Prev: amount of mail
Next: postscreen faux-pas
From: Gabor Illo on 31 May 2010 12:02
> - to remove the header above, you can use header_checks, but you need to
> detect which headers to remove (you obviously don't want to remove
> headers added by remote systems). with (pcre syntax assumed):
>
> /^Received: \[127\.0\.0\.1\] \(\S+ \S+\)\s+by
> mail\.stageline\.hu \(Postfix\) with ESMTPA /
> IGNORE
> you still run the risk of removing a forged header...
>
> ideally, you should enable the submission service and configure your
> mail clients to use the corresponding port (587). then you can have
> header_checks that apply only to this service.

Thanks for your reply!

Original Thunderbird added header:

Received: from 127.0.0.1 (87.97.86.176.pool.invitel.hu [87.97.86.176])
by mail.stageline.hu (Postfix) with ESMTPSA id 358E61C3BC49
for<nospam(a)stageline.hu>; Mon, 31 May 2010 15:37:26 +0000 (UTC)

/usr/local/etc/postfix/main.cf

header_checks = pcre:$config_directory/header_checks

/usr/local/etc/postfix/header_checks

/^Received: \[127\.0\.0\.1\] \(\S+ \S+\)\s+by
mail\.stageline\.hu \(Postfix\) with ESMTPA /
IGNORE

postfix restart

Header check filter not work. I still receive thunderbird header. Can somebody fix the perl regexp code?

Thanks!

From: Noel Jones on 31 May 2010 12:35
On 5/31/2010 11:02 AM, Gabor Illo wrote:
>> - to remove the header above, you can use header_checks, but you need to
>> detect which headers to remove (you obviously don't want to remove
>> headers added by remote systems). with (pcre syntax assumed):
>>
>> /^Received: \[127\.0\.0\.1\] \(\S+ \S+\)\s+by
>> mail\.stageline\.hu \(Postfix\) with ESMTPA /
>> IGNORE
>> you still run the risk of removing a forged header...
>>
>> ideally, you should enable the submission service and configure your
>> mail clients to use the corresponding port (587). then you can have
>> header_checks that apply only to this service.
>
> Thanks for your reply!
>
> Original Thunderbird added header:
>
> Received: from 127.0.0.1 (87.97.86.176.pool.invitel.hu [87.97.86.176])
> by mail.stageline.hu (Postfix) with ESMTPSA id 358E61C3BC49
> for<nospam(a)stageline.hu>; Mon, 31 May 2010 15:37:26 +0000 (UTC)
>
> /usr/local/etc/postfix/main.cf
>
> header_checks = pcre:$config_directory/header_checks
>
> /usr/local/etc/postfix/header_checks
>
> /^Received: \[127\.0\.0\.1\] \(\S+ \S+\)\s+by
> mail\.stageline\.hu \(Postfix\) with ESMTPA /
> IGNORE
>
> postfix restart
>
> Header check filter not work. I still receive thunderbird header. Can
> somebody fix the perl regexp code?

The only obvious error I see is your expression looks for
ESTMPA but the sample header contains ESTMPSA. Note: the
expression should be all on one line in your header_checks file.

You can test your header_checks expression from the command
line with the postmap command:
postmap -h -q - pcre:/path/to/header_checks < test_message

If it matches, IGNORE will be printed. No match, no output.

-- Noel Jones

From: mouss on 31 May 2010 17:30
Gabor Illo a �crit :
>> - to remove the header above, you can use header_checks, but you need to
>> detect which headers to remove (you obviously don't want to remove
>> headers added by remote systems). with (pcre syntax assumed):
>>
>> /^Received: \[127\.0\.0\.1\] \(\S+ \S+\)\s+by
>> mail\.stageline\.hu \(Postfix\) with ESMTPA /
>> IGNORE
>> you still run the risk of removing a forged header...
>>
>> ideally, you should enable the submission service and configure your
>> mail clients to use the corresponding port (587). then you can have
>> header_checks that apply only to this service.
>
> Thanks for your reply!
>
> Original Thunderbird added header:
>
> Received: from 127.0.0.1 (87.97.86.176.pool.invitel.hu [87.97.86.176])
> by mail.stageline.hu (Postfix) with ESMTPSA id 358E61C3BC49
> for<nospam(a)stageline.hu>; Mon, 31 May 2010 15:37:26 +0000 (UTC)
>

In your previous message to the list, we see

Received: from [127.0.0.1] (87.97.80.150.pool.invitel.hu [87.97.80.150])
by mail.stageline.hu (Postfix) with ESMTPSA id DD0851C3BE62
for <postfix-users(a)postfix.org>; Sat, 29 May 2010 16:43:04 +0000 (UTC)

now, in your last message, we see

Received: from 127.0.0.1 (87.97.86.176.pool.invitel.hu [87.97.86.176])
by mail.stageline.hu (Postfix) with ESMTPSA id 08B751C3BC10
for <postfix-users(a)postfix.org>; Mon, 31 May 2010 16:02:51 +0000 (UTC)

so your helo changed from "[127.0.0.1]" to "127.0.0.1"

what did you do?



> [snip]

 | 
Pages: 1
Prev: amount of mail
Next: postscreen faux-pas