[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Virus Checking - COMPLETELY UNENCUMBERED!



On Tue, May 14, 2002 at 08:48:51PM +1000, Martijn van Oosterhout wrote:
> > Frankly, it would be good if someone would add to the useful procmail
> > recipes a filter to remove any executable attachments from an email
> > outright or mark them as spam or delete them or something.  NOBODY should
> > be emailing an executable.  A zip maybe, an image okay.  An executable,
> > particularly a win32 executable is almost guaranteed to be a virus.
> 
> There is a filter available for exim which, when installed, will simply
> bounce any emails with attachments with dodgy looking extensions. It even
> gives a helpful message about putting it in a zip file instead.

Very cool.  (But I'll need to apply magic to it I think, as I use postfix
myself - but most of Debian uses exim by default so this is perfect!)


> It also kills those Seven Dwarves emails. It certainly cut the crap
> around here.
> 
> ftp://ftp.exim.org/pub/filter/system_filter.exim
> 
> After that you need to check the viruses in documents and stuff. If clamav
> can do that, we're all set to roll out push-of-a-button virus-filter debian
> machines :).

Yeah, I'd like to see this specifically (along with a brief set of idiot
instructions for installing it) in README.Debian for exim, if it's not
already there.  (Maintainer Cc'd..)

I'll have to see if I can turn some of it into procmail or some filter I
can apply to postfix, and I'll be sure to let everyone know (especially
postfix maintainer, upstream and the procmail-lib maintainer) what I come
up with when I come up with something, as appropriate.

I must compliment exim for its filter syntax, very simple and very
effective.  I prefer postfix which is IMO a little nicer in the config
file department, and you can't beat the postfix debconf config, but
postfix does not have anything as nice as exim's filters for user mail
filtering - you generally rely on procmail or mailagent which are both
powerful but difficult to use for newbies.

-- 
Joseph Carter <knghtbrd@bluecherry.net>              glDisable (DX8_CRAP);
 
Now I can finally explain to everyone why I do this.  I just got $7 worth
of free stuff for working on Debian !

Attachment: pgptOPeljEhYb.pgp
Description: PGP signature


Reply to: