From owner-freebsd-isp  Tue Jan 23  7:29:32 2001
Delivered-To: freebsd-isp@freebsd.org
Received: from user.nunanet.com (user.nunanet.com [199.247.47.5])
	by hub.freebsd.org (Postfix) with ESMTP id 81E8037B404
	for <freebsd-isp@freebsd.org>; Tue, 23 Jan 2001 07:29:12 -0800 (PST)
Received: from nunanet.com (IDENT:mmason@morrigan.nunanet.com [199.247.47.8])
	by user.nunanet.com (8.9.2/8.9.2) with ESMTP id KAA23593;
	Tue, 23 Jan 2001 10:28:34 -0500 (EST)
Message-ID: <3A6DB0D2.5543A679@nunanet.com>
Date: Tue, 23 Jan 2001 10:26:58 -0600
From: Marcel Mason <mmason@nunanet.com>
Reply-To: mmason@nunanet.com
Organization: Nunanet Worldwide Communications
X-Mailer: Mozilla 4.73 [en] (X11; U; Linux 2.2.14-5.0 i586)
X-Accept-Language: en
MIME-Version: 1.0
To: heckfordj@psi-domain.co.uk
Cc: freebsd-isp@freebsd.org
Subject: Re: sendmail rulesets
References: <20010123092722.A234@freefire.psi-domain.co.uk>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Jamie Heckford wrote:
> 
> Hi,
> 
> Bit stuck trying to implement the following:

Assuming that you are looking at blocking some of the pesky little virus
files that are running around these days .......

##### Check For ILOVEYOU in subject line.... 
HSubject:       $>local_check_subject
D{BadSubject}"ILOVEYOU"
  
Slocal_check_subject
R${BadSubject}  $#error $@ 5.7.1 $: 550 message rejected: Possible I
Love You Trojan infection
R$* ILOVEYOU $* $#error $@ 5.7.1 $: 550 message rejected: Possible I
Love You Trojan infection
#####

I inserted this under S98 in the sendmail.cf to deal with the LoveBug
last year and am putting a similiar one in this week to deal with
Snowhite and her 7 hombres'. CAVEATS: Make sure each line is a single
line, make sure that there is a TAB immediately before "$#error", if
it's a SPACE it won't work.

As there are sometimes quite good reasons for sending .exe files
(self-extracting archives for example) some users may complain if you
block them all, the above allows you to target a specific set of files.

Marcel


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message