Ini saya sumbang regexp : header_checks
## silakan filter mail disini ## ntar kalo ada yg protes ya edit aja file ini, jangan lupa postfix reload. ## ------------------------------------------------------------------------- /^(.*)name\=\"(.*)\.(hta|com|pif|vbs|vbe|bat|cmd|vxd|scr)\"$/ DISCARD virus /^(.*)name\=\"(.*)\.EML\.(zip)\"$/ HOLD virus /^(.*)name\=\"(.*)\.TXT\.(zip)\"$/ HOLD virus /^(.*)name\=\"(.*)\.WORD\.(zip)\"$/ HOLD virus /^(.*)name\=\"(.*)\.DOC\.(zip)\"$/ HOLD virus /^(.*)name\=\"(.*)\.XLS\.(zip)\"$/ HOLD virus /^From:.*Auto-reply from webmaster/ DISCARD spam /^Reply-To:.*<>/ DISCARD spam /^Reply-To:.*yahoogroups\.com/ OK /^To:.*yahoogroups\.com/ OK /^X-Apparently-To:.*yahoogroups\.com/ OK /^From:.*jobdb\.com/ OK /^From:.*kabelvision\.com/ OK /^From:.*nikkei\.com/ OK /^Thread-Topic:.*Delivery Status Notification/ DISCARD spam /^Subject:.*Mail Delivery failure \(.*\)/ DISCARD spam /^Subject:.*WINNING NOTIFICATION/ DISCARD spam /^Subject:.*make investors money/ DISCARD spam /^Subject:.*Returned mail\: Service un/ DISCARD spam /^Subject:.*Warning\: could not send message/ DISCARD spam /^Subject:.*[Vv]iruswarning/ DISCARD virus /^Subject:.*[Vv]irus.*[Dd]etected/ DISCARD virus /^Subject:.*[Mm]ail delivery failed/ DISCARD spam /^Subject:.*[Uu]ndeliverable/ DISCARD spam /^Subject:.*meay-meay/ DISCARD virus /^Subject:.*\^_\^/ DISCARD virus /^Subject:.*Virus found in/ DISCARD virus /^Subject:.*Virus Alert/ DISCARD virus /^Subject:.*Notify about using the e-mail/ DISCARD spam /^Subject:.*Symantec.*[Dd]etected/ DISCARD virus /^Subject:.*User unknown/ DISCARD spam /^Subject:.*Virus.*[Ii]ntercepted/ DISCARD virus /^Subject:.*Medical Innovation/ DISCARD spam /^Subject:.*[Tt]oys Warehouse/ DISCARD spam /^Subject:.*[Dd]isallowed.*[Aa]ttachment/ DISCARD virus /^Subject:.*TAUL COIL/ DISCARD spam /^Subject:.*GoToMyPC.*[Aa]ccount/ DISCARD spam /^Subject:.*NISSHIN.*PRIME/ DISCARD spam /^Subject:.*[Ff]ailure.*[Nn]otice/ DISCARD virus /^Subject:.*[Dd]aily.*[Aa]lert/ DISCARD spam /^Subject:.*[Ss]can.*[Rr]esult/ DISCARD spam /^Subject:.*[Ss]tock.*[Nn]ewsletter/ DISCARD spam /^Subject:.*MDaemon Notification/ DISCARD virus /^Subject:.*[Cc]ustom logos/ DISCARD spam /^Subject:.*Warning\: message delayed/ DISCARD spam /^Subject:.*BANNED FILENAME/ DISCARD spam /^Subject:[EMAIL PROTECTED]/ DISCARD spam /^Subject:.*meds now sold/ DISCARD spam /^Subject:.*Returned mail/ DISCARD spam /^Subject:.*Mail Delayed/ DISCARD spam /^Subject:.*ScanMail Message/ DISCARD spam /^Subject:.*Content violation found/ DISCARD spam /^Subject:.*Mail Delivery \(failure\)/ DISCARD spam /^Subject:.*Mail System Error/ DISCARD spam /^From:[EMAIL PROTECTED]/ DISCARD spam /^Subject:.*Warning about your e-mail account/ DISCARD spam /^Subject:.*Extreme Content Violation/ DISCARD spam /^From:.*waralaba2002/ DISCARD spam /^Subject:.*AWARD NOTIFICATION/ DISCARD spam /^Subject:.*_lis_/ DISCARD spam /^Subject:.*i_c_o/ DISCARD spam /^Subject:.*y_d_roc_0_d_0/ DISCARD spam /^Subject:.*Hydrocodone/ DISCARD spam /^Subject:.*Mail Delivery Problem/ DISCARD spam /^Subject:.*Delivery has failed/ DISCARD spam /^Subject:.*Delivery failure/ DISCARD spam /^Subject:.*MDaemon Warning/ DISCARD spam /^Subject:.*Escalation/ DISCARD spam /^Subject:.*Logo Animation and Flash Design/ DISCARD spam /^Subject:.*ialis/ DISCARD spam /^Subject:.*anax/ DISCARD spam /^Subject:.*C1al1s super m3dz/ DISCARD spam /^Subject:.*icodin/ DISCARD spam /^Subject:.*Cyber ph`armacy / DISCARD spam /^Subject:.*WINNING NOTICE/ DISCARD spam /^Subject:.*High-quality custom logos/ DISCARD spam /^To:.*some_mail_user/ DISCARD virus /^To:.*many-mailer/ DISCARD virus /^Subject:.*viakgra/ DISCARD spam /^Reply-To:.*amercenter\.com/ DISCARD spam /^Subject:.*custom logo/ DISCARD spam /^Subject:.*V�agra/ DISCARD spam /^Subject:.*Very effective weight loss/ DISCARD spam /^Subject:.*Hot Trade Of The Week/ DISCARD spam /^Subject:.*AWARD WINNING/ DISCARD spam /^Subject:.*worry, just listen/ DISCARD spam /^Subject:[EMAIL PROTECTED]@x/ DISCARD spam body_checks /^(.*)Virus Warning Message/ DISCARD virus /^(.*)VIRUS NOTIFICATION/ DISCARD virus /^(.*)V I R U S A L E R T/ DISCARD virus /^(.*)[Vv]\.i\.a\.g\.r\.a/ DISCARD spam /^(.*)Image not.*See message/ DISCARD virus /^(.*)VIRUS WARNING/ DISCARD virus /^(.*)Better than all other spam filters/ DISCARD spam /^(.*)VIRUS ALERT/ DISCARD virus /^(.*)lowerrates4you\.com/ DISCARD spam /^(.*)Looking forward for a response/ DISCARD spam /^(.*)WINNING NOTIFICATION/ DISCARD spam /^(.*)gomezindeed\.com/ DISCARD spam /^(.*)www\.warehouseoffers\.com/ DISCARD spam /^(.*)Smooches babes/ DISCARD spam /^(.*)V-I-A-G-R-A/ DISCARD spam /^(.*)no degree = no job = no money/ DISCARD spam /^(.*)www\.haveyouseenthisone\.com/ DISCARD spam /^(.*)\/a2\.jpg/ DISCARD spam /^(.*)activesaving\.com/ DISCARD spam /^(.*)medscustomer\.com/ DISCARD spam /^(.*)www\.chokopoppa\.com/ DISCARD spam /^(.*)ewds3mds\.com/ DISCARD spam /^(.*)cowan\.congenial\.coolsd4\.com/ DISCARD spam /^(.*)Pharmacy & Overnight Shipping/ DISCARD spam /^(.*)500_350_5\.gif/ DISCARD spam /^(.*)www\.powmowtow\.com/ DISCARD spam /^(.*)bizmedsa\.com/ DISCARD spam /^(.*)bestchoicemortgagequotes/ DISCARD spam /^(.*)\.info\// DISCARD spam /^(.*)sigloan\.com/ DISCARD spam /^(.*)www\.easw3e\.com/ DISCARD spam /^(.*)www\.watchsun\.com/ DISCARD spam /^(.*)wexscle\.com/ DISCARD spam /^(.*)\/twer\.gif/ DISCARD spam /^(.*)[Vv] [Ii] [Aa] [Gg] [Rr] [Aa]/ DISCARD spam /^(.*)\/cgi-bin\/form\.pl/ DISCARD spam /^(.*)X[a]<.*>n[a]x/ DISCARD spam /^(.*)V[a]<.*>lium/ DISCARD spam /^(.*)------ failed message/ DISCARD virus /^(.*)Warning\: antivirus system report/ DISCARD virus /^(.*)\/4-2\.jpg/ DISCARD spam /^(.*)CHEAP !!!/ DISCARD spam /^(.*)\/remove\// DISCARD spam /^(.*)\/car\.gif/ DISCARD spam /^(.*)- US pharmacy/ DISCARD spam /^(.*)\.biz\// DISCARD spam /^(.*)\/emailremove\.asp/ DISCARD spam /^(.*)\/pics\/am1\.gif/ DISCARD spam /^(.*)DQoNCjxib2R5Pg0KPGRpdiBhbGlnbj0iY2VudGVy/ DISCARD spam /^(.*)\.us\// DISCARD spam /^(.*)Powered by the new Norton OnlineScan/ DISCARD virus /^(.*)images\.imagesbyaz\.com/ DISCARD spam /^(.*)portendrxcomplete\.com/ DISCARD spam /^(.*)maleguide\.net/ DISCARD spam /^(.*)valuedclientmtg\.com/ DISCARD spam /^(.*)cyysps\.com/ DISCARD spam /^(.*)Learn how to increase/ DISCARD spam /^(.*)medzwarehouse\.com/ DISCARD spam /^(.*)bestgpad\.jpg/ DISCARD spam /^(.*)Unsensored hard action caught/ DISCARD spam /^(.*)www\.micomeds\.com/ DISCARD spam /^(.*)apples\.ideaswithmore\.com/ DISCARD spam /^(.*)NO Hunger Pains/ DISCARD spam /^(.*)Vic`0di'n/ DISCARD spam /^(.*)US Stock-Market/ DISCARD spam /^(.*)\/uba\/uba\.gif/ DISCARD spam /^(.*)icodin/ DISCARD spam /^(.*)Auto-ReMail/ HOLD virus /^(.*)ReMail\.System/ HOLD virus /^(.*)xoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0iQ29/ DISCARD spam /^(.*)entrefinance\.net/ DISCARD virus /^(.*)GET LARGER TODAY/ DISCARD spam /^(.*)www\.518info\.com/ DISCARD spam /^(.*)www\.vitatex\.ru/ DISCARD spam /^(.*)Vi-co-din/ DISCARD spam /^(.*)lifespan enhancement press here/ DISCARD spam /^(.*)gage\.gif/ DISCARD spam /^(.*)viagra7\.jpg/ DISCARD spam /^(.*)Fuel Saver Pro/ DISCARD spam /^(.*)keen\.jpg/ DISCARD spam /^(.*)mo rtgage/ DISCARD spam /^(.*)mor\.tgage/ DISCARD spam /^(.*)_csseditor/ DISCARD spam /^(.*)TTTP/ DISCARD spam /^(.*)gkJCQ0KICAgICAgPHAgc3R5bGU9InRleHQtYWxp/ DISCARD spam /^(.*)DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LU/ DISCARD spam /^(.*)59_1\.gif/ DISCARD spam /^(.*)star-teens\.com/ DISCARD spam /^(.*)mor tg age/ DISCARD spam /^(.*)Check out Ministry in a Box/ DISCARD spam /^(.*)pharma01\.jpg/ DISCARD spam ----- Original Message ----- From: "Jays" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, May 29, 2004 4:38 AM Subject: RE: [postfix-users] content filter > dear all, > > di README : BACKSCATTER_README > > /etc/postfix/main.cf: > header_checks = regexp:/etc/postfix/header_checks > body_checks = regexp:/etc/postfix/body_checks > > /etc/postfix/header_checks: > /^(From|Return-Path):.*[[:<:]]([EMAIL PROTECTED])[[:>:]]/ > reject forged sender address in $1: message header: $2 > > /etc/postfix/body_checks: > /^[> ]*(From|Return-Path):.*[[:<:]]([EMAIL PROTECTED])[[:>:]]/ > reject forged sender address in $1: message header: $2 > > Notes: > > * The example is simplified for educational purposes. In reality, my > patterns > list multiple email addresses as > "([EMAIL PROTECTED]|[EMAIL PROTECTED])". > > * The [[:<:]] matches the beginning of a word, and the [[:>:]] matches the > end. > > * The "\." matches "." literally. Without the "\", the "." would match any > character. > > saya mau coba apply body_check, tapi masih gak ngarti dengan regexp. > saya pengennya cek body yang mengandung kalimat tertentu...dan postfix block > (reject/drop) > > ...pls help > > ./jays > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Jays > > Sent: Friday, May 28, 2004 8:52 AM > > To: [EMAIL PROTECTED] > > Subject: [postfix-users] content filter > > > > > > buat para postfixer- jangan bosen ya... > > > > aku pengennya buat rule cek body & subject, kalo mengandung > > kata2 tertentu > > akan di block. > > dicari2 di amavisd.conf kok gak ketemu, malah yg ada block dari local > > recipient.... > > pengennya aku mau block dari external sender. > > > > sampai sekarang masih ada beberapa spam yg masih lolos..... > > > > pls help > > > > ./jays > > > >
