3

When sending mail through PHP mail() - Postfix adds the following header:

Received: by myhost.mydomain.com (Postfix, from userid 48)
    id XXXXXXXXXXX; Sun, 20 Nov 2011 21:22:13 +0100 (CET)

Is there a way to remove the userid part, but keep the rest? So the result becomes (if correct):

Received: by myhost.mydomain.com (Postfix)
    id XXXXXXXXXXX; Sun, 20 Nov 2011 21:22:13 +0100 (CET)

Postfix is running on localhost and is only used to send mail from PHP through the mail() function.

A simular question regarding removing the whole header has been asked before, but I can't figure out how to remove the userid part, but keep the rest.

Community
  • 1
elaxsj
  • 141
  • 1
  • 3

3 Answers3

4

You shall not edit the received lines in any case.

Mainly they are required by RFC 5321 and are not allowed to manipulate. Secondly they are a valuable source for tracking abuse.

Assume you only send mails with PHP via Apache (userid 48), what does it tell you if you see messages coming from userid 5000? You are right: A malicious user or script is running mad. Are you able to track this problem with userid removed?

mailq
  • 16,882
  • 2
  • 36
  • 66
  • 1
    Good points. However, I think the header exposes too much of the web server setup. I ended up with the following, wich only hides the userid when the Apache user is sending: `/^Received: by (.+) \(Postfix, from userid 48\)(.+)$/ REPLACE Received: by $1 (Postfix)$2` (maybe I should change 48 to e.g. 550 instead, to not mess with the header construct) – elaxsj Nov 22 '11 at 15:20
3

I think you can try something like:

/etc/postfix/main.cf

header_checks = pcre:/etc/postfix/header_checks.pcre

/etc/postfix/header_checks.pcre

/^Received: by(.*) \(Postfix, from userid(.*)$/ REPLACE Received: by ${1}
Chris
  • 3
  • 3
unlo
  • 454
  • 3
  • 8
1

Now you can change only first line. My solution is with regexp

/etc/postfix/main.cf

header_checks = regexp:/etc/postfix/header_checks

/etc/postfix/header_checks

/^Received: by (.*) .*Postfix, from userid [0-9]+\)\s*id ([A-F[:digit:]]+)(.*) (.*)/ REPLACE Received: by $1 (some text) id $2$3 (EEST)

You can check rezult (http://rubular.com/r/JH14xFTWL9)

or

postmap -q "Received: by mail.xxxx.lt (Postfix, from userid 48) id 5F7CD1E148A Thu, 23 Oct 2014 15:55:08 +0300 (EEST)" regexp:/etc/postfix/header_checks
Mantas
  • 11
  • 2