Postfix on BSD

[Bart Silverstrim]

On Jun 16, 2005, at 12:00 PM, Ean Kingston wrote:

> On June 16, 2005 11:54 am, Bart Silverstrim wrote:
>> Probably off-topic, but it's a sysadmin question that maybe someone on
>> the list could send a quick blurb answer about :-/
>>
>> I'm trying to filter some mail coming into Postfix based on the body
>> content.  I have the line
>>
>> body_checks = regexp:/usr/local/etc/postfix/body_checks
>>
>> in main.cf.  The file contains:
>> ********
>> # Will this stop RR collateral damage messages?
>> /^* This e-mail was sent from a Road Runner IP address. As part of our
>> continuing initiative to stop the spread of malicious viruses, Road
>> Runner scans all outbound e-mail attachments./       REJECT Possible
>> automated RoadRunner mail scanning collateral damage. Eliminate the
>> notifying text and resend message.
>>
>> # Borrowed check lines
>> /^This e-mail, in its original form, contained one or more attached
>> files that were infected with a virus, worm,/ REJECT Email reporting
>> virus detected
>> /^This e-mail in its original form contained one or more attached 
>> files
>> that were infected with the / REJECT Email reporting virus detected
>> **********
>>
>> The files are owned root, wheel with rwrr, so it should be readable by
>> the postfix processes.  I do a "postfix reload", send an email from 
>> the
>> Internet to this mail server containing the key phrase(s), and they
>> seem to go right through!  Am I missing something?
>
> Yes you are missing something. Postfix does not do multi-line 
> expression
> matching.

Maybe I'm misunderstanding you, but the lines wrapped in the email and 
are one line each in the actual configuration file.

Also the asterisk in "/^* This e-mail was sent from a Road Runner IP 
address." has been removed now...a warning was appearing in the 
maillog.  No longer gives warning, but still lets the m ail through.

Postconf shows that the value for body_check is pointing at the correct 
file...