Re: [Mimedefang] OT: Email web form exploits

2005-09-06 Thread John
At 11:23 PM 9/5/2005, you wrote: On Jan 26, 5:16pm, John wrote: } } I am a System Administrator in Billings, MT. I am having the same issue, } however I do not feel this is to be taken lightly. Mine started with IP's } in Egypt Iran. I have attempted to contact the FBI Dept. of Homeland }

[Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread Rolf
hello Yesterday I received several helpful responses to the question below. All suggested using filter_relay to avoid further processing. I have now discovered that what I was initially trying doesn't match what the business wants. What is required is that some parts of the filter are to be

[Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread Mack
return('ACCEPT_AND_NO_MORE_FILTERING',ok); That should throw you straight out and not do anymore processing -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Rolf Sent: Tuesday 06 September 2005 14:22 To: mimedefang@lists.roaringpenguin.com Subject:

RE: [Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread Mack
Oops, Slightly Misread your requriment's there, Yes you will need to enter each part of the filter and perform the IP check, using something like sub filter_end ($) { return if message_rejected(); my($entity) = @_; if ($ip=~ /x.x.x.x$/i){

Re: [Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread David F. Skoll
Rolf wrote: Thanks. But I do want to do more processing. That's just the point. Its like I want to say at each point 'if the mail is from here then jump over the virus scanning bit and likewise avoid the mimetype bit and so on. That's exactly what you need to do. It is sounding like I

Re: [Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread Rolf
return('ACCEPT_AND_NO_MORE_FILTERING',ok); That should throw you straight out and not do anymore processing Thanks. But I do want to do more processing. That's just the point. Its like I want to say at each point 'if the mail is from here then jump over the virus scanning bit and likewise

Re: [Mimedefang] OT: Email web form exploits

2005-09-06 Thread Les Mikesell
On Tue, 2005-09-06 at 07:45, John wrote: Contacted them for what purpose? To tell them that you're a lousy programmer? Or perhaps to tell them that you stick random unverified code on your system (i.e. you're a lousy sysadmin)? We also, are an ISP. We, as a company, do not control

Re: [Mimedefang] OT: Email web form exploits

2005-09-06 Thread John
At 08:42 AM 9/6/2005, you wrote: On Tue, 2005-09-06 at 07:45, John wrote: Contacted them for what purpose? To tell them that you're a lousy programmer? Or perhaps to tell them that you stick random unverified code on your system (i.e. you're a lousy sysadmin)? We also, are an ISP.

[Mimedefang] Re: OT: Email web form exploits

2005-09-06 Thread Ian Mitchell
Not to make a statement here, but as I have worked as/with the feds for many years, I think these attacks are a tad prejudice and ill placed on this mailing list. However, in regards to your statements about or against contacting the feds to alert them of this new exploit. The comment made

Re: [Mimedefang] OT: Email web form exploits

2005-09-06 Thread Kenneth Porter
--On Monday, September 05, 2005 10:59 PM -0400 David F. Skoll [EMAIL PROTECTED] wrote: Also, our Web forms reject anyone who puts in an e-mail address in Vernon Schruyver's free email domain list at http://www.rhyolite.com/anti-spam/freemail-adb Nice list. Anyone have a SpamAssassin plugin

Re: [Mimedefang] Spam with more than one recipient - reject or not?

2005-09-06 Thread Wesley Peters
On Wed, 2005-08-17 at 07:54 -0400, David F. Skoll wrote: Michal Jankowski wrote: I have received a suggestion to stream by recipient. But that's a big no-no. Once you do that, you have effectively accepted the smtp transaction. So you cannot 'bounce' and the only way to notify sender

[Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread Rolf
> Thanks. But I do want to do more processing. That's just the point. > Its like I want to say at each point 'if the mail is from here> then > jump over the virus scanning bit and likewise avoid the mimetype bit > and so on. That's exactly what you need to do. Thank you. The supplied filter

Re: [Mimedefang] OT: Email web form exploits

2005-09-06 Thread David F. Skoll
Kenneth Porter wrote: http://www.rhyolite.com/anti-spam/freemail-adb Nice list. Anyone have a SpamAssassin plugin to use it like a SURBL? It's not really appropriate for that; I don't think most people can afford to reject (or even score) mail from hotmail.com, gmail.com, etc. However, we

Re: [Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread John Nemeth
On Jan 27, 5:57pm, Rolf wrote: } } If $RelayAddr is the address of the ISP mail server then processing } continues as usual. If, however, it is the address of the LAN mail } server then spam, attachments, size, and so on that the filter checks } are all to be ignored, but

Re: [Mimedefang] Re: exiting the filter before any processing

2005-09-06 Thread Rolf
Yes that is a good point and I have decided not to skip some checks on outgoing mail. thanks. r. On Jan 27, 5:57pm, Rolf wrote: } } If $RelayAddr is the address of the ISP mail server then processing } continues as usual. If, however, it is the address of the LAN mail } server then spam,