Re: rejecting 'nested' from address ?

[Voytek]

On Sat, November 17, 2018 1:30 am, Wietse Venema wrote:

>> ...
>> smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated
>> ...
>>
>
> If first, then it will affect local, authorized, and remote clients.
>
>
> If last, then it will affect remote clients.

Wietse,

thanks again.

I guess I'll have it as first, to protect against stolen authorized IDs or
hacked website forms

V

Re: rejecting 'nested' from address ?

[Wietse Venema]

Voytek:
> On Sat, November 17, 2018 12:01 am, Wietse Venema wrote:
> 
> 
> thanks !
> 
> >> or where ? to reject/block ?
> >
> > /etc/postfix/sender_pcre:
> > /@.*@/   reject
> >
> >
> > /etc/postfix/main.cf:
> > smtpd_sender_restrictions = check_sender_access
> > pcre:/etc/postfix/sender_pcre
> 
> I currently have as so, add as 1st or last ?
> 
> ...
> smtpd_sender_restrictions =
>  permit_mynetworks,
>  permit_sasl_authenticated
> ...

If first, then it will affect local, authorized, and remote clients.

If last, then it will affect remote clients.

Wietse

Re: rejecting 'nested' from address ?

[Voytek]

On Sat, November 17, 2018 12:01 am, Wietse Venema wrote:


thanks !

>> or where ? to reject/block ?
>
> /etc/postfix/sender_pcre:
> /@.*@/   reject
>
>
> /etc/postfix/main.cf:
> smtpd_sender_restrictions = check_sender_access
> pcre:/etc/postfix/sender_pcre

I currently have as so, add as 1st or last ?

...
smtpd_sender_restrictions =
 permit_mynetworks,
 permit_sasl_authenticated
...


> Don't use this in header_checks.

Re: rejecting 'nested' from address ?

[Wietse Venema]

Voytek:
> a user started getting many spam/malware with like 'nested' from:
> 
> <"mick@cinkmedia.comgeranc"@gmail.com>
> 
> <"m...@cinkmedia.com.abc"@expertsmeetings.org>
> 
> I'm waiting for a full header from him, can anything be done in Postfix ?
> or where ? to reject/block ?

/etc/postfix/sender_pcre:
   /@.*@/   reject

/etc/postfix/main.cf:
   smtpd_sender_restrictions = 
check_sender_access pcre:/etc/postfix/sender_pcre

Don't use this in header_checks.

Wietse

rejecting 'nested' from address ?

[Voytek]

a user started getting many spam/malware with like 'nested' from:

<"mick@cinkmedia.comgeranc"@gmail.com>

<"m...@cinkmedia.com.abc"@expertsmeetings.org>

I'm waiting for a full header from him, can anything be done in Postfix ?
or where ? to reject/block ?

V