Header_check

[Rick Cooper]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Pete
> Sent: Thursday, April 22, 2004 11:20 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Header_check
>
>
> Below is the log entry from when i release a quarantined messages vua
> mailwatch. Some one gave me the tip on usig a different header_check
> which let mail from the local machine through - but for some one reason
> it has stopped working - i cant understand it longer works? Why dont
> this header_check allow mail from the local machine be delivered without
> being "Held" ?
>
> /^Received:(.*)by localhost\.domain1\.com\.au \(Postfix\)/      HOLD
>
> Apr 23 14:09:58 mail01 postfix/cleanup[17196]: 454581E03: hold: header
> Received: from localhost (localhost [127.0.0.1])??by
> mail01.domain1.com.au (Postfix) with ESMTP id 454581E03??for

Well that RE would miss because of "by mail01.domain1.com.au" is not by
localhost.domain1.com.au"

/^Recieved:.+by mail01\.domain1\.com\.au \(Postfix\)/

should work.. unless you need the capture from (.*) for some reason?

> <prussell at domain1.com.au>; Fri, 23 Apr 2004 14:09:58 +1000 (EST) from
> localhost[127.0.0.1]; from=<postmaster at localhost.mteliza.com.au>
> to=<prussell at domain1.com.au> proto=ESMTP helo=<localhost>
> Apr 23 14:09:58 mail01 postfix/cleanup[17196]: 454581E03:
> message-id=<20040423040958.454581E03 at mail01.domain1.com.au>
> Apr 23 14:09:58 mail01 postfix/smtpd[17194]: disconnect from
> localhost[127.0.0.1]
> Apr 23 14:09:58 mail01 MailScanner[16091]: New Batch: Scanning 1
> messages, 78484 bytes
> Apr 23 14:09:58 mail01 MailScanner[16091]: Spam Checks: Starting
> Apr 23 14:09:58 mail01 MailScanner[16091]: Virus and Content Scanning:
> Starting
> Apr 23 14:09:59 mail01 MailScanner[16091]: Content Checks: Detected
> HTML-specific exploits in 454581E03
> Apr 23 14:09:59 mail01 MailScanner[16091]: Content Checks: Found
> 1 problems
> Apr 23 14:09:59 mail01 MailScanner[16091]: Saved entire message to
> /var/spool/MailScanner/quarantine/20040423/454581E03
> Apr 23 14:09:59 mail01 MailScanner[16091]: Saved infected
> "msg-81419-56.html" to
> /var/spool/MailScanner/quarantine/20040423/454581E03
> Apr 23 14:09:59 mail01 MailScanner[16091]: Requeue: 454581E03 to 4C9401E07
> Apr 23 14:09:59 mail01 MailScanner[16091]: Cleaned: Delivered 1 cleaned
> messages
> Apr 23 14:09:59 mail01 postfix/qmgr[17188]: 4C9401E07:
> from=<postmaster at localhost.domain1.com.au>, size=62237, nrcpt=1 (queue
> active)
> Apr 23 14:09:59 mail01 postfix/smtp[17205]: 4C9401E07:
> to=<prussell at domain1.com.au>, relay=203.55.54.20[203.55.54.20], delay=1,
> status=sent (250 Message accepted for delivery)
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> For further info about MailScanner, please see the Most Asked
> Questions at    http://www.mailscanner.biz/maq/     and the archives
> at    http://www.jiscmail.ac.uk/lists/mailscanner.html
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>
>

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html