Re: Filter email where sender and rcpt-to are the same
On Wed, Feb 20, 2019 at 04:57:08PM +0100, Mischa wrote: > > > > On 6 Feb 2019, at 17:24, Mischa wrote: > > > >> On 6 Feb 2019, at 15:38, Gilles Chehade wrote: > >> > >> On Wed, Feb 06, 2019 at 11:42:19AM +0100, Mischa wrote: > >>> Hi All, > >>> > >>> There has been a new scam going around for some time now where you get an > >>> email from your own email address to your email address. > >>> For people that don't know better it's scares the s**t out of them as the > >>> email is like: > >>> > >>> Hey I hacked your account as you can see since I am sending this email > >>> from your own account. > >>> etc.. > >>> > >>> Is there a quick way to filter email where the sender and rcpt-to are the > >>> same? > >>> Has anybody created a filter already to easily do this? > >>> > >>> Thanx! > >>> > >> > >> I used to have a rule to reject any mail from my domain but which were > >> not originating from trusted machines nor authenticated users. > >> > >> not tested here but something along the lines of: > >> > >> match !from local mail-from "@opensmtpd.org" reject > >> match !auth from any mail-from "@opensmtpd.org" reject > >> > >> there are other ways too > > > > Let me see if some modified version of those rules work, the difference is > > that the MX is for incoming email only, outbound is taking a different > > route. > > > > Thanx Gilles! > > I have been trying to do things like: > > match from any rcpt-to "openbsd @ high5.nl" mail-from "openbsd @ high5.nl" > reject > (without the spaces of course) > > But it's not working. :/ > Is there again parts of the rule I am missing? > yes, you lack the "for" part, making your rules assume "for local", this should be better: match from any mail-from "open...@high5.nl" \ for any rcpt-to "open...@high5.nl"\ reject the criterias are really separate one from another, each performing their own match so you really need the rule to describe every criteria, it will not infer "for" based on "rcpt-to" -- Gilles Chehade @poolpOrg https://www.poolp.org tip me: https://paypal.me/poolpOrg -- You received this mail because you are subscribed to misc@opensmtpd.org To unsubscribe, send a mail to: misc+unsubscr...@opensmtpd.org
Re: Filter email where sender and rcpt-to are the same
> On 6 Feb 2019, at 17:24, Mischa wrote: > >> On 6 Feb 2019, at 15:38, Gilles Chehade wrote: >> >> On Wed, Feb 06, 2019 at 11:42:19AM +0100, Mischa wrote: >>> Hi All, >>> >>> There has been a new scam going around for some time now where you get an >>> email from your own email address to your email address. >>> For people that don't know better it's scares the s**t out of them as the >>> email is like: >>> >>> Hey I hacked your account as you can see since I am sending this email from >>> your own account. >>> etc.. >>> >>> Is there a quick way to filter email where the sender and rcpt-to are the >>> same? >>> Has anybody created a filter already to easily do this? >>> >>> Thanx! >>> >> >> I used to have a rule to reject any mail from my domain but which were >> not originating from trusted machines nor authenticated users. >> >> not tested here but something along the lines of: >> >> match !from local mail-from "@opensmtpd.org" reject >> match !auth from any mail-from "@opensmtpd.org" reject >> >> there are other ways too > > Let me see if some modified version of those rules work, the difference is > that the MX is for incoming email only, outbound is taking a different route. > > Thanx Gilles! I have been trying to do things like: match from any rcpt-to "openbsd @ high5.nl" mail-from "openbsd @ high5.nl" reject (without the spaces of course) But it's not working. :/ Is there again parts of the rule I am missing? Mischa -- You received this mail because you are subscribed to misc@opensmtpd.org To unsubscribe, send a mail to: misc+unsubscr...@opensmtpd.org
Re: Filter email where sender and rcpt-to are the same
> On 6 Feb 2019, at 15:38, Gilles Chehade wrote: > > On Wed, Feb 06, 2019 at 11:42:19AM +0100, Mischa wrote: >> Hi All, >> >> There has been a new scam going around for some time now where you get an >> email from your own email address to your email address. >> For people that don't know better it's scares the s**t out of them as the >> email is like: >> >> Hey I hacked your account as you can see since I am sending this email from >> your own account. >> etc.. >> >> Is there a quick way to filter email where the sender and rcpt-to are the >> same? >> Has anybody created a filter already to easily do this? >> >> Thanx! >> > > I used to have a rule to reject any mail from my domain but which were > not originating from trusted machines nor authenticated users. > > not tested here but something along the lines of: > >match !from local mail-from "@opensmtpd.org" reject >match !auth from any mail-from "@opensmtpd.org" reject > > there are other ways too Let me see if some modified version of those rules work, the difference is that the MX is for incoming email only, outbound is taking a different route. Thanx Gilles! Mischa -- You received this mail because you are subscribed to misc@opensmtpd.org To unsubscribe, send a mail to: misc+unsubscr...@opensmtpd.org
Re: Filter email where sender and rcpt-to are the same
On Wed, Feb 06, 2019 at 11:42:19AM +0100, Mischa wrote: > Hi All, > > There has been a new scam going around for some time now where you get an > email from your own email address to your email address. > For people that don't know better it's scares the s**t out of them as the > email is like: > > Hey I hacked your account as you can see since I am sending this email from > your own account. > etc.. > > Is there a quick way to filter email where the sender and rcpt-to are the > same? > Has anybody created a filter already to easily do this? > > Thanx! > I used to have a rule to reject any mail from my domain but which were not originating from trusted machines nor authenticated users. not tested here but something along the lines of: match !from local mail-from "@opensmtpd.org" reject match !auth from any mail-from "@opensmtpd.org" reject there are other ways too -- Gilles Chehade @poolpOrg https://www.poolp.org tip me: https://paypal.me/poolpOrg -- You received this mail because you are subscribed to misc@opensmtpd.org To unsubscribe, send a mail to: misc+unsubscr...@opensmtpd.org
Filter email where sender and rcpt-to are the same
Hi All, There has been a new scam going around for some time now where you get an email from your own email address to your email address. For people that don't know better it's scares the s**t out of them as the email is like: Hey I hacked your account as you can see since I am sending this email from your own account. etc.. Is there a quick way to filter email where the sender and rcpt-to are the same? Has anybody created a filter already to easily do this? Thanx! Mischa -- You received this mail because you are subscribed to misc@opensmtpd.org To unsubscribe, send a mail to: misc+unsubscr...@opensmtpd.org
