From owner-freebsd-isp@FreeBSD.ORG Fri Aug 22 12:02:05 2003 Return-Path: Delivered-To: freebsd-isp@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C30DF16A4BF for ; Fri, 22 Aug 2003 12:02:05 -0700 (PDT) Received: from mail.tcworks.net (mail.tcworks.net [216.61.218.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0F4EB43FEC for ; Fri, 22 Aug 2003 12:02:05 -0700 (PDT) (envelope-from ccook@tcworks.net) Received: from tcworks.net (stp.tcworks.net [216.61.218.6]) by mail.tcworks.net (8.12.6/8.12.6) with ESMTP id h7MItAdK004952; Fri, 22 Aug 2003 13:55:10 -0500 (CDT) Sender: xcess@mail.tcworks.net Message-ID: <3F4669C9.88A8EF2D@tcworks.net> Date: Fri, 22 Aug 2003 14:06:49 -0500 From: Chris Cook X-Mailer: Mozilla 4.78 [en] (X11; U; Linux 2.4.2 i386) X-Accept-Language: en MIME-Version: 1.0 To: Rowan Crowe References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-RAVMilter-Version: 8.4.1(snapshot 20020920) (mail.tcworks.net) X-Spam-Status: No, hits=-102.1 required=6.0 tests=EMAIL_ATTRIBUTION,QUOTED_EMAIL_TEXT,REFERENCES, REPLY_WITH_QUOTES,USER_AGENT_MOZILLA_XM,USER_IN_WHITELIST, X_ACCEPT_LANG version=2.55 X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) cc: freebsd-isp@freebsd.org Subject: Re: Sendmail and GoBig X-BeenThere: freebsd-isp@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Internet Services Providers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Aug 2003 19:02:06 -0000 Thanks a million! Rowan Crowe wrote: > > On Fri, 22 Aug 2003, Steve Ames wrote: > > > > > Anyone got a quick sendmail ruleset to block the GoBig worm? A couple > > of machines I help admin got beat pretty hard yesterday... > > Steve, > > You're in luck. I was just testing this literally 2 minutes ago. Try this: > > ## > ## Common Virus Subjects > ## > HSubject: $>Check_Subject > D{VMsg}"Message blocked due to subject line - if this was sent by a human\, please change the subject and resend." > > SCheck_Subject > RRe : Approved $#error $: 550 5.7.0 ${VMsg} > RRe : Details $#error $: 550 5.7.0 ${VMsg} > RRe : Re : My details $#error $: 550 5.7.0 ${VMsg} > RRe : Thank you ! $#error $: 550 5.7.0 ${VMsg} > RRe : That movie $#error $: 550 5.7.0 ${VMsg} > RRe : Wicked screensaver $#error $: 550 5.7.0 ${VMsg} > RRe : Your application $#error $: 550 5.7.0 ${VMsg} > RThank you ! $#error $: 550 5.7.0 ${VMsg} > RYour details $#error $: 550 5.7.0 ${VMsg} > > Note that you will need to convert the large areas of space to tabs for > sendmail to recognise it. > > Disclaimer - not 100% tested yet, but so far it's correctly accepted and > rejected the subject lines I've thrown at it, and it's already eaten up a > couple of real world sobig emails. > > Cheers. > > -- > Rowan Crowe - Melbourne, Australia > > _______________________________________________ > freebsd-isp@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-isp > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org" -- Chris o----< ccook@tcworks.net >------------------------------------o |Chris Cook - Admin |TCWORKS.NET - http://www.tcworks.net | |The Computer Works ISP |FreeBSD - http://www.freebsd.org | o-------------------------------------------------------------o