This came up back on August 9th 2020 in #lobsters on freenode. They were doing a system upgrade and providing a report by using `watch` to `cat` together a HTML header and footer with `mysql -e ‘select * from information_schema.processlist’` to provide a status report. Thought that was a neat hack.
Reading about HTTP Header Field Definitions.
I wanted to do something about the fact that I get a lot of spam where the date is substantially in the past, that is, months or years ago.
I figure I’ll never get any mail that I care about where the date is set that far back so what I wanted was a way to filter out such email.
There didn’t seem to be any suitable option in Thunderbird, and I’d rather have this done on the server than the client anyway, so I started fishing around for options in Postfix.
I found out about header checks.
To enable I had to add a file to the header_checks configuration option in /etc/postfix/main.cf:
header_checks = regexp:/etc/postfix/header_filter_map regexp:/etc/postfix/spamheadercheck
Then I created a header_filter_map file with some regexes for the date:
/^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 1\d\d\d/ DISCARD Date 1 /^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 200\d/ DISCARD Date 2 /^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 201[0-1]/ DISCARD Date 3 /^Date: .* Jan 2012/ DISCARD Date Jan /^Date: .* Feb 2011/ DISCARD Date Feb /^Date: .* Mar 2011/ DISCARD Date Mar /^Date: .* Apr 2011/ DISCARD Date Apr /^Date: .* May 2011/ DISCARD Date May /^Date: .* Jun 2011/ DISCARD Date Jun /^Date: .* Jul 2011/ DISCARD Date Jul /^Date: .* Aug 2011/ DISCARD Date Aug /^Date: .* Sep 2011/ DISCARD Date Sep /^Date: .* Oct 2011/ DISCARD Date Oct /^Date: .* Nov 2011/ DISCARD Date Nov /^Date: .* Dec 2011/ DISCARD Date Dec
I also found this file so I added some rules for the X-Mailer header, like this:
/^X-Mailer: 0001/ DISCARD Mailer 1 /^X-Mailer: Avalanche/ DISCARD Mailer 2 /^X-Mailer: Crescent Internet Tool/ DISCARD Mailer 3 /^X-Mailer: DiffondiCool/ DISCARD Mailer 4 /^X-Mailer: E-Mail Delivery Agent/ DISCARD Mailer 5 /^X-Mailer: Emailer Platinum/ DISCARD Mailer 6 /^X-Mailer: Entity/ DISCARD Mailer 7 /^X-Mailer: Extractor/ DISCARD Mailer 8 /^X-Mailer: Floodgate/ DISCARD Mailer 9 /^X-Mailer: GOTO Software Sarbacane/ DISCARD Mailer 10 /^X-Mailer: MailWorkz/ DISCARD Mailer 11 /^X-Mailer: MassE-Mail/ DISCARD Mailer 12 /^X-Mailer: MaxBulk.Mailer/ DISCARD Mailer 13 /^X-Mailer: News Breaker Pro/ DISCARD Mailer 14 /^X-Mailer: SmartMailer/ DISCARD Mailer 15 /^X-Mailer: StormPort/ DISCARD Mailer 16 /^X-Mailer: SuperMail-2/ DISCARD Mailer 17
Now that I know how to do this I’ll start adding rules for particular spam that I seem to get a lot of.
I’m not sure if I made the best decision, but I decided to silently discard email rather than reject it.
/^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 1/ REJECT /^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 200/ REJECT /^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 2010/ REJECT /^Date: .* [JFMASOND][aepuco][nbrynlgptvc] 2011/ REJECT /^Date: .* Jan 2012/ REJECT /^Date: .* Feb 2011/ REJECT /^Date: .* Mar 2011/ REJECT /^Date: .* Apr 2011/ REJECT /^Date: .* May 2011/ REJECT /^Date: .* Jun 2011/ REJECT /^Date: .* Jul 2011/ REJECT /^Date: .* Aug 2011/ REJECT /^Date: .* Sep 2011/ REJECT /^Date: .* Oct 2011/ REJECT /^Date: .* Nov 2011/ REJECT /^Date: .* Dec 2011/ REJECT
Which I applied in Postfix by adding the following line to /etc/postfix/main.cf:
header_checks = regexp:/etc/postfix/header_filter_map
It remains to be seen if what I’ve done will work, and at the moment this is a bit of a pain because I have to manually update the header_filter_map file every month, but the general idea is that if the regexp matches a date too far in the past then the message is rejected. Hopefully then those spammers who have messages turning up in my history will be gone.