Header und Bodychecks mit Postfix 2.11.3 unter CentOS 7.x
Bei der Überlegungen zu den Anforderungen an unseren Mailserver haben wird uns schon mal grundsätzlich Überlegt, das Thema Header- und Bodychecks bei der Bewertung von Nachrichten mit einzubeziehen.
Ob die Filterung von From:-Headern ein geeignetes Mittel beim der SPAM-Bewertung sein kann, muss sich jeder selbst gut überlegen, ist es doch ein leichtes Absenderangaben beim From:-Headern zu fälschen. Nichts desto Trotz, kommt es immer wieder vor, dass Kunden Nachrichten, die einem bestimmten Muster folgen, nicht mehr haben wollen. Wir werden bei der Konfiguration unseres Mailservers also soweit vorbereiten, dass im Notfall schnell und einfach entsprechende Regeln bei den Header- wie auch Body-Checks angelegt und genutzt werden können.
main.cf
Damit wir später die einfache Möglichkeiten haben, basierend auf bestimmte Inhalte im Mailheader bzw. Mailbody, Nachrichten zu bewerten oder gar zu manipulieren, werden wir nun noch unsere Postfix-Hauptkonfigurationsdatei main.cf erweitern.
Wir legen uns in unserer Konfigurationsdatei /etc/postfix/main.cf eine neue Section SPAM ABWEHRMECHANISMEN - INTERNER POSTFIX CONTENT-FILTER an. Dort verweisen wir auf die beiden Lookup-Tebellen zur Contentfilterung.
# vim /etc/postfix/main.cf
... ################################################################################ ## SPAM ABWEHRMECHANISMEN - INTERNER POSTFIX CONTENT-FILTER # # Django : 2014-10-15 - Lookup-Tabelle zum Verwalten der Routinen zur # inhaltliche Prüfung der eMail-Header. Nach dem Ändern der Tabelle # header_check_maps ist ein "systemctl reload postfix.service" # durchzuführen, damit Postfix diese neu einliest! # default: header_checks = header_checks = pcre:/etc/postfix/header_checks_map # Django : 2014-10-15 - Lookup-Tabelle zum Verwalten der Routinen zur # inhaltliche Prüfung der eMail-Bodies. Nach dem Ändern der Tabelle # body_check_maps ist ein "systemctl reload postfix.service" # durchzuführen, damit Postfix diese neu einliest! # default: body_checks = body_checks = pcre:/etc/postfix/body_checks_map
Voraussetzung hierzu (Perl Compatible Regular Expressions) ist natürlich die Unterstützung des installierten Postfix. Mit folgender Abfrage können wir überprüfen, ob pcre unterstützt wird.
# postconf -m | grep pcre
pcre
Die pcre-Unterstützung bei Postfix 2.11.3 unter CentOS 7.x ist natürlich bereits vorhanden!
Trifft das gewählte Suchmuster bei unseren PRCE1) zu, so haben wir unter anderem folgene Möglichkeiten:
- REJECT Nachricht mit einem fatalen Fehler 5xx ablehnen
- REJECT MSG Nachricht mit dem Text MSG ablehnen
- DISCARD Die Nachricht wird verworfen und zwar an alle Empfänger, sobald einer der Empfänger via DISCARD abgelehnt wird. Dem Einliefernden client wir eine erfolgreiche Zustellung mittels 250 OK vorgegaukelt.
Im Konfigurationsverzeichnis von Postfix finden wir für weitere Beschreibungen die Manpage für den Einsatz und die Verwendung der body- und header-checks. Dort finden sich jede Menge hilfreicher Tips zur Postfix built-in Content Inspection von Wietse Venema.
# less /etc/postfix/main.cf
- /etc/postfix/main.cf
# HEADER_CHECKS(5) HEADER_CHECKS(5) # # NAME # header_checks - Postfix built-in content inspection # # SYNOPSIS # header_checks = pcre:/etc/postfix/header_checks # mime_header_checks = pcre:/etc/postfix/mime_header_checks # nested_header_checks = pcre:/etc/postfix/nested_header_checks # body_checks = pcre:/etc/postfix/body_checks # # postmap -q "string" pcre:/etc/postfix/filename # postmap -q - pcre:/etc/postfix/filename <inputfile # # DESCRIPTION # This document describes access control on the content of # message headers and message body lines; it is implemented # by the Postfix cleanup(8) server before mail is queued. # See access(5) for access control on remote SMTP client # information. # # Each message header or message body line is compared # against a list of patterns. When a match is found the # corresponding action is executed, and the matching process # is repeated for the next message header or message body # line. # # For examples, see the EXAMPLES section at the end of this # manual page. # # Postfix header or body_checks are designed to stop a flood # of mail from worms or viruses; they do not decode attach- # ments, and they do not unzip archives. See the documents # referenced below in the README FILES section if you need # more sophisticated content analysis. # # Postfix supports four built-in content inspection classes: # # header_checks # These are applied to initial message headers # (except for the headers that are processed with # mime_header_checks). # # mime_header_checks (default: $header_checks) # These are applied to MIME related message headers # only. # # This feature is available in Postfix 2.0 and later. # # nested_header_checks (default: $header_checks) # These are applied to message headers of attached # email messages (except for the headers that are # processed with mime_header_checks). # # This feature is available in Postfix 2.0 and later. # # body_checks # These are applied to all other content, including # multi-part message boundaries. # # With Postfix versions before 2.0, all content after # the initial message headers is treated as body con- # tent. # # Note: message headers are examined one logical header at a # time, even when a message header spans multiple lines. # Body lines are always examined one line at a time. # # COMPATIBILITY # With Postfix version 2.2 and earlier specify "postmap -fq" # to query a table that contains case sensitive patterns. By # default, regexp: and pcre: patterns are case insensitive. # # TABLE FORMAT # This document assumes that header and body_checks rules # are specified in the form of Postfix regular expression # lookup tables. Usually the best performance is obtained # with pcre (Perl Compatible Regular Expression) tables, but # the slower regexp (POSIX regular expressions) support is # more widely available. Use the command "postconf -m" to # find out what lookup table types your Postfix system sup- # ports. # # The general format of Postfix regular expression tables is # given below. For a discussion of specific pattern or # flags syntax, see pcre_table(5) or regexp_table(5), # respectively. # # /pattern/flags action # When /pattern/ matches the input string, execute # the corresponding action. See below for a list of # possible actions. # # !/pattern/flags action # When /pattern/ does not match the input string, # execute the corresponding action. # # if /pattern/flags # # endif Match the input string against the patterns between # if and endif, if and only if the same input string # also matches /pattern/. The if..endif can nest. # # Note: do not prepend whitespace to patterns inside # if..endif. # # if !/pattern/flags # # endif Match the input string against the patterns between # if and endif, if and only if the same input string # does not match /pattern/. The if..endif can nest. # # blank lines and comments # Empty lines and whitespace-only lines are ignored, # as are lines whose first non-whitespace character # is a `#'. # # multi-line text # A pattern/action line starts with non-whitespace # text. A line that starts with whitespace continues # a logical line. # # TABLE SEARCH ORDER # For each line of message input, the patterns are applied # in the order as specified in the table. When a pattern is # found that matches the input line, the corresponding # action is executed and then the next input line is # inspected. # # TEXT SUBSTITUTION # Substitution of substrings from the matched expression # into the action string is possible using the conventional # Perl syntax ($1, $2, etc.). The macros in the result # string may need to be written as ${n} or $(n) if they # aren't followed by whitespace. # # Note: since negated patterns (those preceded by !) return # a result when the expression does not match, substitutions # are not available for negated patterns. # # ACTIONS # Action names are case insensitive. They are shown in upper # case for consistency with other Postfix documentation. # # DISCARD optional text... # Claim successful delivery and silently discard the # message. Log the optional text if specified, oth- # erwise log a generic message. # # Note: this action disables further header or # body_checks inspection of the current message and # affects all recipients. To discard only one recip- # ient without discarding the entire message, use the # transport(5) table to direct mail to the discard(8) # service. # # This feature is available in Postfix 2.0 and later. # # DUNNO Pretend that the input line did not match any pat- # tern, and inspect the next input line. This action # can be used to shorten the table search. # # For backwards compatibility reasons, Postfix also # accepts OK but it is (and always has been) treated # as DUNNO. # # This feature is available in Postfix 2.1 and later. # # FILTER transport:destination # Write a content filter request to the queue file, # and inspect the next input line. After the com- # plete message is received it will be sent through # the specified external content filter. More infor- # mation about external content filters is in the # Postfix FILTER_README file. # # Note: this action overrides the content_filter set- # ting, and affects all recipients of the message. In # the case that multiple FILTER actions fire, only # the last one is executed. # # This feature is available in Postfix 2.0 and later. # # HOLD optional text... # Arrange for the message to be placed on the hold # queue, and inspect the next input line. The mes- # sage remains on hold until someone either deletes # it or releases it for delivery. Log the optional # text if specified, otherwise log a generic message. # # Mail that is placed on hold can be examined with # the postcat(1) command, and can be destroyed or # released with the postsuper(1) command. # # Note: use "postsuper -r" to release mail that was # kept on hold for a significant fraction of $maxi- # mal_queue_lifetime or $bounce_queue_lifetime, or # longer. Use "postsuper -H" only for mail that will # not expire within a few delivery attempts. # # Note: this action affects all recipients of the # message. # # This feature is available in Postfix 2.0 and later. # # IGNORE Delete the current line from the input, and inspect # the next input line. # # PREPEND text... # Prepend one line with the specified text, and # inspect the next input line. # # Notes: # # o The prepended text is output on a separate # line, immediately before the input that # triggered the PREPEND action. # # o The prepended text is not considered part of # the input stream: it is not subject to # header/body checks or address rewriting, and # it does not affect the way that Postfix adds # missing message headers. # # o When prepending text before a message header # line, the prepended text must begin with a # valid message header label. # # o This action cannot be used to prepend multi- # line text. # # This feature is available in Postfix 2.1 and later. # # REDIRECT user@domain # Write a message redirection request to the queue # file, and inspect the next input line. After the # message is queued, it will be sent to the specified # address instead of the intended recipient(s). # # Note: this action overrides the FILTER action, and # affects all recipients of the message. If multiple # REDIRECT actions fire, only the last one is exe- # cuted. # # This feature is available in Postfix 2.1 and later. # # REPLACE text... # Replace the current line with the specified text, # and inspect the next input line. # # This feature is available in Postfix 2.2 and later. # The description below applies to Postfix 2.2.2 and # later. # # Notes: # # o When replacing a message header line, the # replacement text must begin with a valid # header label. # # o The replaced text remains part of the input # stream. Unlike the result from the PREPEND # action, a replaced message header may be # subject to address rewriting and may affect # the way that Postfix adds missing message # headers. # # REJECT optional text... # Reject the entire message. Reply with optional # text... when the optional text is specified, other- # wise reply with a generic error message. # # Note: this action disables further header or # body_checks inspection of the current message and # affects all recipients. # # Postfix version 2.3 and later support enhanced sta- # tus codes. When no code is specified at the begin- # ning of optional text..., Postfix inserts a default # enhanced status code of "5.7.1". # # WARN optional text... # Log a warning with the optional text... (or log a # generic message), and inspect the next input line. # This action is useful for debugging and for testing # a pattern before applying more drastic actions. # # BUGS # Empty lines never match, because some map types mis-behave # when given a zero-length search string. This limitation # may be removed for regular expression tables in a future # release. # # Many people overlook the main limitations of header and # body_checks rules. # # o These rules operate on one logical message header # or one body line at a time. A decision made for one # line is not carried over to the next line. # # o If text in the message body is encoded (RFC 2045) # then the rules need to be specified for the encoded # form. # # o Likewise, when message headers are encoded (RFC # 2047) then the rules need to be specified for the # encoded form. # # Message headers added by the cleanup(8) daemon itself are # excluded from inspection. Examples of such message headers # are From:, To:, Message-ID:, Date:. # # Message headers deleted by the cleanup(8) daemon will be # examined before they are deleted. Examples are: Bcc:, Con- # tent-Length:, Return-Path:. # # CONFIGURATION PARAMETERS # body_checks # Lookup tables with content filter rules for message # body lines. These filters see one physical line at # a time, in chunks of at most $line_length_limit # bytes. # # body_checks_size_limit # The amount of content per message body segment # (attachment) that is subjected to $body_checks fil- # tering. # # header_checks # # mime_header_checks (default: $header_checks) # # nested_header_checks (default: $header_checks) # Lookup tables with content filter rules for message # header lines: respectively, these are applied to # the initial message headers (not including MIME # headers), to the MIME headers anywhere in the mes- # sage, and to the initial headers of attached mes- # sages. # # Note: these filters see one logical message header # at a time, even when a message header spans multi- # ple lines. Message headers that are longer than # $header_size_limit characters are truncated. # # disable_mime_input_processing # While receiving mail, give no special treatment to # MIME related message headers; all text after the # initial message headers is considered to be part of # the message body. This means that header_checks is # applied to all the initial message headers, and # that body_checks is applied to the remainder of the # message. # # Note: when used in this manner, body_checks will # process a multi-line message header one line at a # time. # # EXAMPLES # Header pattern to block attachments with bad file name # extensions. For convenience, the PCRE /x flag is speci- # fied, so that there is no need to collapse the pattern # into a single line of text. The purpose of the # [[:xdigit:]] sub-expressions is to recognize Windows CLSID # strings. # # /etc/postfix/main.cf: # header_checks = pcre:/etc/postfix/header_checks.pcre # # /etc/postfix/header_checks.pcre: # /^Content-(Disposition|Type).*name\s*=\s*"?(.*(\.|=2E)( # ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe| # hlp|ht[at]| # inf|ins|isp|jse?|lnk|md[betw]|ms[cipt]|nws| # \{[[:xdigit:]]{8}(?:-[[:xdigit:]]{4}){3}-[[:xdigit:]]{12}\}| # ops|pcd|pif|prf|reg|sc[frt]|sh[bsm]|swf| # vb[esx]?|vxd|ws[cfh]))(\?=)?"?\s*(;|$)/x # REJECT Attachment name "$2" may not end with ".$4" # # Body pattern to stop a specific HTML browser vulnerability # exploit. # # /etc/postfix/main.cf: # body_checks = regexp:/etc/postfix/body_checks # # /etc/postfix/body_checks: # /^<iframe src=(3D)?cid:.* height=(3D)?0 width=(3D)?0>$/ # REJECT IFRAME vulnerability exploit # # SEE ALSO # cleanup(8), canonicalize and enqueue Postfix message # pcre_table(5), format of PCRE lookup tables # regexp_table(5), format of POSIX regular expression tables # postconf(1), Postfix configuration utility # postmap(1), Postfix lookup table management # postsuper(1), Postfix janitor # postcat(1), show Postfix queue file contents # RFC 2045, base64 and quoted-printable encoding rules # RFC 2047, message header encoding for non-ASCII text # # README FILES # Use "postconf readme_directory" or "postconf html_direc- # tory" to locate this information. # DATABASE_README, Postfix lookup table overview # CONTENT_INSPECTION_README, Postfix content inspection overview # BUILTIN_FILTER_README, Postfix built-in content inspection # BACKSCATTER_README, blocking returned forged mail # # LICENSE # The Secure Mailer license must be distributed with this # software. # # AUTHOR(S) # Wietse Venema # IBM T.J. Watson Research # P.O. Box 704 # Yorktown Heights, NY 10598, USA # # HEADER_CHECKS(5)
header_checks_map
Wollen wir nun Nachrichten von bestimmten Absendern oder anderen Einträgen in den Headerzeilen generell blocken, so legen wir uns folgende Konfigurationsdatei /etc/postfix/header_checks_map an.
# vim /etc/postfix/header_checks_map
- /etc/postfix/header_checks_map
# Django : 2012-02-06 # Kapitel 13.5 Filtern von eMails nach Inhalt # Kapitel 12.3 Überprüfen von Headern # In der Postfix-Konfigurationsdatei /etc/postfix/main.cf muss # body_checks = pcre:/etc/postfix/body_check_maps gesetzt sein! # # Nach dem Ändern der Datei ist ein "systemctl reload postfix.service" durchzuführen! # # Die Nummern hinter dem REJECT tauchen später als SMTP-Error und auch im Mailserver-Log auf. # Die auslösende Filter-Regel, die den Block ausgelöst hat, ist somit leicht wieder zu finden. # # Ausnahmeregelung für den sicheren IT-/Mailbetrieb im heimischen Netzwerk # # Domeus hat bis heute nicht den Unterschied zwischen Mailheader-To und # SMTP-Envelope-To verstanden und fabriziert seit nunmehr über sieben Jahren in # schöner Regelmäßigkeit Mailschleifen im vier/fünfstelligen Bereich. # /^Received:.*domeus\.com/ REJECT Domeus baut Mailschleifen und hat wichtige RFCs nicht verstanden # # Dauerhaft genutzte Regelungen: # =============================================== # [Immer mit aufsteiger Nummer sauber eintragen!] # If /^Subject:/i /^Subject:.*Sicherheitsaktualisierung/ REJECT Header-Subject-Spamschutzregel Subj-1071 /^Subject:.*PARTNERSHIP.*/ REJECT Header-Subject-Spamschutzregel Subj-1070 /^Subject:.*TEMPORARY JOB OFFER.*/ REJECT Header-Subject-Spamschutzregel Subj-1069 /^Subject:.*URGENT ATTENTION.*/ REJECT Header-Subject-Spamschutzregel Subj-1068 /^Subject:.*Penis.*/ REJECT Header-Subject-Spamschutzregel Subj-1067 /^Subject:.*Potenzschwache.*/ REJECT Header-Subject-Spamschutzregel Subj-1066 /^Subject:.*saxaelle.*/ REJECT Header-Subject-Spamschutzregel Subj-1065 /^Subject:.*formula for men.*/ REJECT Header-Subject-Spamschutzregel Subj-1064 /^Subject:.*wife happiness.*/ REJECT Header-Subject-Spamschutzregel Subj-1063 /^Subject:.*rentiert sich.*/ REJECT Header-Subject-Spamschutzregel Subj-1062 /^Subject:.*caught on camera./ REJECT Header-Subject-Spamschutzregel Subj-1061 /^Subject:.*Betriebsstaette sucht Beschaeftigte.*/ REJECT Header-Subject-Spamschutzregel Subj-1060 /^Subject:.*Stimulate her.*/ REJECT Header-Subject-Spamschutzregel Subj-1059 /^Subject:.*WITH DUE RESPECT.*/ REJECT Header-Subject-Spamschutzregel Subj-1058 /^Subject:.*Bigger snake.*/ REJECT Header-Subject-Spamschutzregel Subj-1057 /^Subject:.*Bang her.*/ REJECT Header-Subject-Spamschutzregel Subj-1056 /^Subject:.*young and enhanced.*/ REJECT Header-Subject-Spamschutzregel Subj-1055 /^Subject:.*YOUR ASSISTANCE.*/ REJECT Header-Subject-Spamschutzregel Subj-1054 /^Subject:.*Helping people.*/ REJECT Header-Subject-Spamschutzregel Subj-1053 /^Subject:.*Enhancing.*/ REJECT Header-Subject-Spamschutzregel Subj-1052 /^Subject:.*Blaue Pillchen.*/ REJECT Header-Subject-Spamschutzregel Subj-1051 /^Subject:.*Impotenz.*/ REJECT Header-Subject-Spamschutzregel Subj-1050 /^Subject:.*ge.fi.ckt.*/ REJECT Header-Subject-Spamschutzregel Subj-1049 /^Subject:.*Softshell.*/ REJECT Header-Subject-Spamschutzregel Subj-1048 /^Subject:.*rollige Ramona.*/ REJECT Header-Subject-Spamschutzregel Subj-1047 /^Subject:.*Dringende Gesch�ft.*/ REJECT Header-Subject-Spamschutzregel Subj-1046 /^Subject:.*Se-xy.*/ REJECT Header-Subject-Spamschutzregel Subj-1045 /^Subject:.*private party.*/ REJECT Header-Subject-Spamschutzregel Subj-1044 /^Subject:.*williges Teeny.*/ REJECT Header-Subject-Spamschutzregel Subj-1043 /^Subject:.*Special Offer.*/ REJECT Header-Subject-Spamschutzregel Subj-1042 /^Subject:.*LiveCams.*/ REJECT Header-Subject-Spamschutzregel Subj-1041 /^Subject:.*gevoegelt.*/ REJECT Header-Subject-Spamschutzregel Subj-1040 /^Subject:.*gefi.ckte.*/ REJECT Header-Subject-Spamschutzregel Subj-1039 /^Subject:.*medications.*/ REJECT Header-Subject-Spamschutzregel Subj-1038 /^Subject:.*Drecksstueck.*/ REJECT Header-Subject-Spamschutzregel Subj-1037 /^Subject:.*Miststueck.*/ REJECT Header-Subject-Spamschutzregel Subj-1036 /^Subject:.*verdorbene Hausfrau.*/ REJECT Header-Subject-Spamschutzregel Subj-1035 /^Subject:.*Ficken.*/ REJECT Header-Subject-Spamschutzregel Subj-1034 /^Subject:.*verdorbene Schlampe.*/ REJECT Header-Subject-Spamschutzregel Subj-1033 /^Subject:.*fi.ckbereit.*/ REJECT Header-Subject-Spamschutzregel Subj-1032 /^Subject:.*immer feucht.*/ REJECT Header-Subject-Spamschutzregel Subj-1031 /^Subject:.*lets chat.*/ REJECT Header-Subject-Spamschutzregel Subj-1030 /^Subject:.*bumsbare.*/ REJECT Header-Subject-Spamschutzregel Subj-1029 /^Subject:.*geiles Weib.*/ REJECT Header-Subject-Spamschutzregel Subj-1028 /^Subject:.*Dild_o.*/ REJECT Header-Subject-Spamschutzregel Subj-1027 /^Subject:.*kommen einmal pro Stunde.*/ REJECT Header-Subject-Spamschutzregel Subj-1026 /^Subject:.*secret to pleasuring.*/ REJECT Header-Subject-Spamschutzregel Subj-1025 /^Subject:.*will schlucken.*/ REJECT Header-Subject-Spamschutzregel Subj-1024 /^Subject:.*an-algeiles.*/ REJECT Header-Subject-Spamschutzregel Subj-1023 /^Subject:.*impotence.*/ REJECT Header-Subject-Spamschutzregel Subj-1022 /^Subject:.*deutscher Freund.*/ REJECT Header-Subject-Spamschutzregel Subj-1021 /^Subject:.*Po-rno.*/ REJECT Header-Subject-Spamschutzregel Subj-1020 /^Subject:.*Entspannt 60 Minuten nicht kommen.*/ REJECT Header-Subject-Spamschutzregel Subj-1019 /^Subject:.*Never be small and tiny again.*/ REJECT Header-Subject-Spamschutzregel Subj-1018 /^Subject:.*Haben Sie wieder Spass am Leben.*/ REJECT Header-Subject-Spamschutzregel Subj-1017 /^Subject:.*D ildo.*/ REJECT Header-Subject-Spamschutzregel Subj-1016 /^Subject:.*chat with you.*/ REJECT Header-Subject-Spamschutzregel Subj-1015 /^Subject:.*zu frueh kommen.*/ REJECT Header-Subject-Spamschutzregel Subj-1014 /^Subject:.*aufgeschlossene Kontakte.*/ REJECT Header-Subject-Spamschutzregel Subj-1013 /^Subject:.*Viagra.*/ REJECT Header-Subject-Spamschutzregel Subj-1012 /^Subject:.*gefic-kt.*/ REJECT Header-Subject-Spamschutzregel Subj-1011 /^Subject:.*Frau sucht aufgeschlossenen Mann.*/ REJECT Header-Subject-Spamschutzregel Subj-1010 /^Subject:.*Nach 10 Minuten kommen.*/ REJECT Header-Subject-Spamschutzregel Subj-1009 /^Subject:.*Mann lebt nur einmal.*/ REJECT Header-Subject-Spamschutzregel Subj-1008 /^Subject:.*You have received an eCard.*/ REJECT Header-Subject-Spamschutzregel Subj-1007 /^Subject:.*D.i.l.d.o.*/ REJECT Header-Subject-Spamschutzregel Subj-1006 /^Subject:.*naturgeil.*/ REJECT Header-Subject-Spamschutzregel Subj-1005 /^Subject:.*So werden sie von jeder Frau vergoettert!/ REJECT Header-Subject-Spamschutzregel Subj-1004 /^Subject:.*Advocacy.Notary Notice.*/ REJECT Header-Subject-Spamschutzregel Subj-1003 /^Subject:.*Webcam Luder.*/ REJECT Header-Subject-Spamschutzregel Subj-1002 /^Subject:.*Potenzprobleme.*/ REJECT Header-Subject-Spamschutzregel Subj-1001 /^Subject:.*RedBull fur Ihr bestes Stueck/ REJECT Header-Subject-Spamschutzregel Subj-1000 Endif # # und das Ganze nach Header-From # ============================== # #If /^From:/i #/^From: .*Online Spiele.*/ REJECT Header-From-Spamschutzregel From-106 #/^From: .*Apotheken-News.*/ REJECT Header-From-Spamschutzregel From-1005 #/^From: .*Kasino.*/ REJECT Header-From-Spamschutzregel From-1004 #/^From: .*Pharmacy.*/ REJECT Header-From-Spamschutzregel From-1003 #/^From: .*Royal Club Casino.*/ REJECT Header-From-Spamschutzregel From-1002 #/^From: .*Euro Dice Casino.*/ REJECT Header-From-Spamschutzregel From-1001 #/^From:.*happydigits.de/ REJECT Header-From-Spamschutzregel From-1000 #Endif # Django : 2014-10-10 ##If /^To:/i ##/^To: .*dj4n90@piraten-it.guru.*/ 456 I hob grod koan bock, vozupf de! ##Endif # # generelle Filerregelungen nach den üblichen Verdächtigen # ======================================================== # /^Date: .* 200[0-7]/ REJECT Your email has a date from the past. Fix your system clock and try again. /^Date: .* 19[0-9][0-9]/ REJECT Your email has a date from the past. Fix your system clock and try again. If /^X-Mailer:/i /^X-Mailer: 0001/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: Avalanche/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: Crescent Internet Tool/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: DiffondiCool/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: E-Mail Delivery Agent/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: Emailer Platinum/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: Entity/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: Extractor/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: Floodgate/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: GOTO Software Sarbacane/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: MailWorkz/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: MassE-Mail/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: MaxBulk.Mailer/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: News Breaker Pro/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: SmartMailer/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: StormPort/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. /^X-Mailer: SuperMail-2/ REJECT You used an email program that is used almost exclusively for spam. We do not accept email sent using this program. Endif
body_checks_map
Wollen wir nun Nachrichten von bestimmten Absendern oder anderen Einträgen in den Headerzeilen generell blocken, so legen wir uns folgende Konfigurationsdatei /etc/postfix/body_checks_map an.
# /etc/postfix/body_checks_map
- /etc/postfix/body_checks_map
# Django : 2012-02-06 # Kapitel 13.5 Filtern von eMails nach Inhalt # Kapitel 12.6 Body prüfen # In der Postfix-Konfigurationsdatei /etc/postfix/main.cf muss # body_checks = pcre:/etc/postfix/header_check_maps gesetzt sein! # # Nach dem Ändern der Datei ist ein "systemctl reload postfix.service" reload durchzuführen! # # Die Nummern hinter dem REJECT tauchen später als SMTP-Error und auch im Mailserver-Log auf. # Die auslösende Filter-Regel, die den Block ausgelöst hat, ist somit leicht wieder zu finden. # #/.*http:\/\/www.csu.de:80\/.*/ REJECT Body_Check_Rule_4_Dummies: 0002 #/.*was@qualys.com.*/ REJECT Body_Check_Rule_4_Dummies: 0001
Aktivierung
Zum Aktivieren unserer Konfigurationsänderungen führen wir nun einen Reload unseres Postfix-Servers durch.
# systemctl reload postfix.service
Bei Bedarf können wir uns noch vergewissern und prüfen welchen Status unser MX nun hat.
# systemctl status postfix.service
postfix.service - Postfix Mail Transport Agent
Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled)
Active: active (running) since Mon 2014-11-10 20:57:24 CET; 1 day 17h ago
Process: 15133 ExecStop=/usr/sbin/postfix stop (code=exited, status=0/SUCCESS)
Process: 17334 ExecReload=/usr/sbin/postfix reload (code=exited, status=0/SUCCESS)
Process: 15148 ExecStart=/usr/sbin/postfix start (code=exited, status=0/SUCCESS)
Process: 15146 ExecStartPre=/usr/libexec/postfix/chroot-update (code=exited, status=0/SUCCESS)
Process: 15143 ExecStartPre=/usr/libexec/postfix/aliasesdb (code=exited, status=0/SUCCESS)
Main PID: 15221 (master)
CGroup: /system.slice/postfix.service
├─15221 /usr/libexec/postfix/master -w
├─17345 qmgr -l -t unix -u
└─17346 pickup -l -t unix -u
Nov 12 14:02:04 vml000087.dmz.nausch.org postfix/pickup[17257]: D0A24C00088: uid=0 from=<root>
Nov 12 14:02:04 vml000087.dmz.nausch.org postfix/cleanup[17292]: D0A24C00088: message-id=<20141112130...>
Nov 12 14:02:04 vml000087.dmz.nausch.org postfix/qmgr[15223]: D0A24C00088: from=<root@nausch.org>, s...e)
Nov 12 14:02:05 vml000087.dmz.nausch.org postfix/lmtp[17298]: D0A24C00088: to=<django@nausch.org>, o...d)
Nov 12 14:02:05 vml000087.dmz.nausch.org postfix/qmgr[15223]: D0A24C00088: removed
Nov 12 14:35:39 vml000087.dmz.nausch.org systemd[1]: Reloading Postfix Mail Transport Agent.
Nov 12 14:35:39 vml000087.dmz.nausch.org postfix/master[15221]: reload -- version 2.11.3, configurat...ix
Nov 12 14:35:39 vml000087.dmz.nausch.org systemd[1]: Reloaded Postfix Mail Transport Agent.
Nov 12 14:35:47 vml000087.dmz.nausch.org systemd[1]: Reloading Postfix Mail Transport Agent.
Nov 12 14:35:47 vml000087.dmz.nausch.org postfix/master[15221]: reload -- version 2.11.3, configurat...ix
Nov 12 14:35:47 vml000087.dmz.nausch.org systemd[1]: Reloaded Postfix Mail Transport Agent.
Hint: Some lines were ellipsized, use -l to show in full.
Links
1)
Perl Compatible Regular Expressions
127.0.0.1