forum.lissyara.su

Код: Выделить всё

# Exim filter

## -----------------------------------------------------------------------
# Only run any of this stuff on the first pass through the
# filter - this is an optomisation for messages that get
# queued and have several delivery attempts
#
# we express this in reverse so we can just bail out
# on inappropriate messages
#

## -----------------------------------------------------------------------
# Error message will not be delivered

if error_message then finish endif 


if not first_delivery
then
  finish
endif



if $h_X-Spam_Flag: matches "^YES|Yes"
then
    save /var/spool/spam/$message_id:
endif



if $header_message-id matches "<[^>]+@>"
then
    logfile /var/log/exim/nullmesgidbouncedemail.log 0600
    logwrite "$tod_log $message_id envelope: $sender_address, From: $h_from ($sender_host_name[$sender_host_address]) => $recipients (recipients=$recipients_count)  subject=$header_subject\n$message_headers"
    save /var/spool/spam/$message_id: 
      
    if not error_message
    then
	fail text "Sorry, but your message-ID is broken, apparently because your\n\
                   hostname isn't set right\n\
		   You need to fix this before you can send us mail.\n"
    endif
					  
    seen finish
endif
					    

if $header_to: contains boss@mydomain.ru
then
seen finish
endif


if
$message_body contains "viagra" or $message_body contains "pennis"  or $message_body contains "Vliragra" or $message_body contains "penis" or $message_body contains "drugs"
then
logfile /var/log/exim/filter.log 0600
logwrite "$tod_log $message_id processed from $sender_address"
seen finish
endif

## -----------------------------------------------------------------------
# Spam assign
if ${length_80:$header_date:} is not $header_date:
then
  fail text "This message has been rejected because it has\n\
	     an overlength date field which can be used\n\
	     to subvert Microsoft mail programs\n\
             The following email has further information\n\
	     postmaster@mydomain.ru"
  seen finish
endif

## -----------------------------------------------------------------------
# Look for single part MIME messages with suspicious name extensions
# Check Content-Type header using quoted filename [content_type_quoted_fn_match]
if $header_content-type: matches "(?:file)?name=(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|hta|in[fs]|isp|jse?|lnk|ms[cipt]|pcd|pif|PIF|reg|scr|sct|shs|exe|ttt|url|vb[se]|ws[fhc])\")"
then
#  fail text "This message has been rejected because it has\n\
#	     potentially executable content $1\n\
#	     This form of attachment has been used by\n\
#             recent viruses or other malware.\n\
#	     If you meant to send this file then please\n\
#	     package it up as a zip file and resend it."
  seen finish
endif

## -----------------------------------------------------------------------
# same again using unquoted filename [content_type_unquoted_fn_match]
if $header_content-type: matches "(?:file)?name=(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|hta|in[fs]|isp|jse?|lnk|ms[cipt]|pcd|pif|PIF|reg|scr|exe|ttt|sct|shs|url|vb[se]|ws[fhc]))"
then
# fail text "This message has been rejected because it has\n\
#	     potentially executable content $1\n\
#	     This form of attachment has been used by\n\
#             recent viruses or other malware.\n\
#	     If you meant to send this file then please\n\
#	     package it up as a zip file and resend it.."
  seen finish
endif

## -----------------------------------------------------------------------
# Attempt to catch embedded VBS attachments
# in emails.   These were used as the basis for 
# the ILOVEYOU virus and its variants - many many varients
# Quoted filename - [body_quoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?>\\\\s*)attachment);(?>\\\\s*)(?:file)?name=|begin(?>\\\\s+)[0-7]{3,4}(?>\\\\s+))(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|ttt|sct|shs|url|vb[se]|ws[fhc])\")[\\\\s;]"
then
#  fail text "This message has been rejected because it has\n\
#     a potentially executable attachment $1\n\
#     This form of attachment has been used by\n\
#     recent viruses or other malware.\n\
#     If you meant to send this file then please\n\
#     package it up as a zip file and resend it..."
  seen finish
endif

## -----------------------------------------------------------------------
# same again using unquoted filename [body_unquoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?>\\\\s*)attachment);(?>\\\\s*)(?:file)?name=|begin(?>\\\\s+)[0-7]{3,4}(?>\\\\s+))(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|ttt|sct|shs|url|vb[se]|ws[fhc]))[\\\\s;]"
then
# fail text "This message has been rejected because it has\n\
#     a potentially executable attachment $1\n\
#     This form of attachment has been used by\n\
#     recent viruses or other malware.\n\
#     If you meant to send this file then please\n\
#     package it up as a zip file and resend it...."
 seen finish
endif

## -----------------------------------------------------------------------
# Error messages
if $header_to: matches "^( )"
then seen finish
endif

## -----------------------------------------------------------------------
if $header_to: contains ""
then seen finish
endif

## -----------------------------------------------------------------------
if $header_to: contains "\"<>\""
then seen finish
endif

## -----------------------------------------------------------------------
if $header_to: contains "\"<>\"@mydomain.ru"
then seen finish
endif

## -----------------------------------------------------------------------
if $header_to: contains "\"\"@mydomain.ru"
then seen finish
endif

## -----------------------------------------------------------------------
if $header_from: contains "\"<>\"@mydomain.ru"
then seen finish
endif

## -----------------------------------------------------------------------
if $header_from: contains "\"<>\""
then seen finish
endif

Код: Выделить всё

add_header = X-Spam-Subject: ***SPAM*** $h_subject

Код: Выделить всё

message = Subject: ***SPAM*** $h_Subject: