Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When sending mail through PHP mail() - Postfix adds the following header:

Received: by myhost.mydomain.com (Postfix, from userid 48)
    id XXXXXXXXXXX; Sun, 20 Nov 2011 21:22:13 +0100 (CET)

Is there a way to remove the userid part, but keep the rest? So the result becomes (if correct):

Received: by myhost.mydomain.com (Postfix)
    id XXXXXXXXXXX; Sun, 20 Nov 2011 21:22:13 +0100 (CET)

Postfix is running on localhost and is only used to send mail from PHP through the mail() function.

A simular question regarding removing the whole header has been asked before, but I can't figure out how to remove the userid part, but keep the rest.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

I think you can try something like:

/etc/postfix/main.cf

header_checks = pcre:/etc/postfix/header_checks.pcre

/etc/postfix/header_checks.pcre

/^Received: by(.*) (Postfix, from userid(.*)$/ REPLACE Received: by ${1} 

(I could be wrong with regex, but it should work)

share|improve this answer

You shall not edit the received lines in any case.

Mainly they are required by RFC 5321 and are not allowed to manipulate. Secondly they are a valuable source for tracking abuse.

Assume you only send mails with PHP via Apache (userid 48), what does it tell you if you see messages coming from userid 5000? You are right: A malicious user or script is running mad. Are you able to track this problem with userid removed?

share|improve this answer
1  
Good points. However, I think the header exposes too much of the web server setup. I ended up with the following, wich only hides the userid when the Apache user is sending: /^Received: by (.+) \(Postfix, from userid 48\)(.+)$/ REPLACE Received: by $1 (Postfix)$2 (maybe I should change 48 to e.g. 550 instead, to not mess with the header construct) –  elaxsj Nov 22 '11 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.