文件操作 - header_checks.pcre

文件: /root/sh/postfix/header_checks.pcre

编辑文件内容

# HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
# 
# NAME
#        header_checks - Postfix built-in content inspection
# 
# SYNOPSIS
#        header_checks = pcre:/etc/postfix/header_checks
#        mime_header_checks = pcre:/etc/postfix/mime_header_checks
#        nested_header_checks = pcre:/etc/postfix/nested_header_checks
#        body_checks = pcre:/etc/postfix/body_checks
# 
#        milter_header_checks = pcre:/etc/postfix/milter_header_checks
# 
#        smtp_header_checks = pcre:/etc/postfix/smtp_header_checks
#        smtp_mime_header_checks = pcre:/etc/postfix/smtp_mime_header_checks
#        smtp_nested_header_checks = pcre:/etc/postfix/smtp_nested_header_checks
#        smtp_body_checks = pcre:/etc/postfix/smtp_body_checks
# 
#        postmap -q "string" pcre:/etc/postfix/filename
#        postmap -q - pcre:/etc/postfix/filename <inputfile>
# 
# DESCRIPTION
#        This  document  describes access control on the content of
#        message headers and message body lines; it is  implemented
#        by  the  Postfix  cleanup(8) server before mail is queued.
#        See access(5) for access control  on  remote  SMTP  client
#        information.
# 
#        Each  message  header  or  message  body  line is compared
#        against a list of patterns.  When a  match  is  found  the
#        corresponding action is executed, and the matching process
#        is repeated for the next message header  or  message  body
#        line.
# 
#        Note: message headers are examined one logical header at a
#        time, even when a message  header  spans  multiple  lines.
#        Body lines are always examined one line at a time.
# 
#        For  examples, see the EXAMPLES section at the end of this
#        manual page.
# 
#        Postfix header or body_checks are designed to stop a flood
#        of  mail from worms or viruses; they do not decode attach-
#        ments, and they do not unzip archives. See  the  documents
#        referenced  below  in the README FILES section if you need
#        more sophisticated content analysis.
# 
# FILTERS WHILE RECEIVING MAIL
#        Postfix implements the  following  four  built-in  content
#        inspection classes while receiving mail:
# 
#        header_checks (default: empty)
#               These   are  applied  to  initial  message  headers
#               (except for the headers  that  are  processed  with
#               mime_header_checks).
# 
#        mime_header_checks (default: $header_checks)
#               These  are  applied to MIME related message headers
#               only.
# 
#               This feature is available in Postfix 2.0 and later.
# 
#        nested_header_checks (default: $header_checks)
#               These  are  applied  to message headers of attached
#               email messages (except for  the  headers  that  are
#               processed with mime_header_checks).
# 
#               This feature is available in Postfix 2.0 and later.
# 
#        body_checks
#               These are applied to all other  content,  including
#               multi-part message boundaries.
# 
#               With Postfix versions before 2.0, all content after
#               the initial message headers is treated as body con-
#               tent.
# 
# FILTERS AFTER RECEIVING MAIL
#        Postfix  supports a subset of the built-in content inspec-
#        tion classes after the message is received:
# 
#        milter_header_checks (default: empty)
#               These are applied to headers that  are  added  with
#               Milter applications.
# 
#               This feature is available in Postfix 2.7 and later.
# 
# FILTERS WHILE DELIVERING MAIL
#        Postfix supports all four content inspection classes while
#        delivering mail via SMTP.
# 
#        smtp_header_checks (default: empty)
# 
#        smtp_mime_header_checks (default: empty)
# 
#        smtp_nested_header_checks (default: empty)
# 
#        smtp_body_checks (default: empty)
#               These  features  are  available  in Postfix 2.5 and
#               later.
# 
# COMPATIBILITY
#        With Postfix version 2.2 and earlier specify "postmap -fq"
#        to query a table that contains case sensitive patterns. By
#        default, regexp: and pcre: patterns are case  insensitive.
# 
# TABLE FORMAT
#        This  document  assumes  that header and body_checks rules
#        are specified in the form of  Postfix  regular  expression
#        lookup  tables.  Usually  the best performance is obtained
#        with pcre (Perl Compatible Regular Expression) tables. The
#        regexp  (POSIX  regular  expressions)  tables  are usually
#        slower, but more widely available.  Use the command "post-
#        conf  -m" to find out what lookup table types your Postfix
#        system supports.
# 
#        The general format of Postfix regular expression tables is
#        given  below.   For  a  discussion  of specific pattern or
#        flags  syntax,  see  pcre_table(5)   or   regexp_table(5),
#        respectively.
# 
#        /pattern/flags action
#               When  /pattern/  matches  the input string, execute
#               the corresponding action. See below for a  list  of
#               possible actions.
# 
#        !/pattern/flags action
#               When  /pattern/  does  not  match the input string,
#               execute the corresponding action.
# 
#        if /pattern/flags
# 
#        endif  If the input string matches /pattern/,  then  match
#               that  input  string against the patterns between if
#               and endif.  The if..endif can nest.
# 
#               Note: do not prepend whitespace to patterns  inside
#               if..endif.
# 
#        if !/pattern/flags
# 
#        endif  If  the input string does not match /pattern/, then
#               match  that  input  string  against  the   patterns
#               between if and endif. The if..endif can nest.
# 
#        blank lines and comments
#               Empty  lines and whitespace-only lines are ignored,
#               as are lines whose first  non-whitespace  character
#               is a `#'.
# 
#        multi-line text
#               A  pattern/action  line  starts with non-whitespace
#               text. A line that starts with whitespace  continues
#               a logical line.
# 
# TABLE SEARCH ORDER
#        For  each  line of message input, the patterns are applied
#        in the order as specified in the table. When a pattern  is
#        found  that  matches  the  input  line,  the corresponding
#        action is  executed  and  then  the  next  input  line  is
#        inspected.
# 
# TEXT SUBSTITUTION
#        Substitution  of  substrings  from  the matched expression
#        into the action string is possible using the  conventional
#        Perl  syntax  ($1,  $2,  etc.).   The macros in the result
#        string may need to be written as  ${n}  or  $(n)  if  they
#        aren't followed by whitespace.
# 
#        Note:  since negated patterns (those preceded by !) return
#        a result when the expression does not match, substitutions
#        are not available for negated patterns.
# 
# ACTIONS
#        Action names are case insensitive. They are shown in upper
#        case for consistency with other Postfix documentation.
# 
#        BCC user@domain
#               Add the specified address as a BCC  recipient,  and
#               inspect  the next input line. The address must have
#               a local part and domain part.  The  number  of  BCC
#               addresses  that can be added is limited only by the
#               amount of available storage space.
# 
#               Note 1: the BCC address is added as if it was spec-
#               ified  with  NOTIFY=NONE.  The  sender  will not be
#               notified when the BCC address is undeliverable,  as
#               long  as  all  down-stream  software implements RFC
#               3461.
# 
#               Note 2: this ignores duplicate addresses (with  the
#               same delivery status notification options).
# 
#               This feature is available in Postfix 3.0 and later.
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        DISCARD optional text...
#               Claim  successful delivery and silently discard the
#               message.  Do not inspect the remainder of the input
#               message.   Log the optional text if specified, oth-
#               erwise log a generic message.
# 
#               Note:  this  action  disables  further  header   or
#               body_checks  inspection  of the current message and
#               affects all recipients.  To discard only one recip-
#               ient without discarding the entire message, use the
#               transport(5) table to direct mail to the discard(8)
#               service.
# 
#               This feature is available in Postfix 2.0 and later.
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        DUNNO  Pretend  that the input line did not match any pat-
#               tern, and inspect the next input line. This  action
#               can be used to shorten the table search.
# 
#               For  backwards  compatibility reasons, Postfix also
#               accepts OK but it is (and always has been)  treated
#               as DUNNO.
# 
#               This feature is available in Postfix 2.1 and later.
# 
#        FILTER transport:destination
#               Override the content_filter parameter setting,  and
#               inspect  the next input line.  After the message is
#               queued, send the entire message through the  speci-
#               fied  external  content  filter. The transport name
#               specifies the first field of a mail delivery  agent
#               definition in master.cf; the syntax of the next-hop
#               destination is described in the manual page of  the
#               corresponding  delivery  agent.   More  information
#               about external content filters is  in  the  Postfix
#               FILTER_README file.
# 
#               Note  1: do not use $number regular expression sub-
#               stitutions for transport or destination unless  you
#               know that the information has a trusted origin.
# 
#               Note  2:  this  action  overrides  the main.cf con-
#               tent_filter setting, and affects all recipients  of
#               the  message.  In  the  case  that  multiple FILTER
#               actions fire, only the last one is executed.
# 
#               Note 3: the purpose of the  FILTER  command  is  to
#               override  message routing.  To override the recipi-
#               ent''s transport but not the  next-hop  destination,
#               specify  an  empty  filter destination (Postfix 2.7
#               and later), or specify a transport:destination that
#               delivers   through  a  different  Postfix  instance
#               (Postfix 2.6 and earlier). Other options are  using
#               the  recipient-dependent transport_maps or the sen-
#               der-dependent   sender_dependent_default_transport-
#               _maps features.
# 
#               This feature is available in Postfix 2.0 and later.
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        HOLD optional text...
#               Arrange  for  the  message to be placed on the hold
#               queue, and inspect the next input line.   The  mes-
#               sage  remains  on hold until someone either deletes
#               it or releases it for delivery.  Log  the  optional
#               text if specified, otherwise log a generic message.
# 
#               Mail that is placed on hold can  be  examined  with
#               the  postcat(1)  command,  and  can be destroyed or
#               released with the postsuper(1) command.
# 
#               Note: use "postsuper -r" to release mail  that  was
#               kept  on  hold for a significant fraction of $maxi-
#               mal_queue_lifetime  or  $bounce_queue_lifetime,  or
#               longer.  Use "postsuper -H" only for mail that will
#               not expire within a few delivery attempts.
# 
#               Note: this action affects  all  recipients  of  the
#               message.
# 
#               This feature is available in Postfix 2.0 and later.
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        IGNORE Delete the current line from the input, and inspect
#               the next input line. See STRIP for  an  alternative
#               that logs the action.
# 
#        INFO optional text...
#               Log an "info:" record with the optional text... (or
#               log a generic text), and  inspect  the  next  input
#               line.  This action is useful for routine logging or
#               for debugging.
# 
#               This feature is available in Postfix 2.8 and later.
# 
#        PASS optional text...
#               Log  a "pass:" record with the optional text... (or
#               log a generic text), and turn off header, body, and
#               Milter  inspection  for  the remainder of this mes-
#               sage.
# 
#               Note: this feature relies on trust  in  information
#               that is easy to forge.
# 
#               This feature is available in Postfix 3.2 and later.
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        PREPEND text...
#               Prepend  one  line  with  the  specified  text, and
#               inspect the next input line.
# 
#               Notes:
# 
#               o      The prepended text is output on  a  separate
#                      line,  immediately  before  the  input  that
#                      triggered the PREPEND action.
# 
#               o      The prepended text is not considered part of
#                      the  input  stream:  it  is  not  subject to
#                      header/body checks or address rewriting, and
#                      it does not affect the way that Postfix adds
#                      missing message headers.
# 
#               o      When prepending text before a message header
#                      line,  the  prepended text must begin with a
#                      valid message header label.
# 
#               o      This  action  cannot  be  used  to   prepend
#                      multi-line text.
# 
#               This feature is available in Postfix 2.1 and later.
# 
#               This   feature   is   not   supported   with   mil-
#               ter_header_checks.
# 
#        REDIRECT user@domain
#               Write  a  message  redirection request to the queue
#               file, and inspect the next input  line.  After  the
#               message is queued, it will be sent to the specified
#               address instead of the intended recipient(s).
# 
#               Note: this action overrides the FILTER action,  and
#               affects  all recipients of the message. If multiple
#               REDIRECT actions fire, only the last  one  is  exe-
#               cuted.
# 
#               This feature is available in Postfix 2.1 and later.
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        REPLACE text...
#               Replace  the  current line with the specified text,
#               and inspect the next input line.
# 
#               This feature is available in Postfix 2.2 and later.
#               The  description below applies to Postfix 2.2.2 and
#               later.
# 
#               Notes:
# 
#               o      When replacing a message  header  line,  the
#                      replacement  text  must  begin  with a valid
#                      header label.
# 
#               o      The replaced text remains part of the  input
#                      stream.  Unlike  the result from the PREPEND
#                      action, a replaced  message  header  may  be
#                      subject  to address rewriting and may affect
#                      the way that Postfix  adds  missing  message
#                      headers.
# 
#        REJECT optional text...
#               Reject  the  entire  message.  Do  not  inspect the
#               remainder  of  the  input  message.    Reply   with
#               optional  text...  when the optional text is speci-
#               fied, otherwise reply with a generic error message.
# 
#               Note:   this  action  disables  further  header  or
#               body_checks inspection of the current  message  and
#               affects all recipients.
# 
#               Postfix version 2.3 and later support enhanced sta-
#               tus codes.  When no code is specified at the begin-
#               ning of optional text..., Postfix inserts a default
#               enhanced status code of "5.7.1".
# 
#               This feature is not supported with smtp header/body
#               checks.
# 
#        STRIP optional text...
#               Log a "strip:" record with the optional text... (or
#               log a generic text), delete the input line from the
#               input,  and inspect the next input line. See IGNORE
#               for a silent alternative.
# 
#               This feature is available in Postfix 3.2 and later.
# 
#        WARN optional text...
#               Log  a  "warning:" record with the optional text...
#               (or log a generic text), and inspect the next input
#               line.  This  action is useful for debugging and for
#               testing a  pattern  before  applying  more  drastic
#               actions.
# 
# BUGS
#        Empty lines never match, because some map types mis-behave
#        when given a zero-length search string.   This  limitation
#        may  be  removed for regular expression tables in a future
#        release.
# 
#        Many people overlook the main limitations  of  header  and
#        body_checks rules.
# 
#        o      These  rules  operate on one logical message header
#               or one body line at a time. A decision made for one
#               line is not carried over to the next line.
# 
#        o      If  text  in the message body is encoded (RFC 2045)
#               then the rules need to be specified for the encoded
#               form.
# 
#        o      Likewise,  when  message  headers  are encoded (RFC
#               2047) then the rules need to be specified  for  the
#               encoded form.
# 
#        Message  headers added by the cleanup(8) daemon itself are
#        excluded from inspection. Examples of such message headers
#        are From:, To:, Message-ID:, Date:.
# 
#        Message  headers  deleted by the cleanup(8) daemon will be
#        examined before they are deleted. Examples are: Bcc:, Con-
#        tent-Length:, Return-Path:.
# 
# CONFIGURATION PARAMETERS
#        body_checks
#               Lookup tables with content filter rules for message
#               body lines.  These filters see one physical line at
#               a  time,  in  chunks  of at most $line_length_limit
#               bytes.
# 
#        body_checks_size_limit
#               The amount of  content  per  message  body  segment
#               (attachment) that is subjected to $body_checks fil-
#               tering.
# 
#        header_checks
# 
#        mime_header_checks (default: $header_checks)
# 
#        nested_header_checks (default: $header_checks)
#               Lookup tables with content filter rules for message
#               header  lines:  respectively,  these are applied to
#               the initial message  headers  (not  including  MIME
#               headers),  to the MIME headers anywhere in the mes-
#               sage, and to the initial headers of  attached  mes-
#               sages.
# 
#               Note:  these filters see one logical message header
#               at a time, even when a message header spans  multi-
#               ple  lines.  Message  headers  that are longer than
#               $header_size_limit characters are truncated.
# 
#        disable_mime_input_processing
#               While receiving mail, give no special treatment  to
#               MIME  related  message  headers; all text after the
#               initial message headers is considered to be part of
#               the  message body. This means that header_checks is
#               applied to all the  initial  message  headers,  and
#               that body_checks is applied to the remainder of the
#               message.
# 
#               Note: when used in this  manner,  body_checks  will
#               process  a  multi-line message header one line at a
#               time.
# 
# EXAMPLES
#        Header pattern to block attachments  with  bad  file  name
#        extensions.   For  convenience, the PCRE /x flag is speci-
#        fied, so that there is no need  to  collapse  the  pattern
#        into   a   single  line  of  text.   The  purpose  of  the
#        [[:xdigit:]] sub-expressions is to recognize Windows CLSID
#        strings.
# 
#        /etc/postfix/main.cf:
#            header_checks = pcre:/etc/postfix/header_checks.pcre
# 
#        /etc/postfix/header_checks.pcre:
#		https://www.sweetnam.eu/index.php/Postfix_Header_Checks
#

# 10-11-2025 CERCO ANCORA DI BLOCCARE GLI SPAN CON NOTIFICHE SERVER
# Ho trovato che nell'eaherd di sti rompicoglioni c'è:
# X-SPF-Fail: YES
# oppure
# Received-SPF: Temperror
# Provo a bloccarli
/^Received-SPF:.*Temperror.*$/ REJECT spam

#30-10-2025  'ITALIA MANAGEMENT' e varie phishing domain
/^Return-Path: .*mdrctr.com.*$/ REJECT spam
/^Return-Path: .*mdrctr.com.*$/ REJECT spam

# 12-10-2025
/^Return-Path: .*xelaroflux.cfd.*$/ REJECT spam
/^Return-Path: .*godfreyelabor.com.*$/ REJECT spam

fdesp.alexcarterlive.com REJECT spam
alexcarterlive.com REJECT spam

# 20-07-2025 sempr epiù rompi
# stavolta blocco se non c'è dkim
/^Authentication-Results:.*dkim=fail reason="key not found in DNS.*$/ REJECT spam 320

# 14-07-2025 spam ravasi (email del 14-07)
/^Received:.*lightningfastriderzone.cfd.*$/ REJECT spam 301

# 03-06-2025 inizio a bloccare i pirla con richieste pw admin varie
/^Received: .*mxout.mta4.net.*$/ REJECT spam 301
/^Received: from .*aarcorq.com.*$/ REJECT spam 301
/^Received: from .*gamakichi5.biz.id.*$/ REJECT spam 301
/^Return-Path: .*myweb600.com.*$/ REJECT spam 201
/^From: .*myweb600.com.*$/ REJECT spam 201

# 15-05-2025 PROVO ELIMINARE SPAM DA "AI"
/^Return-Path: .*gotowebinar.com.*$/ REJECT spam 200
/^Received: .*gotowebinar.com.*$/ REJECT spam 200
/^Return-Path: .*sg.zoom.us.*$/ REJECT spam 203
/^Received: .*sg.zoom.us.*$/ REJECT spam 203
/^Received: .*sg.zoom.us.*$/ REJECT spam 203

/^Return-Path: .*logmeininc.com.*$/ REJECT spam 201
/^Received: .*logmeininc.com.*$/ REJECT spam 201

/^Return-Path: .*marketinghero.sbs.*$/ REJECT spam 201
/^Received: .*marketinghero.sbs.*$/ REJECT spam 201

/^Return-Path: .*msg.gotowebinar.com.*$/ REJECT spam 201
/^Received: .*msg.gotowebinar.com.*$/ REJECT spam 201

/^Return-Path: .*soffultech.*$/ REJECT spam 201
/^Received: .*soffultech.*$/ REJECT spam 201

# 02-06-2025 se non va blocfare tutto il server SMTP
/^Return-Path: .*acutech.live.*$/ REJECT spam 201
/^Received: .*acutech.live.*$/ REJECT spam 201

# 05-03-2025 mail che gira
# colegioanglo.mx REJECT spam
/^Sender:.*att.clubsportuno.com/ REJECT spam 193
/^Return-Path: .*colegioanglo.mx>$/ REJECT spam 193
/^Return-Path: .*att.clubsportuno.com>$/ REJECT spam 194
/^Return-Path: .*clubsportuno.com.*/ REJECT spam 194
/^Return-Path: .*hipatonline.com.*/ REJECT spam 198
/^Return-Path: .*smartecelevators.com.*/ REJECT spam 199

/^Subject:.*Avviso di ricevimento della richiesta.*/ REJECT spam 198
/^Subject:.*Avviso di ricevimento della richiesta/ REJECT spam 200

# 14-11-2024  "mail non consegnata"
/^Received: .*centraldata.*$/ REJECT spam 192

# 20-06-2024 phishing telecamera
/^X-Spam-Prev-Subject: Violazione dei dati personali.*$/ REJECT spam 191

# 13-06-2024 spam da Received: from kdcbv (mail.saescomedical.cam
/^Received:.*mail.saescomedical.*$/i REJECT spam 190
/^Reply-To:.*OpenSea.*$/i REJECT spam 191

# spf record mancante
# attenzione 04-06-2024: purtroppo manca  a molti il record SPF
# stamattina ricevuta telefonate da TE MIlano 2 clienti senza SPF
# icmlift e comicondor.com
# entrambi con server smtp farlocchi o Aruba
# per ora li metto nella whiote list
# /^Received-SPF: None.*$/ REJECT SPF Record Missing 149
# L'ho dovuto remmare perchè il rompi coglioni di Dario
# come al solito gli arrivano le mail da tipi farlocchi
# e siccome è sempre incazzato l'ho remmato
# provare a sostituire cone questo che rileva SPF mancante
# /^no SPF record.*$/ REJECT SPF Record Missing 149

# 29-05-2024 spam rinnovi aruba
/^Received:.*brahmagupta.*$/i REJECT subject not allowed 180

# 24-01-2024 Reply-To: fatturaelettronica26451368@notificacao09j.painthorse.biz.id
/^Reply-To:.*fatturaelettronica.*painthorse.*$/i REJECT subject not allowed 148
/^Return-Path:.*notificao.*$/i REJECT subject not allowed 150
/^From:.*notificao.*$/i REJECT subject not allowed 150
/^Subject:.*Fatturazione online FedEx.*$/i REJECT subject not allowed 150
/^From:.*notificados.*$/i REJECT subject not allowed 160
/^Subject:.*Nuova Fattura Disponibile.*$/i REJECT subject not allowed 160
/^From:.*comunicados.*$/i REJECT subject not allowed 150

# ********************************************************************************************

#  28-11-2023 Purtroppo blocca molti dei siti grandi come Aruba e che fanno capo
#  a Microsoft. Come sempre tutta una ipocrisia.
#  Per spedire a loro vogliono tutte le impo pefette ma poi sono un gran casino
#  Mi viene da piangere

#  A questo punto metto 2 controlli con la condizione
#  Per mettere "if" è scritto qui come fare
#  https://stackoverflow.com/questions/39352168/postfix-header-checks-multiple-actions
#  Lavoro da fare appena ho tempo
#  Nella condizione gli metto il punteggio dell'antipam o altro non so
#  Veramente una cosa penosa. Che si vadino tutti a fan culo !!!

# 25-11-2023 dopo una giornata di merda a cercare come aumentare l'antispam
# con questa cagata di programmi ho trtovato che i minkioni che mandano
# le mail con Aruba non gli viene fatto il controllo del record SPF
# risulta nell'header della mail SPF : none
# controllare lunedì se ne arribvano meno
# http://www.open-spf.org/SPF_Received_Header/
# https://stackoverflow.com/questions/39352168/postfix-header-checks-multiple-actions

# /^Received-SPF: None.*$/i REJECT SPF Record not found 0999

# questo deve stare staccato ?
# /^Received-SPF: fail.*$/i REJECT SPF Record fail 0999

#  Altre condizioni da mettere
#  Received-SPF: Softfail (domain owner discourages use of this host)
#  To: undisclosed-recipients:;

# /^Received-SPF: None.*$/ REDIRECT rossano@planetline.it

# if /^Received-SPF: None.*$/
# /^Subject:.*/ REPLACE Subject: Spam
# endif

# if !/^X-Spam-Status:.*/
# /^Received-SPF: None.*$/i HOLD SPF Record not found 
# /^Received-SPF: Softfail (domain owner discourages use of this host).*/i HOLD SPF Record Incorrect
# endif

/^X-Spam-Status: Yes.*$/i REJECT Spam check with spamassassin 
/^To:.*Recipients.*$/i REJECT No recipient
/^From: Mail Delivery System.*$/i REJECT No accepted 0652
/^To:.*Undisclosed recipients.*$/i REJECT No accepted 0652

# REJECT Helo error : internal code 6221  ... per ora faccio i redirect per vedere se le becca giuste
/^Received: from.*(helo=error-no-valid-domain.com).*$/i REDIRECT rossano@planetline.it

# ********************************************************************************************

# Disattivazione 
/^Subject:.*Disattivazione.*$/i REJECT subject not allowed 147
/^Subject:.*Deactivation.*$/i REJECT subject not allowed 148

# returning pending message
/^Subject:.*returning pending message.*$/ REJECT subject not allowed 5008

# ******************************************************************************
# ATTENZIONE!!!!!!!!!!!!!!    29-12-2022
# QUESTA CAGATA DI POSTIFIX ALCUNE VOLTE SE SI METTE "/i"  NON FA IL CONTROLLO
# RIMUOVERLE
# ******************************************************************************

# 15-10-2023 vari dpam che arrivano a me .... da fare ( gli ultimi 2 ho fatto unsubscibe )
# realzoftware  rompi coglioni con AI
/^From:.*realzoftware.*$/ REJECT not allowed 5050

# 07-09-2023 unsuscribe su questi non va  contact@orafotovoltaico.it
/^Return-Path:.*contact@orafotovoltaico.it.*$/ REJECT not allowed 5049

# 04-09-2023 unsuscribe su questi non va  az1.survey2connect.com

# 13-08-2023 altri rompi da California
/^From:.*Ravu.me.*$/ REJECT not allowed 5048

# 10-08-2023 rompi coglioni dagli USA
/^Return-Path:.*reviewshake.com.*$/ REJECT not allowed 5040
/^Received:.*reviewshake.com.*$/ REJECT not allowed 5041

# 22-07-2023 mailerboss non prende unsuscribe
/^Return-Path:.*mailer.mailingboss.net.*$/ REJECT not allowed 5040
/^Received:.*mailingboss.net.*$/ REJECT not allowed 5041

# 28-05-2023  richieste bitcoin
/^Subject:.*Withdraw your.*$/ REJECT subject REJECT not allowed 5030

# 01-05-2023 # Promise Osegbe mi manda tanto spam
/^from:.*Osegbe.*$/ REJECT spam 5028

# 05-04-2023 Marketing Osegbe 
/^from:.*Marketing Osegbe.*$/ REJECT spam 5028

# 31-03-2023  from=marranzasca@gmail.com
/^from:.*marranzasca@gmail.com.*$/i REJECT spam 5024
# 31-03-2023  from=marranzasca@gmail.com
/^from: marranzasca@gmail.com/i REJECT spam 5025

# 10-02-2023 spam vario 
/^Subject: Your cash bonus.*/  REJECT spam 5022
# /^Content-Type: image\/jpeg; name="Geek.*/ REJECT spam 5023
/^Content-Disposition: attachment; filename="Geek.*/ REJECT spam 5024

# 28-01-2023 spam vario  ( per ora non abilitato)
# /^from:.*Freddie Cammon.*/ REJECT not allowed 5011

# 29-12-2022 altri che arrivano a me
/^.*filename=.*bitcoin.*/ REJECT filename not allowed 5020
/^filename=.*bitcoin.*/ REJECT filename not allowed 5021
/^Received: .*systeme.io.*/ REJECT domain not allowed 5021

# 27-12-2022 Ross spam che arriva a me
/^Subject:.*bitcoin.*$/ REJECT subject REJECT not allowed 5006
/^Subject:.*bitcoin$/ REJECT subject REJECT not allowed 5008
/^Subject: bitcoin.*$/ REJECT subject REJECT not allowed 5010
/^.*filename=.*bitcoin.*$/ subject REJECT not allowed 5009
/^from:.*contentbuzz.online.*/ REJECT not allowed 5010
/^from:.*techhubgrow.online.*/ REJECT not allowed 5011

/^from:.*tech hub.*/ REJECT not allowed 5011
/^Return-Path:.*shared.systeme.io/ REJECT not allowed 5014

/^from:.*reallysuccessful.com.*$/i REJECT not allowed 5012
/^from:.*erpeez.com.*$/i not REJECT allowed 5013

# 04-10-2022 Rossano officina manda  "Con una donazione di 9 euro al"
/^Subject:.*Con una donazione di 9 euro al.*/i REJECT subject not allowed 5005

# 29-09-2022 Austin ...
/^Reply-To: Austin .*/i REJECT subject not allowed 5004

# 31-08-2022 solite cagate
/^Subject:.*Raccontateci i vostri segreti.*/ REJECT subject not allowed 5004

# 12-08-2022 banca sella fake
/^Subject:.*TWlzdXJlIGRpIHNpY3VyZXp6YQ.*/ REJECT subject not allowed 5003

# 11-08-2022 disattivazione fake aruba
/^Subject:.*Disattivazione casella e-mail.*/i REJECT subject not allowed 5002

# 30-06-2022 rompi cacchio devo aumentare il controllo con spamassassin che non funziona
/^.*admin@ideitas.es.*/ REJECT Message header 0108 [301]

# 28-06-2022
/^Subject:.*Dig it out MirAcle.*/i REJECT subject not allowed 5002

# 15-06-2022 
/^Subject:Removio.*/i REJECT subject not allowed 5001

# 15-04-2022 sempre rifiuto di rinnovo in utf8
/^Subject:.*\?UTF-8\?B\?UklGSVVU0J4gREkgUklOT.*/ REJECT content not allowed 0010

# 22-03-2022
/^Subject:.*sparkasse-kundendienst.*$/i REJECT subject not allowed 4001
/^Subject:.*sparkasse.*$/i REJECT subject not allowed 4001
/^Subject:.*wsplw\.de.*$/i REJECT subject not allowed 4001
/^Subject:.*spk\.de.*$/i REJECT subject not allowed 4001
/^Subject:.*ihresprk\.de$/i REJECT subject not allowed 4001
/^Organization:.*Sparkasse$/i REJECT content not allowed  4003
/^.*Organization:.*Sparkasse.*$/i REJECT content not allowed  4004

# 22-03-2022 
# /^Subject:(CONVOCAZIONE GIUDIZIARIA  )|(.*CONVOCAZIONE GIUDIZIARIA  )|(.*CONVOCAZIONE GIUDIZIARIA  .*)$/i REJECT not allowed 999

# 15-03-2022 
/^Subject:(hot girl )|(.*hot girl )|(.*hot girl.*)$/ REJECT not allowed 1000
/^Subject:(nice women.*)|(.*nice woman.*)|(.*nice women.*)$/ REJECT not allowed 1000

# 03-03-2022  Sossetto rifiuto di rinnovo codificato
/^Subject:.*UTF-8?B?UklGSVVU0J4gREkgUklOTtCeVtCe.*/ REJECT subject not allowed 1001

# 02-03-2022 
# /^To:(Undisclosed )|(.*Undisclosed )|(.*Undisclosed .*)$/ REJECT not allowed 1003

# 28-02-2022 
/^From:(Top IM Trends)|(.*Top IM Trends)|(.*Top IM Trends.*)$/ REJECT subject not allowed 4

# 28-02-2022 per ora ragazze
# /^Subject:(ragazze)|(.*ragazze)|(.*ragazze.*)$/ REJECT header content not allowed 001

# 28-02-2022 topimtrends.com
/^From:.*topimtrends.com.*$/i REJECT content not allowed 002

# 23-08-2021 account sospeso fake
# /^From:(Security Check-up)|(.*Security Check-up)|(.*Security Check-up.*)$/ REJECT content not allowed 003

# 23-08-2021 account sospeso fake
/^From:(re-activate)|(.*re-activate)|(.*re-activate.*)$/ REJECT content not allowed 004

# 27-02 immagini porno da edu.bh
/From:.*edu.bh.*/	DISCARD

# 15-02-2022 obj con Non dimentichi di pagare 
/^Subject:(Non dimentichi di pagare)|(.* Non dimentichi di pagare)|(.* Non dimentichi di pagare .*)$/ REJECT header content not allowed 005

# 05-02-2022 obj con MILF
/^Subject:(MILF)|(.* MILF)|(.* MILF.*)$/ REJECT header content not allowed 006

# 02-02-2022 from o TO vuoti
/To:.*<>/	DISCARD
/From:.*<>/	DISCARD

# 28-01-2022 RIFIUTО DI RINNОVО  ( aruba ahaha )
/^Subject:(RIFIUTО DI RINNОVО)|(.*RIFIUTО DI RINNОVО)|(.*RIFIUTО DI RINNОVО.*)$/ REJECT header content not allowed 007
/^Subject:(CONFERMA RINNОVО)|(.*CONFERMA RINNОVО)|(.*CONFERMA RINNОVО.*)$/ REJECT header content not allowed 008
# rifiuto di rinnovo encoded base 64
/^Subject:.*=\?UTF-8?B?UklGSVVU0J4gREkgUklOTtCeVtCe.*/ REJECT header content not allowed 009

# 27-01-2022 mail sex vario
/^From:.*@telnor.net/i REJECT content not allowed 010

# 20-01-2022 superlotto ma criptato
/^Message-ID:.*f34.my.com.*$/i REJECT content not allowed 011
/^From:.*jazzfree.com.*$/i REJECT content not allowed 012
/^From:.*aztennis.at.*$/i REJECT content not allowed 013

# 31-07-2021 Aleksandr rompi coglioni
/^From:(Aleksandr)|(.*Aleksandr)|(.*Aleksandr.*)$/ REJECT content not allowed 014

#  REJECT Chinese encoding not accepted by this server
			# /^Subject: =?big5?/     
			
			# /^Subject: =?EUC-KR?/   REJECT Korean encoding not allowed by this server
			# /^Subject: =?Windows-1251?/     REJECT Russian encoding not allowed by this server
			# /^Subject: =\?KOI8-R\?/ REJECT Russian encoding not allowed by this server
			# /^Subject: ADV:/        REJECT Advertisements not accepted by this server
			
                                                            
            #   REJECT Attachment name "$2" may not end with ".$4"                                             
            # /^Content-(Disposition|Type).*name\s*=\s*"?([^;]*(\.|=2E)(
            #  ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|
            #  hlp|ht[at]|
            #  inf|ins|isp|jse?|lnk|md[betw]|ms[cipt]|nws|
            #  \{[[:xdigit:]]{8}(?:-[[:xdigit:]]{4}){3}-[[:xdigit:]]{12}\}|
            #  ops|pcd|pif|prf|reg|sc[frt]|sh[bsm]|swf|
            #  vb[esx]?|vxd|ws[cfh]))(\?=)?"?\s*(;|$)/x 
			#			REJECT Attachment name "$2" may not end with ".$4"

# /^Received:/ HOLD
            # /^Subject: =?big5?/     REJECT Chinese encoding not accepted by this server
            # /^Subject: =?EUC-KR?/   REJECT Korean encoding not allowed by this server
            # /^Subject: ADV:/        REJECT Advertisements not accepted by this server
            # /^Subject: =?Windows-1251?/     REJECT Russian encoding not allowed by this server
            # /^Subject: =\?KOI8-R\?/ REJECT Russian encoding not allowed by this server
            # /^Subject:.*=\?(big5|euc-kr|gb2312|ks_c_5601-1987)\?/   REJECT Language not accepted by this server as it is probably spam
            # /[^[:print:]]{8}/       REJECT Sorry, ascii characters only permitted by this server
            # /^From:.*\@.*\.cn/      REJECT Sorry, Chinese mail not allowed here
            # /^From:.*\@.*\.kr/      REJECT Sorry, Korean mail not allowed here
            # /^From:.*\@.*\.tr/      REJECT Sorry, Turkish mail not allowed here
            # /^From:.*\@.*\.ru/      REJECT Sorry, Russian mail not allowed here
            # /^From:.*\@.*\.ro/      REJECT Sorry, Romanian mail not allowed here
            # /^(Received|Message-Id|X-(Mailer|Sender)):.*\b(AutoMail|E-Broadcaster|Emailer Platinum|Thunder Server|eMarksman|Extractor|e-Merge|from stealth[^.]|Global Messenger|GroupMaster|Mailcast|MailKing|Match10|MassE-Mail|massmail\.pl|News Breaker|Powermailer|Quick Shot|Ready Aim Fire|WindoZ|WorldMerge|Yourdora|Lite)\b/ REJECT No mass mailers allowed. You are probably sending spam
            
			# /^X-Mailer:.*\b(Aristotle|Avalanche|Blaster|Bomber|DejaVu|eMerge|Extractor|UltraMail|Sonic|Floodgate|GeoList|Mach10|MegaPro|Aureate|MultiMailer|Bluecom|Achi-Kochi Mail|Direct Email|Andrew's SuperCool Blastoise|MailerGear|Advanced Mass Sender|SpireMail|MailWorkZ|UltimDBMail|Mabry|Lite)\b/ REJECT No mass mailers allowed. You are probably sending spam.
            
			# /^(To|From|Cc|Reply-To):.*@optonline/   REJECT Sorry, your message is probably spam

# Ross 28-11-2021 
/^Subject:(Hai un pagamento in sospeso.*)|(.*Hai un pagamento in sospeso)|(Hai un pagamento in sospeso)$/	REJECT header spam 00020

# Ross 07-01-2021 Reject mail a officina poste italiane fake
# errore nel tuo indirizzo di consegna
/^Subject:(errore nel tuo indirizzo di consegna)|(.*errore nel tuo indirizzo di consegna)|(errore nel tuo indirizzo di consegna.*)|(.*errore nel tuo indirizzo di consegna.*)$/     REJECT content 'Reject mail poste italiane fake' prohibited

# Ross reject extension 10-11-2020  rimosso 21-10-2021 causa errori nella valutazione con outlook.com Microsoft
# /filename=\"?(.*)\.(iso|cab|exe|pif|com|dll|vbs|bat|lnk|shs|vbe|hta|mht|js|jse|cmd|vxd|scr|shm|pif|chm|dmg|xlsm|docm|dotm|xltm|xla|xlam|pptm|potm|ppsm|sldm|r00)/   REJECT WRONG ATTACHMENT 00021

/filename=\"?(.*)\.(iso|jar|cab|exe|pif|com|dll|vbs|bat|lnk|shs|vbe|hta|mht|js|jse|cmd|vxd|scr|shm|pif|chm|dmg|xlsm|docm|dotm|xltm|xlms|xla|xlam|pptm|potm|ppsm|sldm|img|r00)\"?$/ REJECT attachment prohibited 00023

# /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.+\.(exe|pif|com|dll|vbs|bat|lnk|shs|vbe|hta|mht|js|jse|cmd|vxd|scr|shm|pif|chm|dmg|xlsm|docm|dotm|xltm|xla|xlam|xlms|pptm|potm|ppsm|sldm|img]|))"?\s*$/  REJECT Attachments that contain or end in "$3" are prohibited on this server. "$2" is  the name of the rejected file 00022

#  ****************************************************************************************************************************************
#  Il seguente file non viene utilizzato da Postfix ma a causa dell'impostazine di "amavis" antivirus in master.cf
# submission inet n       -       n       -       -       smtpd
#    -o cleanup_service_name=no-headerchecks 
#
#	il blocco si trova nel file:
#	/etc/amavisd/amavisd.conf
#
#  ****************************************************************************************************************************************

#  ROSS;
#  attenzione: rimuovere la /i dal pattern perchè è per default case insensitive !
#  con la /i non funziona
/^.*BLOQUEADA.*$/ REJECT Message subject rejected [301]
/^.*BLOQUEADA$/ REJECT Message subject rejected [301]

# 05-07-2021
/^.*(Предложение)|(Предложение$)/ REJECT Message subject rejected [301]

# Ross: 13-10 Arrivano mail con TO undisclosed-recipient
# non capisco come postifix possa accettare della mail senza "to"
# comunque sembra da una parte che la soluzione è un casino dove però ho trovato qui:
# https://forums.zimbra.org/viewtopic.php?t=22884
# di mettere semplicemente un controllo al "TO":
# /^To: .*recipients*/ REJECT Please specify at least one address you are sending to.
# per cui lo provo
# 13-07-2022 Rimosso perchè alcuni mandano solo in CC
# /^To:.*undisclosed-recipients.*$/ REJECT Please specify at least one address you are sending to.

# https://www.cyberciti.biz/tips/postfix-block-mime-attachment-files.html -- 
# ross 22-06 ho aggiunto il $ alla fine della re perchè se no prende anche il nome del file e delle volte combacia con l'estensione
/name=[^>]*\.(bat|com|cmd|cpl|csh|docm|exe|dll|vbs|reg|inf|jar|js|lnk|msi|msp|pif|scf|scr|xlsm|docm|pptm)$/ REJECT bad attachment

# do something with JS files  ( https://serverfault.com/questions/754573/postfix-block-double-extensions-in-archive-attachment)
#
# method 1, much like what you asked for
# /^(.*)name=\"(.*)\.[0-z]{3,}\.js\"$/ REJECT BAD_ATTACHMENT_3CHAR

# method 2, specific on extensions before the .js, customize as desired
/^(.*)name=\"(.*)\.(exe|lnk|dll|shs|vbe|hta|mht|com|vbs|vbe|js|jse|bat|cmd|vxd|scr|shm|pif|chm|zip|dmg|xlsm|xlsx|docm|pptm)\.js\"$/ REJECT BAD_ATTACHMENT_PLUSJS

# log attachments
#/^Content-(Type|Disposition):.*(file)?name=/    WARN ATTACHMENT
#/^(.*)name=\"(.*)\./                            WARN ATTACHMENT

# 
#        Body pattern to stop a specific HTML browser vulnerability
#        exploit.
# 
#        /etc/postfix/main.cf:
#            body_checks = regexp:/etc/postfix/body_checks
# 
#        /etc/postfix/body_checks:
#            /^<iframe src=(3D)?cid:.* height=(3D)?0 width=(3D)?0>$/
#                REJECT IFRAME vulnerability exploit
# 
# SEE ALSO
#        cleanup(8), canonicalize and enqueue Postfix message
#        pcre_table(5), format of PCRE lookup tables
#        regexp_table(5), format of POSIX regular expression tables
#        postconf(1), Postfix configuration utility
#        postmap(1), Postfix lookup table management
#        postsuper(1), Postfix janitor
#        postcat(1), show Postfix queue file contents
#        RFC 2045, base64 and quoted-printable encoding rules
#        RFC 2047, message header encoding for non-ASCII text
# 
# README FILES
#        Use "postconf readme_directory" or  "postconf  html_direc-
#        tory" to locate this information.
#        DATABASE_README, Postfix lookup table overview
#        CONTENT_INSPECTION_README, Postfix content inspection overview
#        BUILTIN_FILTER_README, Postfix built-in content inspection
#        BACKSCATTER_README, blocking returned forged mail
# 
# LICENSE
#        The  Secure  Mailer  license must be distributed with this
#        software.
# 
# AUTHOR(S)
#        Wietse Venema
#        IBM T.J. Watson Research
#        P.O. Box 704
#        Yorktown Heights, NY 10598, USA
# 
#        Wietse Venema
#        Google, Inc.
#        111 8th Avenue
#        New York, NY 10011, USA
# 
#                                                               HEADER_CHECKS(5)

文件操作 - header_checks.pcre

文件: /root/sh/postfix/header_checks.pcre

编辑文件内容

修改文件时间

删除文件