0

This question continues from this identical but focuses on another aspect of detail: the Postfix testing tool and the different options.

As the OP of the linked question, to prevent spam, and specifically, compromised password extortions, I have tried to block mail that contains my pwned old password as a means of chaffing.

Supposed the hacked password was... P@ssw0rd, here is what I have done:

I have created a regex rule in /etc/postfix/header_checks

/^Subject: .*P@ssw0rd.*/i REJECT I know you are scamming me

Then re-checked main.cf

header_checks = regexp:/etc/postfix/header_checks

According to the answers to the linked question, I double checked the master.cf for options that override the header checks. Since I use dkimproxy, which runs after smtp but before delivery, I had the no_header_checks option only on the dkim completion listener (port 10028 as recommended by manuals). I also tried to comment.

Now the test. If I pick an extortion email displaying my P@ssw0rd and push it to postconf I get different results. Please note the regex is flagged case insensitive

# postmap -q "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks
# postmap -fq "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks
DISCARD I know you are scamming me

The above example also worked with the magic blue pill

So I am stuck with this. I have read the answer by Alexis Wilke and learned that Postfix by default uses case insensitive comparison. Wow, I don't care about the case, I specified /i flag.

And regexpal successfully finds the subject line when I put the headers into it.

Question: what is not working here?

0

As with speaking with a rubber duck, I found the solution myself while investigating and writing the question.

Removing the /i (case insensitive) flag from the header_checks file worked like a charm

Regex becomes /^Subject: .*P@ssw0rd.*/ REJECT I know you are scamming me

Waiting a few hours to see real mail being rejected in production. I won't wait long.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.