OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: About date spoofing

From: mouss (moussnetoyen.net)
Date: Fri Mar 14 2008 - 14:02:15 CDT


Eddy Beliveau wrote:
> Hi! Noel,
>
> Many thanks for your reply.
>
> After many tests, I noticed that the Date header is correctly replaced
> when submitting my email to the usual smtp port
> but is NOT replaced when sending email to the submission port.
> (I'm always using the submission port)
>
> So it seems that I have problem with my cleanup or pre-cleanup services
>
> I cannot find the correct culprit
> Maybe I should take another cup of coffee ;-)
>
> Can you help?

you disabled header checks in cleanup, which is used by your submission.

you don't need a pre-cleanup, since receive_override_options seems
enough for you.
so
- remove the pre-cleanup
- remove the options you added to "cleanup"
- make sure to use receive_override_options before the filter (to
disable rewrite)
and try again

> Thanks,
> Eddy
>
> Here is part of my master.cf file:
> smtp inet n - n - - smtpd
> -o cleanup_service_name=pre-cleanup
>
> submission inet n - n - - smtpd
> -o smtpd_etrn_restrictions=reject
> -o local_header_rewrite_clients=permit_sasl_authenticated,reject
>
> pre-cleanup unix n - n - 0 cleanup
> -o virtual_alias_maps=
> -o canonical_maps=
> -o sender_canonical_maps=
> -o recipient_canonical_maps=
> -o masquerade_domains=
>
> cleanup unix n - n - 0 cleanup
> -o mime_header_checks=
> -o nested_header_checks=
> -o body_checks=
> -o header_checks=
>
> 127.0.0.1:10025 inet n - n - - smtpd
> -o content_filter=
> -o local_recipient_maps=
> -o relay_recipient_maps=
> -o smtpd_restriction_classes=
> -o smtpd_client_restrictions=
> -o smtpd_helo_restrictions=
> -o smtpd_sender_restrictions=
> -o smtpd_data_restrictions=
> -o smtpd_recipient_restrictions=permit_mynetworks,reject
> -o mynetworks=127.0.0.0/8
> -o mynetworks_style=host
> -o strict_rfc821_envelopes=yes
> -o in_flow_delay=0
> -o
> receive_override_options=no_unknown_recipient_checks,no_header_body_checks
>
>
> ----- Message d'origine -----
>> Do you have any receive_override_options defined in master.cf?
>>
>> Is the Subject warning logged as you defined?
>>
>> Are you sure your mail had a Date: header to begin with?
>>