters are simply enough. However, if you do see any "virus warnings" that slip
# through, please send submissions to: samples-2007t29.dk. If you do not see your submission added,
# it is probably because it would already have been caught by the expressions below.
#
# Usage (main.cf):
# header_checks = regexp:/etc/postfix/header_checks
#
# To reduce clutter in this file, all discussion, attribtions etc have been
# moved to http://www.t29.dk/header_check_notes.php

>
>> and I'd rather keep them as-is and for my own rules use pcre where I can
>> and hash maps for other purposes.
>
> pcre: is backward-compatible with maps intended for regexp:.
>
>> Justin.
>
> --
> Noel Jones