On 27.04.20 13:27, Juan Manuel P wrote:
Hello Witse do you mean to use HOLD action on header_checks ?
like this ?
/^Subject:.*hacked*/ HOLD
And that whats suppose to do ?
if Wietse's message wasn't enough for you, I recommend looking at
http://www.postfix.org/header_checks.5.html
It is holded the email on the queue ? and I can check with mailq command ?
and later detele from queue and email me a alert
Sorry for ask and not try, because we have only enviroment on producction
and dont make a misstake on the service.
El lun., 27 abr. 2020 a las 12:59, Wietse Venema (<wie...@porcupine.org>)
escribió:
jmpatagonia:
> Hello I need help to using header_checks, I create a rule
>
> /^Subject:.*hacked*/ DISCARD
An alternative is to use HOLD action, assuming you aren't using
software that hijacks the HOLD feature for other purposes, such as
mailscanner. Then you can review the email with "postcat -q" and
delete it with "postsuper -d".
> that work propertly, but a want to know it is posible to email me o to
alert
> me when this rule occur or is aplicated. For some way. Oviusly I see
that on
> the mail.log
A logfile scanner such as fail2ban could do that for you. Ideally
there is a rate limit so that you won't be email bombed.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Your mouse has moved. Windows NT will now restart for changes to take
to take effect. [OK]
