[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Researching spamblock/antivirus/attachment filters on mail servers

for procmail i use this two recipes:

* (^See the attached file for details)

* (^Please see the attached file for details)

maybe it would be better to use
* (^(Please see|See) the attached file for details)
but I didn't tried. It was easier and I didn't have time to experience.
${MAILDIR}.Virus/ could be changed to /dev/null but I like to see my every
email (including the infected mails).


----- Original Message ----- 
From: "Jarle Aase" <jgaa@jgaa.com>
To: <debian-isp@lists.debian.org>
Sent: Wednesday, September 03, 2003 1:45 AM
Subject: Researching spamblock/antivirus/attachment filters on mail servers

> When Sobig.F hit the local MTA, I started to look for a filter to block
> it. I looked at some common approaches, and my first impression was that
> the filters would be pretty easy to bypass. Which again means that lot's
> og MTA's may be vulnerable for the next attachment plague.
> In order to research this theory, I need access to email accounts[1] on
> mail-servers that has applied filters to block suspect attachment types
> like "*.pif". The findings will be published on my home-page (and
> possible on BUGTRAQ if I find anything serious), along with tools to
> verify if an MTA indeed stop masqueraded attachments, or stop valid
> emails in error.
> If you have a mail-server that is supposed to block such attachments,
> and are willing to help me in my research, please drop me a note. I'm
> looking for anything from simple perl scripts to commercial filters.
> Jarle
> [1] The email-accounts will only be used for this purpose.
> -- 
> Jarle Aase                      email: jgaa@jgaa.com
> Author of freeware.             http://www.jgaa.com
>                                 news:alt.comp.jgaa
> War FTP Daemon:     http://www.warftp.org
> War FTP Daemon FAQ: http://www.warftp.org/faq/warfaq.htm
> Jgaa's PGP key:     http://war.jgaa.com/pgp
> NB: If you reply to this message, please include all relevant
> information from the conversation in your reply. Thanks.
> <<< no need to argue - just kill'em all! >>>
> -- 
> To UNSUBSCRIBE, email to debian-isp-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact

Reply to: