Re: header_checks question
Juan Manuel P: > Hello Witse do you mean to use HOLD action on header_checks ? > > like this ? > > /^Subject:.*hacked*/ HOLD By the way that "*" at the end is useless. > And that whats suppose to do ? > > It is holded the email on the queue ? and I can check with mailq command ? > and later detele from queue and email me a alert Yes, as described in my reply. Then you can review the email with "postcat -q" and delete it with "postsuper -d". > Sorry for ask and not try, because we have only enviroment on producction > and dont make a misstake on the service. Then DISCARD should be considered unsafe, as it is irreversible. HOLD is safer because it can be undone with "postsuper -H". Wietse
Re: header_checks question
On 27.04.20 13:27, Juan Manuel P wrote: Hello Witse do you mean to use HOLD action on header_checks ? like this ? /^Subject:.*hacked*/ HOLD And that whats suppose to do ? if Wietse's message wasn't enough for you, I recommend looking at http://www.postfix.org/header_checks.5.html It is holded the email on the queue ? and I can check with mailq command ? and later detele from queue and email me a alert Sorry for ask and not try, because we have only enviroment on producction and dont make a misstake on the service. El lun., 27 abr. 2020 a las 12:59, Wietse Venema () escribió: jmpatagonia: > Hello I need help to using header_checks, I create a rule > > /^Subject:.*hacked*/ DISCARD An alternative is to use HOLD action, assuming you aren't using software that hijacks the HOLD feature for other purposes, such as mailscanner. Then you can review the email with "postcat -q" and delete it with "postsuper -d". > that work propertly, but a want to know it is posible to email me o to alert > me when this rule occur or is aplicated. For some way. Oviusly I see that on > the mail.log A logfile scanner such as fail2ban could do that for you. Ideally there is a rate limit so that you won't be email bombed. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Your mouse has moved. Windows NT will now restart for changes to take to take effect. [OK]
Re: header_checks question
Hello Witse do you mean to use HOLD action on header_checks ? like this ? /^Subject:.*hacked*/ HOLD And that whats suppose to do ? It is holded the email on the queue ? and I can check with mailq command ? and later detele from queue and email me a alert Sorry for ask and not try, because we have only enviroment on producction and dont make a misstake on the service. Regards El lun., 27 abr. 2020 a las 12:59, Wietse Venema () escribió: > jmpatagonia: > > Hello I need help to using header_checks, I create a rule > > > > /^Subject:.*hacked*/ DISCARD > > An alternative is to use HOLD action, assuming you aren't using > software that hijacks the HOLD feature for other purposes, such as > mailscanner. Then you can review the email with "postcat -q" and > delete it with "postsuper -d". > > > that work propertly, but a want to know it is posible to email me o to > alert > > me when this rule occur or is aplicated. For some way. Oviusly I see > that on > > the mail.log > > A logfile scanner such as fail2ban could do that for you. Ideally > there is a rate limit so that you won't be email bombed. > > Wietse >
Re: header_checks question
jmpatagonia: > Hello I need help to using header_checks, I create a rule > > /^Subject:.*hacked*/ DISCARD An alternative is to use HOLD action, assuming you aren't using software that hijacks the HOLD feature for other purposes, such as mailscanner. Then you can review the email with "postcat -q" and delete it with "postsuper -d". > that work propertly, but a want to know it is posible to email me o to alert > me when this rule occur or is aplicated. For some way. Oviusly I see that on > the mail.log A logfile scanner such as fail2ban could do that for you. Ideally there is a rate limit so that you won't be email bombed. Wietse
Re: header_checks question
Zitat von Victor Duchovni victor.ducho...@morganstanley.com: On Tue, Feb 23, 2010 at 03:47:16PM +0100, Ralf Hildebrandt wrote: So the first one is correct and the second one not?? From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= xx...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de This was within one mail from Outlook/Exchange and at least Thunderbird badly chokes on the first one when answering Same here. That's why I added the ugly hack Same what? Can someone explain the observed issue in some detail? All I am seeing is questions about an ill-advised hypothetical solution. When I put my Cyrillic name into Apple's MUA, the From: header read: From: =?utf-8?B?0JLQuNC60YLQvtGAINCU0YPRhdC+0LLQvdGL0Lk=?= mailbox this does not include any double quotes, and Outlook reads it just fine, at least with the one Outlook user I tested. Can someone explain with some specificity what problem you are trying to solve, rather than the (so far misguided :-( ) solution? The problem is that on some mails sent from Outlook it is not possible to answer with Thunderbird because the sender address is split into two invalid mailadresses when doing a reply. This only happens when there are special chars in the display name but not every time. 1.) Mail created with Outlook/Exchange (MAPI) From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= x...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de The To-Header is wrong (=22 - ), with this Thunderbird creates two recpient addresses of the form: Höfler Verena x...@.de when doing reply. The User get a error because a invalid mailaddress so he/she cannot answer the mail. In Outlook 2000 this was also a problem when answering, Outlook 2003-SP3 seems to be fixed. 2.) Outlook 2003 without Exchange From: =?iso-8859-1?Q?H=F6fler=2C_Martin?= xx...@x.de To: =?iso-8859-1?Q?Erwin_H=F6fler?= xx...@x.de From-Header is the same, To-Header is correct. No Problem when doing reply with Thunderbird. So it seems that Thunderbird is choking on the wrong To-Header from Outlook when doing a reply... Regards Andreas smime.p7s Description: S/MIME Signatur
Re: header_checks question
* lst_ho...@kwsoft.de lst_ho...@kwsoft.de: The problem is that on some mails sent from Outlook it is not possible to answer with Thunderbird because the sender address is split into two invalid mailadresses when doing a reply. This only happens when there are special chars in the display name but not every time. Exactly. 1.) Mail created with Outlook/Exchange (MAPI) From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= x...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de The To-Header is wrong (=22 - ), with this Thunderbird creates two recpient addresses of the form: When replying... Höfler Verena x...@.de thus my perception that the From: header is wrong... when doing reply. The User get a error because a invalid mailaddress Höfler - h?f...@$myorigin - FAIL so he/she cannot answer the mail. In Outlook 2000 this was also a problem when answering, Outlook 2003-SP3 seems to be fixed. 2.) Outlook 2003 without Exchange From: =?iso-8859-1?Q?H=F6fler=2C_Martin?= xx...@x.de To: =?iso-8859-1?Q?Erwin_H=F6fler?= xx...@x.de From-Header is the same, To-Header is correct. No Problem when doing reply with Thunderbird. So it seems that Thunderbird is choking on the wrong To-Header from Outlook when doing a reply... Regards Andreas -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebra...@charite.de | http://www.charite.de
Re: header_checks question
Zitat von Ralf Hildebrandt ralf.hildebra...@charite.de: * lst_ho...@kwsoft.de lst_ho...@kwsoft.de: The problem is that on some mails sent from Outlook it is not possible to answer with Thunderbird because the sender address is split into two invalid mailadresses when doing a reply. This only happens when there are special chars in the display name but not every time. Exactly. 1.) Mail created with Outlook/Exchange (MAPI) From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= x...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de The To-Header is wrong (=22 - ), with this Thunderbird creates two recpient addresses of the form: When replying... Höfler Verena x...@.de thus my perception that the From: header is wrong... It seems it is more of the To: header which confuses Thunderbird so it creates the bogus addresses out of the From: header :-( The second example works fine despite the fact that it has the same From: header coding Thunderbird is replying to... Andreas smime.p7s Description: S/MIME Signatur
Re: header_checks question
lst_ho...@kwsoft.de: Zitat von Ralf Hildebrandt ralf.hildebra...@charite.de: * lst_ho...@kwsoft.de lst_ho...@kwsoft.de: The problem is that on some mails sent from Outlook it is not possible to answer with Thunderbird because the sender address is split into two invalid mailadresses when doing a reply. This only happens when there are special chars in the display name but not every time. Exactly. 1.) Mail created with Outlook/Exchange (MAPI) From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= x...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de The To-Header is wrong (=22 - ), with this Thunderbird creates two recpient addresses of the form: When replying... H?fler Verena x...@.de thus my perception that the From: header is wrong... It seems it is more of the To: header which confuses Thunderbird so it creates the bogus addresses out of the From: header :-( The second example works fine despite the fact that it has the same From: header coding Thunderbird is replying to... Can you guys file a bug report and tell the vendor that they must apply RFC822 syntax rules on the RFC 2047 ENCODED string, not on the DECODED string. Wietse
Re: header_checks question
On Wed, Feb 24, 2010 at 11:16:41AM +0100, lst_ho...@kwsoft.de wrote: Same what? Can someone explain the observed issue in some detail? All I am seeing is questions about an ill-advised hypothetical solution. When I put my Cyrillic name into Apple's MUA, the From: header read: From: =?utf-8?B?0JLQuNC60YLQvtGAINCU0YPRhdC+0LLQvdGL0Lk=?= mailbox this does not include any double quotes, and Outlook reads it just fine, at least with the one Outlook user I tested. Can someone explain with some specificity what problem you are trying to solve, rather than the (so far misguided :-( ) solution? The problem is that on some mails sent from Outlook it is not possible to answer with Thunderbird because the sender address is split into two invalid mailadresses when doing a reply. This only happens when there are special chars in the display name but not every time. 1.) Mail created with Outlook/Exchange (MAPI) From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= x...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de The Outlook From: header is fine, no silly quotes. The To: header is lame (but not illegal), it decodes to a value of: 'some text' use of single quotes by Outlook/Exchange in place of double quotes, dates back to rather old versions of the software, I've not seen this brain-damage since the 2003 versions (2007 is current and 2010 is in beta)... The To-Header is wrong (=22 - ), with this Thunderbird creates two recpient addresses of the form: H?fler Verena x...@.de when doing reply. The From header is perfectly fine, and if Thunderbird chokes on it, then Thunderbird is broken, not Outlook. The User get a error because a invalid mailaddress so he/she cannot answer the mail. In Outlook 2000 this was also a problem when answering, Outlook 2003-SP3 seems to be fixed. 2.) Outlook 2003 without Exchange From: =?iso-8859-1?Q?H=F6fler=2C_Martin?= xx...@x.de To: =?iso-8859-1?Q?Erwin_H=F6fler?= xx...@x.de From-Header is the same, To-Header is correct. No Problem when doing reply with Thunderbird. This is a thunderbird bug, why does the To: header of the original message break replies to identical From: headers. So it seems that Thunderbird is choking on the wrong To-Header from Outlook when doing a reply... There is no wrong To-Header. File a bug-report with Mozilla. -- Viktor. P.S. Morgan Stanley is looking for a New York City based, Senior Unix system/email administrator to architect and sustain our perimeter email environment. If you are interested, please drop me a note.
Re: header_checks question
lst_ho...@kwsoft.de: There is no wrong To-Header. File a bug-report with Mozilla. That's what i tried to find out: Who is at fault and what is the root-case... If the bug is still present in TB3 i will bother to file a bug. If software X mis-handles a correctly-formatted message header, then software X is broken. Tell them to apply RFC822 syntax to the RFC 2047 ENCODED string, not the DECODED string. The whole point of RFC 2047 encoding is to make the ENCODED string compatible with RFC822 syntax. Wietse
Re: header_checks question
On Wed, Feb 24, 2010 at 04:12:05PM +0100, lst_ho...@kwsoft.de wrote: There is no wrong To-Header. File a bug-report with Mozilla. That's what i tried to find out: Who is at fault and what is the root-case... If the bug is still present in TB3 i will bother to file a bug. I failed to reproduce this (as described so far) with Thunderbird 3.0 on MacOSX. -- Viktor. P.S. Morgan Stanley is looking for a New York City based, Senior Unix system/email administrator to architect and sustain our perimeter email environment. If you are interested, please drop me a note.
Re: header_checks question
Zitat von Victor Duchovni victor.ducho...@morganstanley.com: On Wed, Feb 24, 2010 at 04:12:05PM +0100, lst_ho...@kwsoft.de wrote: There is no wrong To-Header. File a bug-report with Mozilla. That's what i tried to find out: Who is at fault and what is the root-case... If the bug is still present in TB3 i will bother to file a bug. I failed to reproduce this (as described so far) with Thunderbird 3.0 on MacOSX. Yup, seems to be fixed in Thunderbird 3, no problem with 3.0.1 on Windows either... So for the archives case closed for Thunderbird later than 3 and Outlook since at least 2003-SP3. Many Thanks for clarification Andreas smime.p7s Description: S/MIME Signatur
Re: header_checks question
Zitat von Victor Duchovni victor.ducho...@morganstanley.com: On Mon, Feb 22, 2010 at 03:54:47PM -0500, Wietse Venema wrote: The rules for display names are in RFC*22. Look for the ABNF for display-name, phrase, word, and atom. Short answer: as long as =?iso-8859-1?Q?stuff?= looks like an RFC2822 atom, it needs no quoting. And of course, RFC 2047 ensures that encoded words are atoms. So the first one is correct and the second one not?? From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= xx...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de This was within one mail from Outlook/Exchange and at least Thunderbird badly chokes on the first one when answering Many Thanks Andreas smime.p7s Description: S/MIME Signatur
Re: header_checks question
So the first one is correct and the second one not?? From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= xx...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de This was within one mail from Outlook/Exchange and at least Thunderbird badly chokes on the first one when answering Same here. That's why I added the ugly hack -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebra...@charite.de | http://www.charite.de
Re: header_checks question
lst_ho...@kwsoft.de: Zitat von Victor Duchovni victor.ducho...@morganstanley.com: On Mon, Feb 22, 2010 at 03:54:47PM -0500, Wietse Venema wrote: The rules for display names are in RFC*22. Look for the ABNF for display-name, phrase, word, and atom. Short answer: as long as =?iso-8859-1?Q?stuff?= looks like an RFC2822 atom, it needs no quoting. And of course, RFC 2047 ensures that encoded words are atoms. So the first one is correct and the second one not?? From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= xx...@x.de This is a properly encoded string. If a mail system cannot deal with it, then it mis-implements RFC 5322 syntax rules and RFC 2047 encoding. Of course we know exactly what the bug is: they apply RFC 5322 syntax rules on the DECODED string. Instead, they must apply RFC 5322 syntax rules on the ENCODED string. That is the whole point of having RFC 2047 encoding in the first place. Putting unencoded quotes around an RFC 2047 encoded string violates RFC 2047. Inserting encoded quotes into an RFC 2047 encoded string will break strings that already contain quotes. Wietse
Re: header_checks question
On Tue, Feb 23, 2010 at 03:47:16PM +0100, Ralf Hildebrandt wrote: So the first one is correct and the second one not?? From: =?iso-8859-1?Q?H=F6fler=2C_Verena?= xx...@x.de To: =?iso-8859-1?Q?=27=22H=F6fler=2C_Martin=22=27?= xx...@kwsoft.de This was within one mail from Outlook/Exchange and at least Thunderbird badly chokes on the first one when answering Same here. That's why I added the ugly hack Same what? Can someone explain the observed issue in some detail? All I am seeing is questions about an ill-advised hypothetical solution. When I put my Cyrillic name into Apple's MUA, the From: header read: From: =?utf-8?B?0JLQuNC60YLQvtGAINCU0YPRhdC+0LLQvdGL0Lk=?= mailbox this does not include any double quotes, and Outlook reads it just fine, at least with the one Outlook user I tested. Can someone explain with some specificity what problem you are trying to solve, rather than the (so far misguided :-( ) solution? -- Viktor. P.S. Morgan Stanley is looking for a New York City based, Senior Unix system/email administrator to architect and sustain our perimeter email environment. If you are interested, please drop me a note.
Re: header_checks question
Zitat von Ralf Hildebrandt ralf.hildebra...@charite.de: Can anybody comment on this ugly fix for Umlauts in realnames? # Already with Quotes (=22) thus do nothing /^From: =?iso-8859-1?Q?=22(.*)=22?= (.*)$/ REPLACE From: =?iso-8859-1?Q?=22$1=22?= $2 # No quotes /^From: =?iso-8859-1?Q?(.*)?= (.*)$/ REPLACE From: =?iso-8859-1?Q?=22$1=22?= $2 #becaus: #wrong =?iso-8859-1?Q?Kr=FCger=2C_Stephanie?= #correct =?iso-8859-1?Q?=22Dr._med._Stefan_R=F6pke=22?= Yes, this fails if the encoding is NOT iso-8859-1 Not using Outlook as mailclient??? More serious, i would be interested too because this happens to us around twice a month from external senders using Outlook/Exchange... Regards Andreas smime.p7s Description: S/MIME Signatur
Re: header_checks question
On Mon, Feb 22, 2010 at 02:57:54PM +0100, Ralf Hildebrandt wrote: Can anybody comment on this ugly fix for Umlauts in realnames? # Already with Quotes (=22) thus do nothing /^From: =\?iso-8859-1\?Q\?=22(.*)=22\?= (.*)$/ REPLACE From: =?iso-8859-1?Q?=22$1=22?= $2 # No quotes /^From: =\?iso-8859-1\?Q\?(.*)\?= (.*)$/ REPLACE From: =?iso-8859-1?Q?=22$1=22?= $2 #becaus: #wrong =?iso-8859-1?Q?Kr=FCger=2C_Stephanie?= #correct =?iso-8859-1?Q?=22Dr._med._Stefan_R=F6pke=22?= The wrong form is RFC compliant. No quotes are required, because they are not part of the value, they are part of the syntax for a quoted-string encapsulation of the value inside the quotes. When using RFC 2047 encoding, the encoded string is an RFC822 atom and does not require any quotes. The correct form is not RFC compliant. -- Viktor. P.S. Morgan Stanley is looking for a New York City based, Senior Unix system/email administrator to architect and sustain our perimeter email environment. If you are interested, please drop me a note.
Re: header_checks question
* Victor Duchovni victor.ducho...@morganstanley.com: On Mon, Feb 22, 2010 at 02:57:54PM +0100, Ralf Hildebrandt wrote: Can anybody comment on this ugly fix for Umlauts in realnames? # Already with Quotes (=22) thus do nothing /^From: =\?iso-8859-1\?Q\?=22(.*)=22\?= (.*)$/ REPLACE From: =?iso-8859-1?Q?=22$1=22?= $2 # No quotes /^From: =\?iso-8859-1\?Q\?(.*)\?= (.*)$/ REPLACE From: =?iso-8859-1?Q?=22$1=22?= $2 #becaus: #wrong =?iso-8859-1?Q?Kr=FCger=2C_Stephanie?= #correct =?iso-8859-1?Q?=22Dr._med._Stefan_R=F6pke=22?= The wrong form is RFC compliant. No quotes are required, because they are not part of the value, they are part of the syntax for a quoted-string encapsulation of the value inside the quotes. When using RFC 2047 encoding, the encoded string is an RFC822 atom and does not require any quotes. But Exchange forgets the and just encodes Lästnäme, Firstnäme instead of Lästnäme, Firstnäme thus the quoted-string encapsulation is wrong?! -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebra...@charite.de | http://www.charite.de
Re: header_checks question
* Wietse Venema wie...@porcupine.org: But Exchange forgets the and just encodes L?stn?me, Firstn?me instead of L?stn?me, Firstn?me thus the quoted-string encapsulation is wrong?! RFC822..RFC5322 do not need quotes around text inside the =?iso-8859-1?Q?stuff?=, as long as there are no spaces. That was an explicit design choice. So what IS the correct way? if (space or special characters in realname) return encode(add_quotes(realname)) else return realname fi ? Or is it if (space or special characters in realname) return add_quotes(encode(realname)) else return realname fi -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebra...@charite.de | http://www.charite.de
Re: header_checks question
Ralf Hildebrandt: * Wietse Venema wie...@porcupine.org: But Exchange forgets the and just encodes L?stn?me, Firstn?me instead of L?stn?me, Firstn?me thus the quoted-string encapsulation is wrong?! RFC822..RFC5322 do not need quotes around text inside the =?iso-8859-1?Q?stuff?=, as long as there are no spaces. That was an explicit design choice. Actually spaces are OK. So what IS the correct way? if (space or special characters in realname) return encode(add_quotes(realname)) else return realname The rules for display names are in RFC*22. Look for the ABNF for display-name, phrase, word, and atom. Short answer: as long as =?iso-8859-1?Q?stuff?= looks like an RFC2822 atom, it needs no quoting. Wietse
Re: header_checks question
On Mon, Feb 22, 2010 at 09:26:53PM +0100, Ralf Hildebrandt wrote: if (space or special characters in realname) return encode(add_quotes(realname)) else return realname fi No, if you encode, you don't add quotes, quotes are for ASCII data that contains special characters. For non-ASCII data, you just encode, *without* quotes. Or is it if (space or special characters in realname) return add_quotes(encode(realname)) else return realname fi No, you don't quote encoded data, this violates RFC 2047, which explicitly mandates no encoded text in quoted strings. The answer is that RFC-2047 encoding obviates the need for quotes. If Exchange/Outlook is breaking on correctly encoded display names, complain to Microsoft and have them fix the bug. -- Viktor. P.S. Morgan Stanley is looking for a New York City based, Senior Unix system/email administrator to architect and sustain our perimeter email environment. If you are interested, please drop me a note.
Re: header_checks question
On Mon, Feb 22, 2010 at 03:54:47PM -0500, Wietse Venema wrote: The rules for display names are in RFC*22. Look for the ABNF for display-name, phrase, word, and atom. Short answer: as long as =?iso-8859-1?Q?stuff?= looks like an RFC2822 atom, it needs no quoting. And of course, RFC 2047 ensures that encoded words are atoms. -- Viktor. P.S. Morgan Stanley is looking for a New York City based, Senior Unix system/email administrator to architect and sustain our perimeter email environment. If you are interested, please drop me a note.
