From 10353fd0f09ce17397aa9bfdced6155498817f62 Mon Sep 17 00:00:00 2001
From: Jonas Smedegaard <dr@jones.dk>
Date: Tue, 23 Jan 2007 18:57:13 +0000
Subject: Add postfix bad-word exclusion.

---
 logcheck/cracking.ignore.d/local-postfix | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 logcheck/cracking.ignore.d/local-postfix

(limited to 'logcheck')

diff --git a/logcheck/cracking.ignore.d/local-postfix b/logcheck/cracking.ignore.d/local-postfix
new file mode 100644
index 0000000..6419b51
--- /dev/null
+++ b/logcheck/cracking.ignore.d/local-postfix
@@ -0,0 +1,4 @@
+# Suspiciously worded hostname or email address is not a security thread
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/[[:alnum:]]+\[[0-9]+\]: ([[:xdigit:]]+|NOQUEUE): ([^[:space:]]+=[^[:space:]]+, )*(from|helo|message-id|to)=<[^>]*(attack|nested)[^>]*>.*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/[[:alnum:]]+\[[0-9]+\]: warning: no MX host for [^[:space:]]*(attack|nested)[^[:space:]]* has a valid A record$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp+\[[0-9]+\]: connect to [^[:space:]]*(attack|nested)[^[:space:]]*:.*$
-- 
cgit v1.2.3