Vineet Kumar <mailto:[EMAIL PROTECTED]> schreef op zaterdag 27 september 2003 18:47:
> * Willem-Jan Meijer ([EMAIL PROTECTED]) [030927 > 06:54]: >> My antivirus is working well, but all those MS mails are very >> annoying Better delete before seeing it :) > > Consider, at least temporarily, blocking anything with an exe > attachment at smtp time. I started this a few days ago on my mail > server (after clearing it with all of my users first, of course -- > I'm not _that_ much of a BOFH) and it's been great. > > I'm using exim4. Andreas Metzler's packages (the stable backports) > include exiscan-acl. I wonder how I ever lived without it! Now I've > got a multi-tiered approach. Black- and white-lists, block all > exe:vbs:scr:... attachments, and everything else goes through clamav. > All at smtp time. So far, this has reduced the annoyance to the > misplaced bounces; we haven't seen any of the actual virus here at > all. (My rejectlog is getting large, though ;) > > I did think (and still do think) that filename-based-blocking is > pretty lame, but recently it's been saving my clamscan from GiB of > traffic. All of my users said that they don't expect any attachments > of those extensions anyway, and have expressed relief at being able > to use their email again. I'll probably lift the > filename-based-block once the noise dies down (if it ever does ... > let's see a show of hands of those who still get nimda nad code red > in their error_logs!) and just leave it up to clam -- which by the > way, was recognizing the virus as Gibe.F from the first day, as quick > as the "big boys". Kudos to the clam team and community! > > good times, > Vineet > -- > http://www.doorstop.net/ I'm a noob with mail server - i started for about 3 weeks ago with it I don't understand the configuration and implementation of it. I'm a student with tons of things to do at this moment. The only thing I want is a simple mail filter that just picks the ms mail bomb out of it. the amount of spam is very low except this one. Can someone give me a howto for this version of spamassassin to do the trick? HTH, -WJ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
