1

This question continues from this identical but focuses on another aspect of detail: the Postfix testing tool and the different options.

As the OP of the linked question, to prevent spam, and specifically, compromised password extortions, I have tried to block mail that contains my pwned old password as a means of chaffing.

Supposed the hacked password was... P@ssw0rd, here is what I have done:

I have created a regex rule in /etc/postfix/header_checks

/^Subject: .*P@ssw0rd.*/i REJECT I know you are scamming me

Then re-checked main.cf

header_checks = regexp:/etc/postfix/header_checks

According to the answers to the linked question, I double checked the master.cf for options that override the header checks. Since I use dkimproxy, which runs after smtp but before delivery, I had the no_header_checks option only on the dkim completion listener (port 10028 as recommended by manuals). I also tried to comment.

Now the test. If I pick an extortion email displaying my P@ssw0rd and push it to postconf I get different results. Please note the regex is flagged case insensitive

# postmap -q "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks
# postmap -fq "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks
DISCARD I know you are scamming me

The above example also worked with the magic blue pill

So I am stuck with this. I have read the answer by Alexis Wilke and learned that Postfix by default uses case insensitive comparison. Wow, I don't care about the case, I specified /i flag.

And regexpal successfully finds the subject line when I put the headers into it.

Question: what is not working here?

2 Answers 2

1

You need to not use the flag "i" to make it case insensitive indeed. From the manual, https://www.postfix.org/regexp_table.5.html:

       i (default: on)
              Toggles  the case sensitivity flag. By default, matching is case
              insensitive.

The default is to be case insensitive, adding the flag "i" toggles it to be case sensitive.

0

As with speaking with a rubber duck, I found the solution myself while investigating and writing the question.

Removing the /i (case insensitive) flag from the header_checks file worked like a charm

Regex becomes /^Subject: .*P@ssw0rd.*/ REJECT I know you are scamming me

Waiting a few hours to see real mail being rejected in production. I won't wait long.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .