OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: About date spoofing

From: Eddy Beliveau (eddy.beliveauhec.ca)
Date: Fri Mar 14 2008 - 09:42:57 CDT


Hi! Ralf,

I'm using postfix 2.5.1, I did the following
- add the following line to my main.cf file:
header_checks = regexp:/etc/postfix/maps/header_checks
- create the file /etc/postfix/maps/header_checks with following content:
/^Subject:/ WARN Subject
/^(Date:.*)/ REPLACE X-$1
- postmap that file
- postfix reload

Now, when I sent an email to my server,
- there is NO header X-Date
- The Date header is still there

Here is an extract of the received email:
Received: from hidden (unknown [hidden])
 by hidden.hec.ca (Postfix) with ESMTPA id DFB8ABAF13
 for <Eddy.Beliveauhec.ca>; Fri, 14 Mar 2008 10:19:12 -0400 (EDT)
...cut...
Date: Fri, 14 Mar 2008 10:19:05 -0400

Can you reproduce ?

Thanks,
Eddy

----- Message d'origine -----
De : "Ralf Hildebrandt" <Ralf.Hildebrandtcharite.de>
>> Is it possible for postfix to write the correct date on the incoming
>> emails?
>
> You could try and remove the Date: Header using header_checks:
>
> /^Date:/ DISCARD
> or
> /^(Date:.*)/ REPLACE X-$1