Hello all,
I totally agree that "all messages regardless of whom they are from
or to" should be scanned. But
in the way I look at it it's alot easy'er and better (in my opinion) to
scan as much as you can at the smtp
level. ( in my case I scan for spam , invaild attachments, and soon
virus) heres my reason why:
Spam:
1. Anything be classify'ed as spam is reject with the error "550 error"
this does 3 jobs.
Delete the message, Sends back a error to the sender as way (during
the smtp "chat",
so as not to have to send a email back. to what might be a fake
account), and lastly it
does it in self help to cut down on spam. Due to the fact the "new"
spamming programs
do under stand what the 550 really means (it means non-existing
account). So so after
a few (about 3) 550 error to the same account. They stop sending (if
any would like
to see I do have the logs to help show this).
Attachments:
1. The easy'est reason for this is so you don't have to send back a full
blown email to the
sender of the attachment (which might also be fake, thus wasting
more bandwith). But
you are still able to notifiy, the sender of the problem and how he
might want to fix it.
Virus':
1. Really the reasons for this are the same as the Other 2.
A. Notify sender or virus with out wasting bandwidth
B. Not allowing virus any farther into your system then they have
to go.
Ps. These reay just my reasons for doing more scanning more at he smtp
level..
-- Chris L. Franklin --
Francesco Vertova wrote:
>At 21.12 11/10/04 +0200, you wrote:
>
>
>>Thank you Francesco, It indeed worked. Can you tell me what's the different
>>between filters*.tabs?
>>I want to use the fastest attachment check. No other check (AV, content) is
>>used. Shouldn't I use the filters.in or global filters file?
>>
>>
>
>In my own view, the best place to put an AV/anti-attach filter is in
>filters.post-data.tab (since you want to filter all messages regardless of
>whom they are from or to). But I had to add an AV check - besides rejecting
>exes, pifs and things like that - because I didn't want to prevent users
>from sending zip attachments, nor to let zipped viruses in.
>
>Originally, FLAVS was designed to be a filters.in filter and to send a
>virus found notification (which is very bad practice). Be sure to modify
>FLAVS so that it sends an appropriate 550 SMTP error message (look at the
>section on the .rej file in the source code).
>
>Ciao, Francesco
>
>-
>To unsubscribe from this list: send the line "unsubscribe xmail" in
>the body of a message to [EMAIL PROTECTED]
>For general help: send the line "help" in the body of a message to
>[EMAIL PROTECTED]
>
>
>
>
-
To unsubscribe from this list: send the line "unsubscribe xmail" in
the body of a message to [EMAIL PROTECTED]
For general help: send the line "help" in the body of a message to
[EMAIL PROTECTED]
