Hi,

I run postfix 1.1.12 at home. Works nicely, secure and all that. I'm using the postfix body_checks function to keep virusses away from my inbox. Usually this works well but recently I got into problems there.

my domain is wijnands.xs4all.nl, my isp's mailservers are called maildropx.xs4all.nl, they are sending mail from normal users and are also the output servers for my backup mx host.

Now I'm seeing entries like this:

Jun 1 22:21:43 vuurmuur postfix/smtpd[15672]: 9CE03D0E: client=maildrop17.xs4all.nl[194.109.127.147]
Jun 1 22:21:43 vuurmuur postfix/cleanup[15788]: 9CE03D0E: message-id=<f869550f68a14e.78b84.qmail@wijnands.xs4all.nl>
Jun 1 22:21:43 vuurmuur postfix/cleanup[15788]: 9CE03D0E: reject: body UEsDBAoAAAAAAAFYrjCN6Qnn/cEAAP3BAAAfAAAAcC16aXBwZWRfZmlsZV9kYXRhICAgICAgICAg; from=<jeroen@wijnands.xs4all.nl> to=<Hf7.95@wijnands.xs4all.nl>: Suspected w32.mydoom.a/w32.novarg virus in attachment
Jun 1 22:21:45 vuurmuur postfix/cleanup[15673]: 7EFE7CDA: message-id=<20040601202142.7EFE7CDA@wijnands.xs4all.nl>
Jun 1 22:21:45 vuurmuur postfix/cleanup[15673]: 7EFE7CDA: reject: body ?name="bill.scr"; from=<kateurboy34@aol.com> to=<jeroen@wijnands.xs4all.nl>: virus-like attachment, please use zip to send binary files - mogelijk virus in je email, gebruik aub zip om bestanden te versturen
Jun 1 22:21:49 vuurmuur postfix/smtpd[15672]: AC6FAD0E: client=maildrop17.xs4all.nl[194.109.127.147]
Jun 1 22:21:49 vuurmuur postfix/cleanup[15788]: AC6FAD0E: message-id=<f869550f68a14e.78b84.qmail@wijnands.xs4all.nl>
Jun 1 22:21:49 vuurmuur postfix/cleanup[15788]: AC6FAD0E: reject: body UEsDBAoAAAAAAAFYrjCN6Qnn/cEAAP3BAAAfAAAAcC16aXBwZWRfZmlsZV9kYXRhICAgICAgICAg; from=<jeroen@wijnands.xs4all.nl> to=<marjatiditweglaten@wijnands.xs4all.nl>: Suspected w32.mydoom.a/w32.novarg virus in attachment
Jun 1 22:21:55 vuurmuur postfix/smtpd[15672]: C0E6BD0E: client=maildrop17.xs4all.nl[194.109.127.147]
Jun 1 22:21:55 vuurmuur postfix/cleanup[15788]: C0E6BD0E: message-id=<200406012016.i51KGZ97029660@maildrop17.xs4all.nl>
Jun 1 22:21:56 vuurmuur postfix/cleanup[15788]: C0E6BD0E: reject: body UEsDBAoAAAAAAAFYrjCN6Qnn/cEAAP3BAAAfAAAAcC16aXBwZWRfZmlsZV9kYXRhICAgICAgICAg; from=<> to=<jeroen@wijnands.xs4all.nl>: Suspected w32.mydoom.a/w32.novarg virus in attachment
Jun 1 22:22:01 vuurmuur postfix/smtpd[15672]: 642BBD0E: client=maildrop17.xs4all.nl[194.109.127.147]
Jun 1 22:22:05 vuurmuur postfix/cleanup[15788]: 642BBD0E: message-id=<200406012016.i51KGfmS029817@maildrop17.xs4all.nl>
Jun 1 22:22:05 vuurmuur postfix/cleanup[15788]: 642BBD0E: reject: body UEsDBAoAAAAAAAFYrjCN6Qnn/cEAAP3BAAAfAAAAcC16aXBwZWRfZmlsZV9kYXRhICAgICAgICAg; from=<> to=<jeroen@wijnands.xs4all.nl>: Suspected w32.mydoom.a/w32.novarg virus in attachment
<truncated>


I've already had a word with the xs4all admins, they don't really mind but I do since this has doubled my log file size.

I'd still like to keep reject virusses on general principle but I think what I need to do is modify my body_checks so that any virus from maildropX.xs4all.nl is discarded instead of bounced.

Any feedback on that?

Next problem, I'm really bad at regexp writing. Anyone willing to help me out there?

TIA!

ok, failing that, a good regexp primer for dummies?