Disclaimer: If it works, great. If it does not, that is great also. It is
a little lengthy and I apologize in advance to anyone on the list that has
not asked for this spew from me. Feel free to e-mail me with any
questions about this or for a copy of my existing rules. (Approx 23KB).
If I do not respond immediately please forgive me. Believe it or not
I run an ISP on the side.
Okay, here it is. It is nothing special, but it does work for me.
Out of respect for the other users on the list I have not attached
the actual rules.ima file to this message. Drop an e-mail to me at
[EMAIL PROTECTED] and I will promptly return my current set of rules
to anyone that wants them. Keep in mind that I can not type to save my
life and my spelling and grammar is even worse.
Put a file called rules.ima in your \Imail folder. Or for virtual domains,
put this in the \Imail\virtual folder. Imail Administrator has a good
utility
for doing this also. I use notepad since I am editing it from different
locations and sitting at the server is not always convenient.
Setup rules.ima as follows:
B~filtered content in body:spambox
S~filtered content in subject:spambox
H~filtered content in header:spambox
F~filtered content in From address:spambox
T~filtered content in To address:spambox
N~filtered content in Sender:spambox
For example if you wanted to trash any mail with the subject "Kill
Dusty", then you would have a rule like this.
S~kill dusty:spambox
This would also catch messages with the subject "I want to kill Dusty" but
it would not catch "I am going to kill that thar Dusty". For you southern
typers out there.
Where does it go?
The ":spambox" sends the message to a folder called "spambox".
Unfortunately
this would create a file called "spambox.mbx" in the users folder which
would
then be accessible by the user. You could send it to any box you like. The
only
reason I chose "spambox" is because some users have their own rules that
send
to "spam".
But I don't want the user to have access to spambox.
To prevent this you must put a forward file in each users folder. Yes, each
folder.
This file must match the name of your rule. i.e. spambox.fwd. The only
thing that should be in the spambox.fwd file is the account you want the
filtered
message to go to. In my case I forward them to my "abuse" account so my
spambox.fwd looks like this.
abuse
DO NOT use a vacation message or autoresponse on the spambox folder under
abuse. Now that the filtered mail is in the abuse-spambox I can log in to
my
abuse box and see who is spamming and hopefully be able to direct any
complaints to the right people by analyzing the header info. One other
point.
DO NOT put the forward file in the account you are sending the mail to.
Getting the forward file into the users folder is another book almost so I
will not
cover it here in detail. In short I have a batch file that copies the
required files
to the new users folder. This batch runs once per day on my server and is
updated
manually by the office. I know this is not practical for larger outfits so
another
method will have to be dreamed up.
I filtered a valid message. What do I do with it?
Remember the term throwing the baby out with the bath water? Unfortunately
you
are sort of stuck with it here. If you were to simply forward the message
to
the user, it would show up from your account. And unless you removed the
filtered
content from the message then you would get trapped in your own filters. Or
you
could do it the hard way and open the .mbx file with notepad and copy and
paste
the message into the users main.mbx. Use this method with caution though as
it
can easily corrupt the mailbox. It is also a PITA.
So how do I filter a e-mail trojan or worm using rules?
You have to find the common element in messages that contain the worm in
order
to filter them. HAPPY99 is easy.
H~X-Spanska:virus
That will send any mail from an infected user to a virus folder. You could
easily send
the same message to your spambox folder also. The reason I send that one to
the
virus folder is because I have a virus.fwd file in every users folder that
sends it to
abuse. In the abuse-virus folder I have an autoresponse which sends
detailed info
back on how to remove the trojan from their computer. You could handle any
trojan
like this if you have a for sure rule that will detect it. Use the
auto-response with
extreme caution. Some users get real upset when an outsider tells them they
are
infected with anything.
Hopefully this helps anyone that is attempting to battle SPAM on their
servers. If you have
any questions, feel free to e-mail me directly.
Dusty
