[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [linux] Filtres sur les entêtes/corps detexte avec postfix ?
Voici mes headers checks et body checks.
Hope this helps.
--
Alexandre Dulaunoy http://www.foo.be/
AD993-RIPE http://www.ael.be/
"People who fight may lose. People who do not fight have already lost."
- Bertolt Brecht
On 23 May 2002, Kennedy van Dam Eric wrote:
> Salut,
>
> Suite à une invasion de mails non-sollicités, il faudrait que je mette
> en place un filtre dans postfix.
>
> J'ai regardé en vitesse sur le site de Postfix et il existe les règles
> header_checks et body_checks. Seulement les exemples donnés sont plutôt
> succins. Je remarque cependant qu'ils semblent être fort proches des
> filtres procmail.
>
> Quelqu'un peut-il me confirmer ceci ? et par la même occasion me donner
> une url ou trouver plus d'info sur la syntaxe de ces filtres ?
>
> Merci
>
#
# header_checks for postfix configuration
#
# CHOI Junho <cjh@kr.FreeBSD.org>
# 2001/11/28 ~
#
# added content disposition
# Alexandre Dulaunoy <adulau@foo.be>
# 29/03/2002
#
#
/^Content-(Disposition|Type):.*name=".*\.scr/ REJECT
/^Content-(Disposition|Type):.*name=".*\.pif/ REJECT
/^Content-(Disposition|Type):.*name=".*\.exe/ REJECT
/^Content-(Disposition|Type):.*name=".*\.com/ REJECT
/^Content-(Disposition|Type):.*name=".*\.bat/ REJECT
/^Content-(Disposition|Type):.*name=".*\.chm/ REJECT
#
# X-Mailer Header
#
/^X-Mailer:.*Red\ Spider/ REJECT
/^X-Mailer:.*redspider/ REJECT
/^X-Mailer:.*Davinci\ Address\ Mailer/ REJECT
/^X-Mailer:.*mBiznet/ REJECT
/^X-Mailer:.*Mail\ Bomber/ REJECT
/^X-Mailer:.*CrazyNickels/ REJECT
# block unusual OE mailer
# such as <Microsoft Outlook Express 4.72.3110.5>
/^X-Mailer:.*<Microsoft/ REJECT
# for lgcard...
#/^X-Mailer:.*INFOMailer/ REJECT
/^X-Mailer:.*DiffondiCool/ REJECT
/^X-Mailer:.*Mailtouch/ REJECT
/^X-Mailer:.*Novasoft Sagittarius Professional/ REJECT
/^X-Mailer:.*SoftForum-WebMail/ REJECT
/^X-Mailer:.*[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]$/ REJECT
/^X-Mailer:.*Merge\ \&\ Group\ Mailer/ REJECT
/^X-Mailer:.*Way-SERIES\ Mailer/ REJECT
/^X-Mailer:.*Microsoft Outloo$/ REJECT
/^X-Mailer:.*LightningMail/ REJECT
/^X-Mailer:.*MailKing/ REJECT
/^X-Mailer:.*WC Mail/ REJECT
/^X-Mailer:.*The Bat!/ REJECT
/^X-Mailer:.*emsoft/ REJECT
/^X-Mailer:.*MegaMail/ REJECT
/^X-Mailer:.*Easy Mail/ REJECT
/^X-Mailer:.*SimpleX Mailer/ REJECT
/^X-Mailer:.*NetPIMS/ REJECT
/^X-Mailer:.*PG-MAILINGLIST/ REJECT
/^X-Mailer:.*Imoxion MailExpress/ REJECT
/^X-MAILER:/i REJECT
/^X-Mailer:.*MultiCaster/ REJECT
/^X-Mailer:.*IMMS/ REJECT
/^X-Mailer:.*PHP$/ REJECT
/^X-Mailer:.*TMS\ Enterprise/ REJECT
/^X-Mailer:.*BulkyMailer/ REJECT
/^X-Mailer:.*Mach5\ Mailer/ REJECT
/^X-Mailer:.*VC_IPA/ REJECT
/^X-Mailer:.*CSMTPConnection/ REJECT
/^X-Mailer:.*NMK Mailer/ REJECT
#
# Subject Rejections
#
# spam: palzanet
/^Subject:.*°Ç½ÂÀ»\ ±â¿ø/i REJECT
/^Subject:.*Mail.*ÀÐÀ»¶§¸¶´Ù/i REJECT
/^Subject: [a-z0-9]+´Ô/i REJECT
/^Subject:.*¡Ú»çÁøÀ»/i REJECT
/^Subject:.*±¤°í/i REJECT
/^Subject:.*±¤\ *°í/i REJECT
/^Subject:.*ÎÆÍ±/i REJECT
/^Subject:.*ÎÆ\ *ͱ/i REJECT
/^Subject:.*¼ºÀÎ\ *»çÀÌÆ®/i REJECT
/^Subject:.*¼ºÀÎ\ *Á¤º¸/i REJECT
/^Subject:.*̵̧/i REJECT
/^Subject:.*È«º¸/i REJECT
/^Subject:.*È«\ *º¸/i REJECT
/^Subject:.*¹«·á/i REJECT
/^Subject:.*Ãæ°Ý\ ¾Æ¸£¹ÙÀÌÆ®/i REJECT
/^Subject:.*¹«º¸Áõ/i REJECT
/^Subject:.*¹«´ãº¸/i REJECT
# reject some hoax
/^Subject: ILOVEYOU/ REJECT
/^Subject: fwd: Joke/ REJECT
/^Subject:.*PCÁ¤ºñ»ç/i REJECT
/^Subject:.*á´äþ÷á/i REJECT
/^Subject:.*ADV/i REJECT
/^Subject:.*±âµ¶±³°¡Á¤»ç¿ª/i REJECT
# Melissa
/^Subject:.*Important Message From/ REJECT
# Pretty Park
/^Subject:.*C:\\CoolProgs\\Pretty Park\.exe/ REJECT
# Ecokys
/^Subject:.*¿µ»óÀ¸·Î º¸³»´Â ÆíÁö/i REJECT
# Klez worm
/^Subject:.*Look at the pretty/ REJECT
/^Subject:.*Some advice on your shortcoming/ REJECT
/^Subject:.*Free XXX Pictures/ REJECT
/^Subject:.*A Free hot porn site/ REJECT
/^Subject:.*Why don't you reply to me/ REJECT
/^Subject:.*Never kiss a stranger/ REJECT
/^Subject:.*How about have dinner with me together/ REJECT
/^Subject:.*Boost Your Windows Reliability/ REJECT
# Brazil spam
/^Subject:.*CONVITE\ HP\ ALERTA/ REJECT
# ksc5601 encoded spam: [±¤°í]: 6 char = 8 Base64
/^Subject:.*=\?ks_c_5601-1987\?B\?W7GksO1d/ REJECT
# ksc5601 encoded spam: [È«º¸]: 6 char = 8 Base64
/^Subject:.*=\?ks_c_5601-1987\?B\?W8irurhd/ REJECT
/^Subject:.*=\?ks_c_5601-1987\?B\?oeFbyKu6uF/ REJECT
# Unacceptable encodings; only in Korea/US
/^Subject:.*=\?MS949\?/ REJECT
/^Subject:.*=\?windows-1251\?/ REJECT
/^Subject:.*=\?koi8-r\?/ REJECT
/^Subject:.*=\?big5\?/ REJECT
/^Subject:.*=\?8859_1\?/ REJECT
/^Subject:.*=\?KSC_5601\?/ REJECT
/^Subject:.*À̻ۿʸ¸°ñ¶óÀÔÀÚ/i REJECT
/^Subject:.*\[Á¤º¸\]/i REJECT
/^Subject:.*¸ÞÀϹ߼Û\ ´ëÇà/i REJECT
/^Subject:.*´Ô\ ÀÎÅͳÝ\ »ç¿ë¿¡/i REJECT
/^Subject: \(AD\)/i REJECT
/^Subject:.*¼ÖÁ÷È÷\ ¯Æù/i REJECT
# Win32/Myparty.worm.29696
/^Subject:.*new photos from my party/ REJECT
# Win32/Klez???
/^Subject: OnLoad$/i REJECT
/^Subject:.*¸¶À̼¥/i REJECT
/^Subject:.*Best Adult Webcam Chats/ REJECT
/^Subject:.*SEMINARIO REFORMA LABORAL/ REJECT
/^Subject:.*ÄܽºÆ® Á¤º¸ ÀÔ´Ï´Ù/ REJECT
/^Subject: subscribe/ REJECT
/^Subject: unsubscribe/ REJECT
#
# Message-ID
#
# some spam from kornet
/^Message-ID:.*relay[0-9]\.kornet\.net/ REJECT
/^Message-ID:.*bomul[0-9]\.kornet\.net/ REJECT
# and korea.com
/^Message-ID:.*3w-pop3-a[a-z]\.korea\.com/ REJECT
/^Message-ID:.*3w-smtp-a[a-z]\.korea\.com/ REJECT
# quanta
/^Message-ID:.*<[0-9]+\.[0-9]+\.[0-9]+@localhost>/ REJECT
/^Message-ID:.*<bulk\.[0-9]+\.[0-9]+@>/ REJECT
/^Message-ID:.*totally-fudged-out-message-id/ REJECT
/^Message-ID:.*RND-TEST/ REJECT
/^Message-ID:.*merrychristmas/ REJECT
/^Message-ID:.*printbang\.com/ REJECT
/^Message-ID:\ PM2000/i REJECT
/^Message-ID:.*atfreeweb\.com/ REJECT
/^Message-ID:.*caramail\.com/ REJECT
/^Message-ID:.*@mail\.kr\.freebsd\.org>/ REJECT
#
# From/To/Cc/Sender Header
#
/^From:.*cashmoney/i REJECT
/^From:.*163\.net/ REJECT
/^From:.*¹Ù½ºÆ®¸ÞÀÏ/i REJECT
/^From:.*yesgirl/ REJECT
/^From:.*¸ÖƼÁð³Ý/i REJECT
/^From:.*¿ùµåž½ºÄð/i REJECT
/^From:.*¿ÀÇǽºÇÁ¶óÀÚ/i REJECT
/^From:.*»ç¹«°ü¸®Á¶ÇÕ/i REJECT
/^From:.*¹Î¿ø»¡¸®´åÄÄ/i REJECT
/^From:.*nudetour\.com/ REJECT
/^From:.*700-7726/i REJECT
/^From:.*À̵¿Åë½Å/i REJECT
/^From:.*±Ý¿¬/i REJECT
/^From:.*¡Ú¹ý¿ø°æ¸Å/i REJECT
/^From:.*³ìÀ½±â/i REJECT
/^From:.*RichMedia.*@/ REJECT
/^From:.*ÇÁ¸°Æ®¹æ/i REJECT
# nimda or unusual mail
/^From: <>/ REJECT
/^From:.*Â÷¹æ¼®/i REJECT
# ÀÌ»ç¸ô
/^From:.*MjRtYWxsKMDMu\+e49Ck/i REJECT
/^From:.*ÀÌ»ç¸ô/i REJECT
/^From:.*ÇѼ®ºÀ/i REJECT
/^From:.*±âÇÁÆ®³ª¶ó/i REJECT
/^From:.*¿©»ó¿±/i REJECT
/^From:.*樨毢/i REJECT
/^From:.*¾ÆÀÌÆ¼¿¡½º/i REJECT
/^From:.*DVD¿Ã/i REJECT
/^From:.*=\?KSC_5601\?/ REJECT
/^From:.*¼¿ï¹Ìµð¾î/i REJECT
/^From:.*ZALL/i REJECT
/^From:.*¸íǰ¼îÇθô/i REJECT
/^From:.*¼¼ÀÏÅÚ/i REJECT
/^From:.*°¡ÀÚÆù/i REJECT
/^From:.*¾ÆÀÚ¾ÆÀÚ/i REJECT
/^From:.*¾ß°ÔÀÓÁî´å³Ý/i REJECT
# reject too long id
/^From:.*[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]*@/ REJECT
# Buggy To:
/^To: @/ REJECT
/^To:\ *$/ REJECT
# reject too long id: 15 chars
/^To:.*[0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z][0-9A-Za-z]*@/ REJECT
/^From:.*ÇØÇdzÝ/i REJECT
/^From:.*Àú½Â»çÀÚ/i REJECT
#
# Date Header
#
/^Date:\ *$/ REJECT
/^Date:\ *[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/ REJECT
#/^Date:.*Ç¥ÁؽÃ/i REJECT
/^Date:.*Standard Time/ REJECT
/^Date:.*Daylight Time/ REJECT
/^Date:.*AM/i REJECT
/^Date:.*PM/i REJECT
#
# C-T-E Header or MIME boundary
#
/^Content-Type:.*boundary=-\+PART_BOUNDARY_[0-9]/ REJECT
/^Content-Type:.*charset=.*CHARSET/ REJECT
# Sircam virus
/^Content-Disposition:.*Multipart message/ REJECT
/boundary=WC_MAIL_PaRt_BoUnDaRy_05151998/ REJECT
/^Content-Type:.*AD_2000_PART/ REJECT
/^Content-Type:.*charset=big5/ REJECT
# reject some mail virus
/^Content.*:.*\.vbs/ REJECT
/^Content.*:.*\.pif/ REJECT
# nimda
/boundary=\"====_ABC1234567890DEF_====\"/ REJECT
/boundary=\"====_ABC09876j54321DEF_====\"/ REJECT
# are you nuts?
/^Content-Type:.*;;;;;;/ REJECT
# block Korean html-only mail
/^Content-Type:.*text\/html.*ks_c_5601-1987/ REJECT
/^Content-Type:.*text\/html.*euc-kr/ REJECT
# some spam
/boundary=\"=\ Multipart\ Boundary\ [0-9]+\"/ REJECT
#
# Received; spam passage
#
# Taiwan spam
/^Received:.*dialup\.seed\.net\.tw/ REJECT
/^Received:.*HINET-IP\.hinet\.net/ REJECT
/^Received:.*mail.HIGHERWAY.COM.HK/ REJECT
/^Received:.*168\.126\.231\.196/ REJECT
/^Received:.*rev\.krline\.net/ REJECT
/^Received:.*dido\.co\.kr/ REJECT
#
# Misc. Header
#
# Organization Header
/^Organization:.*ÇÁ·£µå\ À¯Çпø/i REJECT
/^Organization:.*Hampton Casino/ REJECT
/^Organization:.*freeandkinky/ REJECT
/^Organization:.*freeamateurass/ REJECT
/^X-Library:.*SeekerCenter\.com/ REJECT
/^X-Library:.*WincusSMTP/ REJECT
#/^X-EM-Version:/ REJECT
#/^X-EM-Registration:/ REJECT
/^Original-Message-ID:.*PM2000/ REJECT
# block CD spammer: an international bullshit!
#/^Received:.*ppp[0-9]\.kornet\.net/ REJECT
# Regular expression to reject:
# * numeric-only localparts from aol.com and msn.com
# * localparts starting with a digit from juno.com
# * localparts longer than 10 characters from aol.com
/^(From|Sender|To):.*([0-9]+<@(aol|msn)\.com|[0-9][^<]*<@juno\.com|.{10}[^<]+<@aol\.com)/ REJECT
# AD2000
/^X-AD2000-Serial:/ REJECT
/^X-AD2000-Register:/ REJECT
/^[A-Z].*oddnews/ REJECT
# oddnews
/^X-SMTP-MAIL-FROM:.*rayhew/ REJECT
# happy99
/^X-Spanska:.*/ REJECT
# Disallow sender-specified routing. This is a must if you relay mail
# for other domains.
#/[%!@].*@/ 550 Sender-specified routing rejected
# Postmaster is OK, that way they can talk to us about how to fix their problem.
/^postmaster@.*$/ OK
# Protect your outgoing majordomo exploders
/^(.*)-outgoing@(.*)$/!/^owner-.*/ 550 Use ${1}@${2} instead
#
/^X-MDRemoteIP:/ 550 Reject X flag known to be spam
#
/^X-Toname:/ REJECT
/^X-User: 2.1-knlnjqnx-kootns-Iinpq/ REJECT
#
# ÀÓ½Ã: ¹Ý¼Û¸ÞÀÏ(»ç¿ëÀÚÀÇ ½ºÇ® Ãʰú)
# block notifies
#/^Subject:.*¸ÞÀÏ\ Àü¼Û\ ½ÇÆÐ\ Å뺸/i REJECT
#/^Subject:.*½ºÇ®\ Çã¿ëÇѵµ\ Ãʰú¸ÞÀÏ/i REJECT
#/^From:.*NAVER-MAILER@naver.com/i REJECT
#/^From:.*postmaster@netsgo.com/i REJECT
#/^Subject:.*¼ö½ÅÀÚÀÇ\ ¸ÞÀÏ\ ÁÖ¼Ò°¡\ Á¤È®ÇÏÁö\ ¾Ê¾Æ/i REJECT
#/^Subject:.*\[¼ö½Å°ÅºÎ\]/i REJECT
#/^Subject:.*ÀÚµ¿´äÀå/i REJECT
/^(.*)name\=\"(.*)\.(hta|pif|vbs|vbe|js|jse|cmd|vxd|scr|chm)\"$/ REJECT
/^Content.*\.(hta|pif|vbs|vbe|js|jse|cmd|vxd|scr|shm|lnk)"/ REJECT
/^I send you this file in order to have your advice/ REJECT