OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Changed subject (was Re: reg. virus named ...)
From: Bennett Todd (betrahul.net)
Date: Thu May 04 2000 - 11:53:02 CDT

2000-05-04-12:39:59 Thomas Andres:
> /Content.*LOVE-LETTER-FOR-YOU.TXT.vbs/ REJECT

I think it'd be better still to make that

  /Content.*\.vbs/ REJECT

except that I don't actually want to reject email, at all. I'm gonna
try setting up Lars Hecking's approach, with two postfixes and a
filter in between. And I'm gonna try and see if I can write the
filter in C, since I don't want to demolish my email server
performance too badly. I'm thinking the ideal, fantasy solution
would be to just have a file full of regexps, one per line, and if
any match anywhere in the whole message, header or body, just
replace the entire message with something like

        From: <>
        Subject: Suspected email worm
        Message-Id: <tailbiter.TIMESTAMPHOSTNAME>
        Date: RFC-822-TIMESTAMP

> original message,
> headers and all,
> as received,
> with the entire
> schmeer quoted
> using "> "

and send it on its way to the envelope recipients.

Sure wish I could interpose something like this without the
complexity of two Postfixes, but Lars's approach looks to be the
cleanest and simplest I've heard of so far.

-Bennett

  • application/pgp-signature attachment: stored