Hi,
After receiving hundreds megabytes of SirCam viruses from
[EMAIL PROTECTED], I decided to block him by procmail. My procmail is
active, and working for other purposes.
I added the following entry to the appropriate ".procmailrc" file:
:0
* ^From.*[EMAIL PROTECTED]
{
| echo > /dev/null
:0: /tmp/null
}
(I know that something is wrong, and I know that I duplicated the
nullification of the message, because it didn't work without it too).
As expected, it didn't help; about 100 new messages, of 0.5MB each,
reached the mail server this night.
Where was I wrong?
P.S. Please don't suggest the usual SirCam filter; It doesn't help
against messages that their attachment is a file with a Hebrew file
name. If, however, there is a solution for Hebrew filenames too, I'll
be glad to see it, but in any case, I want to learn where I was wrong
with the procmail.
P.P.S. The viruses are filtered out also in the level of the browsers
/ mailers, however I must have the filtering also in the sendmail
level, to save disk space. By the way: Meanwhile, I blocked the
sender mail server (62.0.12.20) by the access list of the router...
Thanks,
--
Eli Marmor
[EMAIL PROTECTED]
CTO, Founder
Netmask (El-Mar) Internet Technologies Ltd.
__________________________________________________________
Tel.: +972-9-766-1020 8 Yad-Harutzim St.
Fax.: +972-9-766-1314 P.O.B. 7004
Mobile: +972-50-23-7338 Kfar-Saba 44641, Israel
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
