LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 03-12-2010, 07:44 PM   #1
subcon42
LQ Newbie
 
Registered: Jul 2009
Posts: 9

Rep: Reputation: 0
Postfix header checking script


Greetings,

I have a postfix smarthost that filters mail. Works great. Debian Lenny i386 running Postfix 2.5.5-1.1.

I have observed that most of the SPAM mail that slips past my header_checks share a common demeanor:

Return-Path: <spoofed-email-address@domain.com>
From: <my-email-address@mydomain.com>

In 99% of the SPAM that slips through, the two header attributes above do not match.

However, in a legitimate email's case ...

Return-Path: <myfriend@gmail.com>
From: <myfriend@gmail.com>

... these two values would match.

I want to make Postfix check to see if the Return-Path matches From (Obviously, I am speaking strictly of the data between the angle brackets (< and >). How can I make it so ?

Thank you.

subcon42
 
Old 03-13-2010, 01:11 AM   #2
subcon42
LQ Newbie
 
Registered: Jul 2009
Posts: 9

Original Poster
Rep: Reputation: 0
Found this at http://www.postfix.org/BACKSCATTER_R...#forged_sender

/etc/postfix/header_checks:
/^(From|Return-Path):.*\b(user@domain\.tld)\b/
reject forged sender address in $1: header: $2

... which I am testing this evening. I simply replaced the generic 'user@domain.tld' with my real email addresses.

Will post my findings when I have something to post.

subcon42
 
Old 03-13-2010, 02:45 AM   #3
subcon42
LQ Newbie
 
Registered: Jul 2009
Posts: 9

Original Poster
Rep: Reputation: 0
No ... did not work as expected.
 
Old 03-13-2010, 02:55 AM   #4
subcon42
LQ Newbie
 
Registered: Jul 2009
Posts: 9

Original Poster
Rep: Reputation: 0
AH, there we go. Got it working:

/^(From|Return-Path):.*(\<me@domain1\.com\>|\<me2@domain2\.com\>)/ REJECT forged sender address in $1: header: $2.

Its all in the escape characters (e.g: instead of \b \b, I used (\<$email.addr\>)).

subcon42
 
Old 03-13-2010, 04:56 AM   #5
spampig
Member
 
Registered: Feb 2010
Location: /Earth/UK/England/Hampshire
Distribution: Debian, Ubuntu, CentOS, Slackware
Posts: 262
Blog Entries: 2

Rep: Reputation: 56
You can also do it like this (slightly more work, but less cryptic)

1. Create '/etc/postfix/spoofmap' (or similar) containing:
Code:
example.com	REJECT spoofing of my domain 
example.org	REJECT spoofing of my domain 
example.net	REJECT spoofing of my domain
2. Postmap it:
Code:
postmap /etc/postfix/spoofmap
3. Edit your main.cf and put it somewhere suitable - suggest in smtpd_recipient_restrictions as shown
Code:
smtpd_recipient_restrictions =
        permit_mynetworks
        permit_sasl_authenticated
        reject_unauth_destination
        #do spoof protection
        check_sender_access hash:/etc/postfix/spoofmap
4. reload Postfix
 
Old 08-29-2010, 03:56 PM   #6
Eduardo Nunes
LQ Newbie
 
Registered: Aug 2010
Location: /root/SouthAmerica/Brazil/SaoPaulo/SP
Distribution: Slackware
Posts: 24

Rep: Reputation: 2
Smile

Greetings subcon42,

What you want to do is possible with a postfix content_filter.

I have made one and posted here.

Have Fun!
 
Old 08-30-2010, 08:00 AM   #7
subcon42
LQ Newbie
 
Registered: Jul 2009
Posts: 9

Original Poster
Rep: Reputation: 0
Thanks to both spampig and Eduardo_Nunes - both suggestions were very enlightening and will help me greatly.

Thank you

subcon42
 
  


Reply

Tags
postfix, regex


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Postfix - Header V3 DSA signature: NOKEY justemail Linux - Newbie 2 06-02-2009 03:14 AM
postfix - changing display part of header tklima Linux - Server 1 12-28-2007 03:56 AM
postfix X-extra-header-information: paul_mat Linux - Software 1 05-16-2006 04:10 PM
linux 9 and java script error - premature end of script header sibil Linux - Newbie 0 01-06-2004 04:21 PM
postfix header check sirjosi Linux - Security 6 12-02-2003 07:09 PM


All times are GMT -5. The time now is 06:16 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration