[Logcheck-devel] Bug#437752: logcheck-database: ignore rules for postfix's reject_unknown_sender_domain

[Frédéric Brière]

Package: logcheck-database
Version: 1.2.54
Severity: wishlist

Enabling reject_unknown_sender_domain allows one to filter out some of
the crap that spammers send, but it often generates one or two warnings.
Here are some ignore rules to weed those out:

  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning: numeric hostname: [0-9.]{7,15}$
  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning: valid_hostname: empty hostname$
  ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ postfix/smtpd\[[[:digit:]]+\]: warning: malformed domain name in resource data of MX record for [._[:alnum:]-]+:.*$


The first warning is issued when the MAIL FROM domain reverse-resolves
to an all-numeric hostname (like 84.16.227.85 at the moment), while the
other two are issued together when the MAIL FROM domain has an MX record
with garbage in it (usually ".").


-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.21-2-k7 (SMP w/1 CPU core)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash