[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [linux] Filtres sur les entêtes/corps detexte avec postfix ?



Voici mes headers checks et body checks.

Hope this helps.


-- 
Alexandre Dulaunoy		http://www.foo.be/
AD993-RIPE			http://www.ael.be/
"People who fight may lose.  People who do not fight have already lost."
  - Bertolt Brecht


On 23 May 2002, Kennedy van Dam Eric wrote:

> Salut,
>
> Suite à une invasion de mails non-sollicités, il faudrait que je mette
> en place un filtre dans postfix.
>
> J'ai regardé en vitesse sur le site de Postfix et il existe les règles
> header_checks et body_checks. Seulement les exemples donnés sont plutôt
> succins. Je remarque cependant qu'ils semblent être fort proches des
> filtres procmail.
>
> Quelqu'un peut-il me confirmer ceci ? et par la même occasion me donner
> une url ou trouver plus d'info sur la syntaxe de ces filtres ?
>
> Merci
>
#
# header_checks for postfix configuration
#
# CHOI Junho <cjh@kr.FreeBSD.org>
# 2001/11/28 ~
#
# added content disposition 
# Alexandre Dulaunoy <adulau@foo.be> 
# 29/03/2002
#
#

/^Content-(Disposition|Type):.*name=".*\.scr/ REJECT
/^Content-(Disposition|Type):.*name=".*\.pif/ REJECT
/^Content-(Disposition|Type):.*name=".*\.exe/ REJECT
/^Content-(Disposition|Type):.*name=".*\.com/ REJECT
/^Content-(Disposition|Type):.*name=".*\.bat/ REJECT
/^Content-(Disposition|Type):.*name=".*\.chm/ REJECT

#
# X-Mailer Header
#
/^X-Mailer:.*Red\ Spider/			REJECT
/^X-Mailer:.*redspider/				REJECT
/^X-Mailer:.*Davinci\ Address\ Mailer/		REJECT
/^X-Mailer:.*mBiznet/				REJECT
/^X-Mailer:.*Mail\ Bomber/			REJECT
/^X-Mailer:.*CrazyNickels/			REJECT
# block unusual OE mailer
# such as <Microsoft Outlook Express 4.72.3110.5>
/^X-Mailer:.*<Microsoft/			REJECT
# for lgcard...
#/^X-Mailer:.*INFOMailer/			REJECT
/^X-Mailer:.*DiffondiCool/			REJECT
/^X-Mailer:.*Mailtouch/				REJECT
/^X-Mailer:.*Novasoft Sagittarius Professional/	REJECT
/^X-Mailer:.*SoftForum-WebMail/			REJECT
/^X-Mailer:.*[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]$/	REJECT
/^X-Mailer:.*Merge\ \&\ Group\ Mailer/		REJECT
/^X-Mailer:.*Way-SERIES\ Mailer/		REJECT
/^X-Mailer:.*Microsoft Outloo$/			REJECT
/^X-Mailer:.*LightningMail/			REJECT
/^X-Mailer:.*MailKing/				REJECT
/^X-Mailer:.*WC Mail/				REJECT
/^X-Mailer:.*The Bat!/				REJECT
/^X-Mailer:.*emsoft/				REJECT
/^X-Mailer:.*MegaMail/				REJECT
/^X-Mailer:.*Easy Mail/				REJECT
/^X-Mailer:.*SimpleX Mailer/			REJECT
/^X-Mailer:.*NetPIMS/				REJECT
/^X-Mailer:.*PG-MAILINGLIST/			REJECT
/^X-Mailer:.*Imoxion MailExpress/		REJECT
/^X-MAILER:/i					REJECT
/^X-Mailer:.*MultiCaster/			REJECT
/^X-Mailer:.*IMMS/				REJECT
/^X-Mailer:.*PHP$/				REJECT
/^X-Mailer:.*TMS\ Enterprise/			REJECT
/^X-Mailer:.*BulkyMailer/			REJECT
/^X-Mailer:.*Mach5\ Mailer/			REJECT
/^X-Mailer:.*VC_IPA/				REJECT
/^X-Mailer:.*CSMTPConnection/			REJECT
/^X-Mailer:.*NMK Mailer/			REJECT

#
# Subject Rejections
#
# spam: palzanet
/^Subject:.*°Ç½ÂÀ»\ ±â¿ø/i			REJECT
/^Subject:.*Mail.*ÀÐÀ»¶§¸¶´Ù/i			REJECT
/^Subject: [a-z0-9]+´Ô/i			REJECT
/^Subject:.*¡Ú»çÁøÀ»/i				REJECT
/^Subject:.*±¤°í/i 				REJECT
/^Subject:.*±¤\ *°í/i 				REJECT
/^Subject:.*ÎÆÍ±/i 				REJECT
/^Subject:.*ÎÆ\ *ͱ/i 				REJECT
/^Subject:.*¼ºÀÎ\ *»çÀÌÆ®/i 			REJECT
/^Subject:.*¼ºÀÎ\ *Á¤º¸/i 			REJECT
/^Subject:.*̵̧/i 				REJECT
/^Subject:.*È«º¸/i 				REJECT
/^Subject:.*È«\ *º¸/i 				REJECT
/^Subject:.*¹«·á/i 				REJECT
/^Subject:.*Ãæ°Ý\ ¾Æ¸£¹ÙÀÌÆ®/i 			REJECT
/^Subject:.*¹«º¸Áõ/i 				REJECT
/^Subject:.*¹«´ãº¸/i 				REJECT
# reject some hoax
/^Subject: ILOVEYOU/            		REJECT
/^Subject: fwd: Joke/           		REJECT
/^Subject:.*PCÁ¤ºñ»ç/i				REJECT
/^Subject:.*á´äþ÷á/i				REJECT
/^Subject:.*ADV/i				REJECT
/^Subject:.*±âµ¶±³°¡Á¤»ç¿ª/i			REJECT
# Melissa
/^Subject:.*Important Message From/		REJECT
# Pretty Park
/^Subject:.*C:\\CoolProgs\\Pretty Park\.exe/	REJECT
# Ecokys
/^Subject:.*¿µ»óÀ¸·Î º¸³»´Â ÆíÁö/i		REJECT
# Klez worm
/^Subject:.*Look at the pretty/			REJECT
/^Subject:.*Some advice on your shortcoming/	REJECT
/^Subject:.*Free XXX Pictures/			REJECT
/^Subject:.*A Free hot porn site/		REJECT
/^Subject:.*Why don't you reply to me/		REJECT
/^Subject:.*Never kiss a stranger/		REJECT
/^Subject:.*How about have dinner with me together/	REJECT
/^Subject:.*Boost Your Windows Reliability/	REJECT
# Brazil spam
/^Subject:.*CONVITE\ HP\ ALERTA/		REJECT
# ksc5601 encoded spam: [±¤°í]: 6 char = 8 Base64
/^Subject:.*=\?ks_c_5601-1987\?B\?W7GksO1d/	REJECT
# ksc5601 encoded spam: [È«º¸]: 6 char = 8 Base64
/^Subject:.*=\?ks_c_5601-1987\?B\?W8irurhd/	REJECT
/^Subject:.*=\?ks_c_5601-1987\?B\?oeFbyKu6uF/	REJECT
# Unacceptable encodings; only in Korea/US
/^Subject:.*=\?MS949\?/				REJECT
/^Subject:.*=\?windows-1251\?/			REJECT
/^Subject:.*=\?koi8-r\?/			REJECT
/^Subject:.*=\?big5\?/				REJECT
/^Subject:.*=\?8859_1\?/			REJECT
/^Subject:.*=\?KSC_5601\?/			REJECT
/^Subject:.*À̻ۿʸ¸°ñ¶óÀÔÀÚ/i			REJECT
/^Subject:.*\[Á¤º¸\]/i 				REJECT
/^Subject:.*¸ÞÀϹ߼Û\ ´ëÇà/i 			REJECT
/^Subject:.*´Ô\ ÀÎÅͳÝ\ »ç¿ë¿¡/i 		REJECT
/^Subject: \(AD\)/i		 		REJECT
/^Subject:.*¼ÖÁ÷È÷\ ¯Æù/i	 		REJECT
# Win32/Myparty.worm.29696
/^Subject:.*new photos from my party/		REJECT
# Win32/Klez???
/^Subject: OnLoad$/i				REJECT
/^Subject:.*¸¶À̼¥/i		 		REJECT
/^Subject:.*Best Adult Webcam Chats/		REJECT
/^Subject:.*SEMINARIO REFORMA LABORAL/		REJECT
/^Subject:.*ÄܽºÆ® Á¤º¸ ÀÔ´Ï´Ù/			REJECT
/^Subject: subscribe/				REJECT
/^Subject: unsubscribe/				REJECT


#
# Message-ID
#
# some spam from kornet
/^Message-ID:.*relay[0-9]\.kornet\.net/		REJECT
/^Message-ID:.*bomul[0-9]\.kornet\.net/		REJECT
# and korea.com
/^Message-ID:.*3w-pop3-a[a-z]\.korea\.com/	REJECT
/^Message-ID:.*3w-smtp-a[a-z]\.korea\.com/	REJECT
# quanta
/^Message-ID:.*<[0-9]+\.[0-9]+\.[0-9]+@localhost>/	REJECT
/^Message-ID:.*<bulk\.[0-9]+\.[0-9]+@>/		REJECT
/^Message-ID:.*totally-fudged-out-message-id/	REJECT
/^Message-ID:.*RND-TEST/			REJECT
/^Message-ID:.*merrychristmas/			REJECT
/^Message-ID:.*printbang\.com/			REJECT
/^Message-ID:\ PM2000/i				REJECT
/^Message-ID:.*atfreeweb\.com/			REJECT
/^Message-ID:.*caramail\.com/			REJECT
/^Message-ID:.*@mail\.kr\.freebsd\.org>/	REJECT

#
# From/To/Cc/Sender Header
#
/^From:.*cashmoney/i				REJECT
/^From:.*163\.net/				REJECT
/^From:.*¹Ù½ºÆ®¸ÞÀÏ/i				REJECT
/^From:.*yesgirl/				REJECT
/^From:.*¸ÖƼÁð³Ý/i				REJECT
/^From:.*¿ùµåž½ºÄð/i				REJECT
/^From:.*¿ÀÇǽºÇÁ¶óÀÚ/i				REJECT
/^From:.*»ç¹«°ü¸®Á¶ÇÕ/i				REJECT
/^From:.*¹Î¿ø»¡¸®´åÄÄ/i				REJECT
/^From:.*nudetour\.com/				REJECT
/^From:.*700-7726/i				REJECT
/^From:.*À̵¿Åë½Å/i				REJECT
/^From:.*±Ý¿¬/i					REJECT
/^From:.*¡Ú¹ý¿ø°æ¸Å/i				REJECT
/^From:.*³ìÀ½±â/i				REJECT
/^From:.*RichMedia.*@/				REJECT
/^From:.*ÇÁ¸°Æ®¹æ/i				REJECT
# nimda or unusual mail
/^From: <>/     				REJECT
/^From:.*Â÷¹æ¼®/i				REJECT
# ÀÌ»ç¸ô
/^From:.*MjRtYWxsKMDMu\+e49Ck/i			REJECT
/^From:.*ÀÌ»ç¸ô/i				REJECT
/^From:.*ÇѼ®ºÀ/i				REJECT
/^From:.*±âÇÁÆ®³ª¶ó/i				REJECT
/^From:.*¿©»ó¿±/i				REJECT
/^From:.*樨毢/i				REJECT
/^From:.*¾ÆÀÌÆ¼¿¡½º/i				REJECT
/^From:.*DVD¿Ã/i				REJECT
/^From:.*=\?KSC_5601\?/				REJECT
/^From:.*¼­¿ï¹Ìµð¾î/i				REJECT
/^From:.*ZALL/i					REJECT
/^From:.*¸íǰ¼îÇθô/i				REJECT
/^From:.*¼¼ÀÏÅÚ/i				REJECT
/^From:.*°¡ÀÚÆù/i				REJECT
/^From:.*¾ÆÀÚ¾ÆÀÚ/i				REJECT
/^From:.*¾ß°ÔÀÓÁî´å³Ý/i				REJECT
# reject too long id
/^From:.*[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]*@/	REJECT
# Buggy To:
/^To: @/					REJECT
/^To:\ *$/					REJECT
# reject too long id: 15 chars
/^To:.*[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]*@/	REJECT
/^From:.*ÇØÇdzÝ/i				REJECT
/^From:.*Àú½Â»çÀÚ/i				REJECT

#
# Date Header
#
/^Date:\ *$/					REJECT
/^Date:\ *[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/	REJECT
#/^Date:.*Ç¥ÁؽÃ/i				REJECT
/^Date:.*Standard Time/				REJECT
/^Date:.*Daylight Time/				REJECT
/^Date:.*AM/i					REJECT
/^Date:.*PM/i					REJECT

#
# C-T-E Header or MIME boundary
#
/^Content-Type:.*boundary=-\+PART_BOUNDARY_[0-9]/	REJECT
/^Content-Type:.*charset=.*CHARSET/		REJECT
# Sircam virus
/^Content-Disposition:.*Multipart message/	REJECT
/boundary=WC_MAIL_PaRt_BoUnDaRy_05151998/	REJECT
/^Content-Type:.*AD_2000_PART/			REJECT
/^Content-Type:.*charset=big5/ 			REJECT
# reject some mail virus
/^Content.*:.*\.vbs/               		REJECT
/^Content.*:.*\.pif/               		REJECT
# nimda
/boundary=\"====_ABC1234567890DEF_====\"/	REJECT
/boundary=\"====_ABC09876j54321DEF_====\"/	REJECT
# are you nuts?
/^Content-Type:.*;;;;;;/ 			REJECT
# block Korean html-only mail
/^Content-Type:.*text\/html.*ks_c_5601-1987/	REJECT
/^Content-Type:.*text\/html.*euc-kr/		REJECT
# some spam
/boundary=\"=\ Multipart\ Boundary\ [0-9]+\"/	REJECT

#
# Received; spam passage
#
# Taiwan spam
/^Received:.*dialup\.seed\.net\.tw/ 		REJECT
/^Received:.*HINET-IP\.hinet\.net/ 		REJECT
/^Received:.*mail.HIGHERWAY.COM.HK/ 		REJECT
/^Received:.*168\.126\.231\.196/ 		REJECT
/^Received:.*rev\.krline\.net/	 		REJECT
/^Received:.*dido\.co\.kr/	 		REJECT

#
# Misc. Header
#
# Organization Header
/^Organization:.*ÇÁ·£µå\ À¯Çпø/i		REJECT
/^Organization:.*Hampton Casino/		REJECT
/^Organization:.*freeandkinky/			REJECT
/^Organization:.*freeamateurass/		REJECT
/^X-Library:.*SeekerCenter\.com/		REJECT
/^X-Library:.*WincusSMTP/			REJECT
#/^X-EM-Version:/				REJECT
#/^X-EM-Registration:/				REJECT
/^Original-Message-ID:.*PM2000/			REJECT
# block CD spammer: an international bullshit!
#/^Received:.*ppp[0-9]\.kornet\.net/		REJECT
#  Regular expression to reject:
#    * numeric-only localparts from aol.com and msn.com
#    * localparts starting with a digit from juno.com
#    * localparts longer than 10 characters from aol.com
/^(From|Sender|To):.*([0-9]+<@(aol|msn)\.com|[0-9][^<]*<@juno\.com|.{10}[^<]+<@aol\.com)/					REJECT
# AD2000
/^X-AD2000-Serial:/ 				REJECT
/^X-AD2000-Register:/ 				REJECT
/^[A-Z].*oddnews/ 				REJECT
# oddnews
/^X-SMTP-MAIL-FROM:.*rayhew/			REJECT
# happy99
/^X-Spanska:.*/					REJECT
# Disallow sender-specified routing. This is a must if you relay mail
# for other domains.
#/[%!@].*@/                             	550 Sender-specified routing rejected
# Postmaster is OK, that way they can talk to us about how to fix their problem.
/^postmaster@.*$/                       	OK
# Protect your outgoing majordomo exploders
/^(.*)-outgoing@(.*)$/!/^owner-.*/      	550 Use ${1}@${2} instead
#
/^X-MDRemoteIP:/				550 Reject X flag known to be spam
#
/^X-Toname:/					REJECT
/^X-User: 2.1-knlnjqnx-kootns-Iinpq/		REJECT

#
# ÀÓ½Ã: ¹Ý¼Û¸ÞÀÏ(»ç¿ëÀÚÀÇ ½ºÇ® Ãʰú)
# block notifies
#/^Subject:.*¸ÞÀÏ\ Àü¼Û\ ½ÇÆÐ\ Å뺸/i 		REJECT
#/^Subject:.*½ºÇ®\ Çã¿ëÇѵµ\ Ãʰú¸ÞÀÏ/i 	REJECT
#/^From:.*NAVER-MAILER@naver.com/i		REJECT
#/^From:.*postmaster@netsgo.com/i 		REJECT
#/^Subject:.*¼ö½ÅÀÚÀÇ\ ¸ÞÀÏ\ ÁÖ¼Ò°¡\ Á¤È®ÇÏÁö\ ¾Ê¾Æ/i REJECT
#/^Subject:.*\[¼ö½Å°ÅºÎ\]/i 			REJECT
#/^Subject:.*ÀÚµ¿´äÀå/i 			REJECT


/^(.*)name\=\"(.*)\.(hta|pif|vbs|vbe|js|jse|cmd|vxd|scr|chm)\"$/ REJECT

/^Content.*\.(hta|pif|vbs|vbe|js|jse|cmd|vxd|scr|shm|lnk)"/ REJECT

/^I send you this file in order to have your advice/  REJECT