Postfix header_checks não está funcionando

Question

Eu simplesmente não consigo descobrir por que os header_checks não estão sendo avaliados.

Eu adiciono a seguinte linha ao /etc/postfix/main.cf:

header_checks = pcre:/etc/postfix/header_checks.pcre

E aqui está o header_checks.pcre:

/^From: [email protected]/  REDIRECT [email protected]

Para testar, tentei:

postmap -q "From: [email protected]" pcre:/etc/postfix/header_checks.pcre

que avalia corretamente e me retorna a saída de:

REDIRECT [email protected]

Mas quando recebo um email de [email protected] isso não funciona. Meu maillog mostra:

Nov 26 07:30:11 smtp postfix/smtpd[18733]: connect from gatekeeper.pressclip.si[213.161.20.180]
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp postfix/smtpd[18733]: 0F1862111E: client=gatekeeper.pressclip.si[213.161.20.180]
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp sqlgrey: grey: domain awl match: updating 213.161.20(213.161.20.180), pressclip.si
Nov 26 07:30:19 smtp postfix/cleanup[18828]: 0F1862111E: message-id=<[email protected]>
Nov 26 07:30:21 smtp postfix/qmgr[14986]: 0F1862111E: from=<[email protected]>, size=4125270, nrcpt=12 (queue active)
Nov 26 07:30:21 smtp postfix/smtpd[18733]: disconnect from gatekeeper.pressclip.si[213.161.20.180]
Nov 26 07:30:21 smtp postfix/cleanup[18827]: 09F6A212AB: message-id=<[email protected]>
Nov 26 07:30:21 smtp postfix/qmgr[14986]: 09F6A212AB: from=<[email protected]>, size=4125593, nrcpt=12 (queue active)

Postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
anvil_rate_time_unit = 600s
body_checks = regexp:/etc/postfix/body_checks
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp:[127.0.0.1]:2526
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
header_checks = pcre:/etc/postfix/header_checks.pcre
html_directory = no
inet_interfaces = all
inet_protocols = ipv4
luser_relay = [email protected]
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 30971520
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = ztm.si
myhostname = ip04.ztm.si
mynetworks = 193.2.210.0/24, 92.244.66.224/28, 127.0.0.0/8, 89.212.169.201/32, 10.0.0.0/8 172.31.255.0/24
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
relay_domains = $mydestination
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_starttls_timeout = 100s
smtp_tls_loglevel = 3
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 300
smtpd_client_message_rate_limit = 300
smtpd_client_recipient_rate_limit = 300
smtpd_recipient_restrictions = permit_mynetworks                reject_unauth_destination                check_policy_service inet:127.0.0.1:2501
smtpd_starttls_timeout = 100s
smtpd_tls_CAfile = /etc/postfix/DigiCertCA.crt
smtpd_tls_cert_file = /etc/postfix/smtp_ztm_si.crt
smtpd_tls_key_file = /etc/postfix/smtp.key
smtpd_tls_loglevel = 3
smtpd_tls_security_level = may
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual_alias_map

Master.cf

smtp      inet  n       -       n       -       -       smtpd
submission inet n       -       n       -       -       smtpd
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_security_options=noanonymous
  -o broken_sasl_auth_clients=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o smtpd_tls_key_file=/etc/postfix/smtp.key
  -o smtpd_tls_cert_file=/etc/postfix/smtp_ztm_si.crt
  -o smtpd_tls_CAfile=/etc/postfix/DigiCertCA.crt
  -o content_filter=
  -o smtpd_use_tls=yes
#  -o smtpd_enforce_tls=yes
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sasl_security_options=noanonymous
  -o broken_sasl_auth_clients=yes
  -o smtpd_etrn_restrictions=reject
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o smtpd_tls_key_file=/etc/postfix/smtp.key
  -o smtpd_tls_cert_file=/etc/postfix/smtp_ztm_si.crt
  -o smtpd_tls_CAfile=/etc/postfix/DigiCertCA.crt
  -o smtpd_use_tls=yes
  -o smtpd_enforce_tls=yes
  -o content_filter=
#  -o content_filter=smtp:localhost:2525
#submission inet n       -       n       -       -       smtpd
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       n       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628      inet  n       -       n       -       -       qmqpd
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       n       -       -       smtp
        -o smtp_fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

smtp-esets unix -       -       n       -       6  lmtp
    -o lmtp_data_done_timeout=1200
    -o lmtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20

localhost:2525 inet  n - n - - smtpd
  -o content_filter=
  -o myhostname=esets.ztm.si
  -o local_recipient_maps=
  -o relay_recipient_maps=
  -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
  -o smtpd_helo_restrictions=
  -o smtpd_client_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o mynetworks=127.0.0.0/8

Alguma ideia? Obrigado!

    

Answer 1

Um problema pode ser que exista um receive_override_options=no_header_body_checks em algum lugar em main.cf ou master.cf que está desativando as verificações de cabeçalho. No arquivo master.cf , seria uma opção -o em uma das entradas de configuração de serviço.

Existem 4 opções para receive_override_options :

• no_unknown_recipient_checks Do not try to reject unknown recipients (SMTP server only). This is typically specified AFTER an external content filter.
• no_address_mappings Disable canonical address mapping, virtual alias map expansion, address masquerading, and automatic BCC (blind carbon-copy) recipients. This is typically specified BEFORE an external content filter.
• no_header_body_checks Disable header/body_checks. This is typically specified AFTER an external content filter.
• no_milters Disable Milter (mail filter) applications. This is typically specified AFTER an external content filter.

As opções no_address_mappings normalmente estarão localizadas em main.cf , enquanto as outras opções, em master.cf

The "-o receive_override_options" overrides main.cf settings to avoid duplicating work that was already done before the content filter. These options are complementary to the options that are specified in main.cf

Fonte: Filtro de conteúdo pós-fila do postfix

    

Answer 2

Como @HZC diz que pode ser um problema -o receive_override_options . Eu tive o mesmo problema aqui: Meu problema e solucionou-o após a postagem postfix header_checks usando regexp a configuração apropriada . Meu caso foi um REJECT ao invés de DISCAR . Você usa o DISCARD no caso de você querer enganar o spammer, o spammer não receberá nenhuma notificação. Para obter mais informações sobre isso, acesse este link e veja a seção REJECTS ACTIONS .

Estrutura de DISCARD:

              DISCARD optional text...
              Claim successful delivery and silently discard the message.  Log
              the optional text if specified, otherwise log a generic message.