bis heute morgen hat das ganze gut funktioniert.<br>leider seit heute morgen wieder einige mails bekommen.<br>allerdings an eine andere adresse, aber dieselbe domain.<br><br>habe hier mal den header einer nachricht:<br><br>
________________________________________________________________________________________<br>Microsoft Mail Internet Headers Version 2.0<br>Received: from <a href="http://mailgate.domain.org">mailgate.domain.org</a> ([<a href="http://10.0.0.1">10.0.0.1</a>]) by mail.firma.local with Microsoft SMTPSVC(6.0.3790.3959);<br>
Tue, 27 May 2008 16:40:43 +0200<br>Received: by <a href="http://mailgate.domain.org">mailgate.domain.org</a> (mailgate, from userid 505)<br> id 9D214D404D; Tue, 27 May 2008 16:40:47 +0200 (CEST)<br>Received: from <a href="http://mailgate.domain.org">mailgate.domain.org</a> (localhost.localdomain [<a href="http://127.0.0.1">127.0.0.1</a>])<br>
by <a href="http://mailgate.domain.org">mailgate.domain.org</a> (mailgate) with SMTP id CB9FED405F;<br> Tue, 27 May 2008 16:40:45 +0200 (CEST)<br>Received: from <a href="http://c163.net">c163.net</a> (unknown [<a href="http://61.156.14.22">61.156.14.22</a>])<br>
by <a href="http://mailgate.domain.org">mailgate.domain.org</a> (mailgate) with SMTP id 5F5A3D404D<br> for <<a href="mailto:contact@domain.org">contact@domain.org</a>>; Tue, 27 May 2008 16:40:42 +0200 (CEST)<br>
Received: (fmail 23850 invoked for bounce); 27 May 2008 14:36:29 -0000<br>Date: 27 May 2008 14:36:29 -0000<br>From: <a href="mailto:MAILER-DAEMON@c163.net">MAILER-DAEMON@c163.net</a><br>To: <a href="mailto:contact@domain.org">contact@domain.org</a><br>
Subject: ????: ????<br>MIME-Version: 1.0<br>Content-Type: multipart/mixed;<br> boundary="-------1forlinkforlinkforlinkforlink1"<br>Message-Id: <<a href="mailto:20080527144042.5F5A3D404D@mailgate.domain.org">20080527144042.5F5A3D404D@mailgate.domain.org</a>><br>
X-AV-Checked: ClamAV using ClamSMTP<br>X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on <br> <a href="http://mailgate.domain.org">mailgate.domain.org</a><br>X-Spam-Level: <br>X-Spam-Status: No, score=-74.2 required=4.0 tests=BAYES_50,HTML_FONT_BIG,<br>
HTML_MESSAGE,MIME_HTML_MOSTLY,MSGID_FROM_MTA_ID,NO_REAL_NAME,<br> RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SUBJ_ILLEGAL_CHARS,URIBL_AB_SURBL,<br> URIBL_OB_SURBL,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL,<br> USER_IN_WHITELIST autolearn=disabled version=3.0.3<br>
Return-Path: <><br>X-OriginalArrivalTime: 27 May 2008 14:40:43.0651 (UTC) FILETIME=[A4753D30:01C8C007]<br><br>---------1forlinkforlinkforlinkforlink1<br>Content-Type: text/plain; charset=gb2312<br>Content-Transfer-Encoding: quoted-printable<br>
<br>---------1forlinkforlinkforlinkforlink1<br>Content-Type: message/rfc822<br>Content-disposition: attachment<br><br>Return-Path: <<a href="mailto:contact@domain.org">contact@domain.org</a>><br>Received: (fmail 23824 invoked from network); 27 May 2008 14:36:27 -0000<br>
Received: from unknown (HELO <a href="http://0x5550d362.adsl.cybercity.dk">0x5550d362.adsl.cybercity.dk</a>) (<a href="http://85.80.211.98">85.80.211.98</a>)<br> by 0 with SMTP; 27 May 2008 14:36:27 -0000<br>IP: <a href="http://85.80.211.98">85.80.211.98</a><br>
Message-ID: <000601c8c007$0481818a$e2097c89@kkflk><br>From: "Breitling Watches" <<a href="mailto:contact@domain.org">contact@domain.org</a>><br>To: "Un Beatable" <<a href="mailto:rsc@c163.net">rsc@c163.net</a>><br>
Subject: Chanel Watches<br>Date: Tue, 27 May 2008 12:53:03 +0000<br>MIME-Version: 1.0<br>Content-Type: multipart/alternative;<br> boundary="----=_NextPart_000_0003_01C8C007.047F5F3C"<br>X-Priority: 3<br>X-MSMail-Priority: Normal<br>
X-Mailer: Microsoft Outlook Express 6.00.2900.3138<br>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198<br><br>------=_NextPart_000_0003_01C8C007.047F5F3C<br>Content-Type: text/plain;<br> charset="iso-8859-1"<br>
Content-Transfer-Encoding: quoted-printable<br><br>------=_NextPart_000_0003_01C8C007.047F5F3C<br>Content-Type: text/html;<br> charset="iso-8859-1"<br>Content-Transfer-Encoding: quoted-printable<br><br><br>------=_NextPart_000_0003_01C8C007.047F5F3C--<br>
<br>---------1forlinkforlinkforlinkforlink1--<br>__________________________________________________________________________________________________<br><br>Hat jemand eine Idee, wie ich die Regeln verschärfen kann um diese mails auch abzuweisen?<br>
<br>vielen Dank im Voraus,<br><br>Tobi<br><br><br><div class="gmail_quote">Am 15. Mai 2008 17:28 schrieb Tobi H <<a href="mailto:tobias.hiller@googlemail.com">tobias.hiller@googlemail.com</a>>:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
das scheints gewesen zu sein...<br>Wer lesen kann ist klar im vorteil ;)<br>Vielen Dank!<br><br>Tobi<br><br><div class="gmail_quote">Am 15. Mai 2008 16:47 schrieb Stefan Förster <<a href="mailto:cite@incertum.net" target="_blank">cite@incertum.net</a>>:<div>
<div></div><div class="Wj3C7c"><br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>* Stefan Förster <<a href="mailto:cite@incertum.net" target="_blank">cite@incertum.net</a>> wrote:<br>
> * Tobi H <<a href="mailto:tobias.hiller@googlemail.com" target="_blank">tobias.hiller@googlemail.com</a>> wrote:<br>
>> habe im prinzip einfach nur das beispiel angepasst und eingefügt.<br>
>> hab jetzt hier nochmal das beispiel, wie es angepasst in meiner header_check<br>
>> steht:<br>
>><br>
>> 40:if /^Received:/<br>
>> 41: /^Received: +from +(porcupine\.org) +/<br>
>> 42: reject forged client name in Received: header: $1<br>
>> 43: /^Received: +from +[^ ]+ +\(([^ ]+ +[he]+lo=|[he]+lo<br>
>> +)(porcupine\.org)\)/<br>
>> 44: reject forged client name in Received: header: $2<br>
>> 45: /^Received:.* +by +(porcupine\.org)\b/<br>
>> 46: reject forged mail server name in Received: header: $1<br>
>> 47: endif<br>
>> 48: /^Message-ID:.* <!&!/ DUNNO<br>
>> 49: /^Message-ID:.*@(porcupine\.org)/<br>
>> 50: reject forged domain name in Message-ID: header: $1<br>
>><br>
>> und in zeile 60 gehts dann weiter mit:<br>
>> 60: /^Received: from localhost/ IGNORE<br>
>><br>
>><br>
>> dazwischen halt kommentare usw.<br>
><br>
> Die Leerzeichen stören ihn, denke ich:<br>
><br>
> | Note: do not prepend whitespace to patterns inside if..endif.<br>
<br>
</div>Oder die Whitespaces am Anfang der Zeile. Da war doch was.<br>
<br>
|DO NOT indent lines starting with /pattern/ between the "if" and<br>
<div>|"endif"!<br>
<br>
<br>
<br>
Ciao<br>
Stefan<br>
--<br>
Stefan Förster <a href="http://www.incertum.net/" target="_blank">http://www.incertum.net/</a> Public Key: 0xBBE2A9E9<br>
</div>FdI #82: Demokratie - Statt eines Hofnarren für den König gibt es ein paar<br>
hundert für das Volk. (Stefan Hager)<br>
<div><div></div><div>--<br>
_______________________________________________<br>
Postfixbuch-users -- <a href="http://www.postfixbuch.de" target="_blank">http://www.postfixbuch.de</a><br>
Heinlein Professional Linux Support GmbH<br>
<br>
<a href="mailto:Postfixbuch-users@listi.jpberlin.de" target="_blank">Postfixbuch-users@listi.jpberlin.de</a><br>
<a href="https://listi.jpberlin.de/mailman/listinfo/postfixbuch-users" target="_blank">https://listi.jpberlin.de/mailman/listinfo/postfixbuch-users</a><br>
</div></div></blockquote></div></div></div><br>
</blockquote></div><br>