[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: MS mail bombs



On Wed, Sep 24, 2003 at 11:48:43AM +0100, Clive Menzies wrote:
> On (24/09/03 04:22), Pigeon wrote:
> > I've just found getting mailfilter up on woody to be a suitable
> > means of passing the time while microwaving pizzas. It's dead easy:
> I think my pizza would be crisped by now ;) but thanks for this.
> Coincidentally, I was trying to confilgure mailfilter last night to
> find, I couldn't invoke it from getmail and so downloaded fetchmail. So
> your posting is timely ;)
> 
> > 
> > 1) apt-get install mailfilter - it only depends on libc, libstdc++ and
> >    debconf, so no baddies there. :-)
> Installed through dselect - no problem
> 
> > 2) modify ~/.fetchmailrc with the 'preconnect "mailfilter"' line,
> >    which goes in a slightly non-obvious place, as in my example
> >    (attached); only one 'preconnect' line is needed to check multiple
> >    mailboxes, as mailfilter gets the info on which boxes to check from
> >    its own .rc, not from fetchmail.
> Have done this but want to avoid wiping mails off the server for two
> days (what I currently do with getmail).  Haven't cracked how to do this
> yet ... so using mailfilter alone in "TEST" mode

I don't think you can do this straightforwardly. It would probably be
possible to do something yucky like filtering on the Date: header with
a cron job to alter the filter expression in .mailfilterrc at
midnight...

> > 3) modify my attached ~/.mailfilterrc with your POP3 username and
> >    password details. The DENY rules to filter out viral crap are
> >    translated from posts by Greg Lehey and David Lloyd on the LinuxSA
> >    list. The ALLOW lines are to cope with the possibility of list
> >    traffic arriving with large log files attached which would
> >    otherwise be knocked out by the MAXSIZE limit. You must have the
> >    log file. You can add a line 'TEST=yes' to run in 'dummy' mode
> >    without actually deleting everything. The DENY and ALLOW lines must
> >    not contain line breaks.
> I've used your filters only (having commented out the example ones
> supplied) but when I look at mailfilter.log it seems to have deleted
> everything (in TEST mode luckily).  I can send the log file if needed;
> meanwhile I attach my mailfilterrc file.  Can you tell me what I've done
> wrong?

Most peculiar... it scarcely differs from mine except in ordering.
Differences being that you've explicitly set MAXLENGTH and
MAXSIZE_ALLOW - but to the default values, so that shouldn't make any
difference; and a couple of spurious spaces appear to have crept into
the DENY rule based on attachment file extensions - probably some word
wrap issue along the way - which should do nothing but make that rule
slightly less effective.

Perhaps you could set VERBOSE to 5 and post a log file?

-- 
Pigeon

Be kind to pigeons
Get my GPG key here: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x21C61F7F

Attachment: pgpi9zcAXt29x.pgp
Description: PGP signature


Reply to: