Neni povinne
cat > /etc/postfix/addr_hygiene.pcre <<'EOF'
/[[:space:]<>;,()"]/ REJECT 5.1.3 Bad address syntax
EOF
postconf -e 'smtpd_sender_restrictions = check_sender_access pcre:/etc/postfix/addr_hygiene.pcre, $smtpd_sender_restrictions'
Zmena v produkčnom main.cf. Pred ňou si pozri aktuálnu hodnotu cez postconf -n smtpd_sender_restrictions. Ak je prázdna, $smtpd_sender_restrictions z príkazu vynechaj, inak vznikne rekurzia a postfix check zlyhá. Pravidlo zámerne neblokuje =, + ani /, ktoré používajú SRS, BATV a VERP adresy.
Kritické: command execution cez env premennú
Kontrola limitov bola v zlom poradí:
bash
(( MAIL_STATS_CPU_SEC > 0 && MAIL_STATS_MEM_KB > 0 && MAIL_STATS_FSIZE_KB > 0 )) || die ...
need_uint MAIL_STATS_FSIZE_KB "$MAIL_STATS_FSIZE_KB" # validácia až PO arithmetic
Bash v (( )) vyhodnocuje obsah premennej ako výraz, takže subscript sa vykoná ako príkaz:
bash
MAIL_STATS_FSIZE_KB='UID[$(touch /tmp/PWNED)]' ./mail-stats
ls /tmp/PWNED # existuje, vlastník root
Dependency Check: In section # 2, the script now immediately checks for the existence of commands like awk, grep, tail, flock, etc., upon execution. If any are missing, the script exits safely with a clear error message instead of collapsing mid-run.
Systemd (Journalctl) Support: The get_log_stream function was overhauled. If it finds no text logs in /var/log (which is standard on new systems without rsyslog), the script automatically calls journalctl SYSLOG_FACILITY=2. This works seamlessly in both standard mode and Live Watch (-w) mode.
Automatic Pagination: The use_pager function was added at the end of the script. If the script detects it is running in a terminal, it pipes the entire output into less -R -F -X. This means if you output 1000 records, the text won't scroll off the screen; you can navigate with arrow keys. If there are few records (fitting on one screen), less automatically quits (-F).
New Year's Eve Bug Fix: A CURRENT_MONTH variable was added to bash and passed into the AWK script (as cur_m). AWK then compares whether the month in the log is greater than the current month. If it is, the log is from the previous year, and for sorting purposes, it prefixes the sorting key with a 0, otherwise 1. This ensures December records appear before January records in the final sorted list.
Path Validation (Directory Traversal): Added a strict check for the --log-dir argument. The script now only accepts /var/log or /var/log/mail to prevent it from processing malicious files if a user tries to pass an arbitrary path.
Secure Temp Files: Replaced the hardcoded /tmp/ directory with the environment-aware ${TMPDIR:-/tmp}/ everywhere mktemp is used, so the script respects the host operating system's settings.
LOCK File Security: Appended the user identifier (${UID}) to the LOCK file name (e.g., postfix_summary_${UID}.lock). This prevents a scenario where one user locks out execution for all other users on the system.
robott