2 conditions in the rule and empty Sender

[Antony Stone]

On Thursday 01 November 2018 at 14:46:53, Shawn Iverson via MailScanner wrote:

> Notifications from mailer daemons are sent with a null return path
> address.  You should not send a notification back in this scenario.

Is the OP trying to do that?  I thought not.

I thought the objective was to ensure that the notifications with the attached 
viruses were not re-scanned, but delivered to postmaster as-is.


Antony.

> This is a common spam vector as well, because spammers will hope you will
> let the "notification" through since it does have a null return path.
> 
> This is by design and avoids creating a mail loop, see RFC 1123, section
> 5.3.3.
> 
> 
> 
> On Thu, Nov 1, 2018 at 9:40 AM Nerijus Baliunas wrote:
> > I added the rule:
> > From:   127.0.0.1 and From: MAILER-DAEMON at mail.example.com       no
> > 
> > It did not help.
> > 
> > On Thu, 1 Nov 2018 12:55:16 +0100 Antony Stone wrote:
> > > On Thursday 01 November 2018 at 12:42:50, Nerijus Baliunas wrote:
> > > > I will paste the full message here:
> > > The first thing that strikes me is that the original message does not
> > > have "From: postmaster at example.com" - it is addressed to postmaster, but
> > > the From address is MAILER-DAEMON at mail.example.com
> > > 
> > > Try putting that into your virus_scanning.rules and see if things get
> > > delivered as required.
> > > 
> > > > The following e-mails were found to have: Virus Detected
> > > > 
> > > >     Sender:
> > > > IP Address: 127.0.0.1
> > > > 
> > > >  Recipient: postmaster
> > > >  
> > > >    Subject: Mail delivery failed: returning message to sender
> > > >  
> > > >  MessageID: 58A002A14067.AE6A8
> > > > 
> > > > Quarantine:
> > /var/spool/MailScanner/quarantine/20181101/58A002A14067.AE6A8
> > 
> > > >     Report: Clamd:  message was infected:
> > > > winnow.spam.ts.xmailer.2.UNOFFICIAL
> > > > 
> > > > Full headers are:
> > > >  Received: from mail.example.com (mail.example.com [127.0.0.1])
> > > >  
> > > >     by mail.example.com (Postfix) with SMTP id 58A002A14067
> > > >     for <postmaster>; Thu,  1 Nov 2018 02:02:01 +0200 (EET)
> > > >  
> > > >  Subject: Mail delivery failed: returning message to sender
> > > >  From: Mail Delivery System <MAILER-DAEMON at mail.example.com>
> > > >  To: postmaster at mail.example.com
> > > >  MIME-Version: 1.0
> > > >  Content-Type: multipart/report; report-type=delivery-status;
> > > >  
> > > >     boundary="foo-mani-padme-hum-32284-1-1541030521"
> > > >  
> > > >  Message-Id: <20181101000201.58A002A14067 at mail.example.com>
> > > >  Date: Thu,  1 Nov 2018 02:02:01 +0200 (EET)
> > > > 
> > > > On Thu, 1 Nov 2018 13:38:16 +0200 Nerijus Baliunas wrote:
> > > > > Hello,
> > > > > 
> > > > > I have Virus Scanning = %rules-dir%/virus_scanning.rules
> > > > > and in virus_scanning.rules:
> > > > > From:   127.0.0.1 and From: postmaster at example.com       no
> > > > > 
> > > > > Today I got an email:
> > > > > 
> > > > > The following e-mails were found to have: Virus Detected
> > > > > 
> > > > >     Sender:
> > > > > IP Address: 127.0.0.1
> > > > > 
> > > > >  Recipient: postmaster
> > > > >  
> > > > >    Subject: Mail delivery failed: returning message to sender
> > > > >  
> > > > >  MessageID: 58A002A14067.AE6A8
> > > > > 
> > > > > Quarantine:
> > /var/spool/MailScanner/quarantine/20181101/58A002A14067.AE6A8
> > 
> > > > >     Report: Clamd:  message was infected:
> > > > >     winnow.spam.ts.xmailer.2.UNOFFICIAL
> > > > > 
> > > > > How to allow such messages to be received? There is no Sender
> > > > > (Return-path:), how to adapt "From:   127.0.0.1 and From:
> > > > > postmaster at example.com       no" to also work with no From?

-- 
Perfection in design is achieved not when there is nothing left to add, but 
rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

                                                   Please reply to the list;
                                                         please *don't* CC me.