From owner-freebsd-isp  Tue Jan 23  8:31:36 2001
Delivered-To: freebsd-isp@freebsd.org
Received: from mail.tcworks.net (mail.tcworks.net [216.61.218.4])
	by hub.freebsd.org (Postfix) with ESMTP id 8508837B401
	for <freebsd-isp@FreeBSD.ORG>; Tue, 23 Jan 2001 08:31:17 -0800 (PST)
Received: from tcworks.net (stuck.sticky.org [216.61.218.6])
	by mail.tcworks.net (8.10.2/8.10.2) with ESMTP id f0NGRVi21355;
	Tue, 23 Jan 2001 10:27:33 -0600 (CST)
Message-ID: <3A6DB20D.55BEB874@tcworks.net>
Date: Tue, 23 Jan 2001 10:32:13 -0600
From: Chris Cook <ccook@tcworks.net>
X-Mailer: Mozilla 4.72 [en] (X11; I; Linux 2.2.12 i386)
X-Accept-Language: en
MIME-Version: 1.0
To: mmason@nunanet.com
Cc: heckfordj@psi-domain.co.uk, freebsd-isp@FreeBSD.ORG
Subject: Re: sendmail rulesets
References: <20010123092722.A234@freefire.psi-domain.co.uk> <3A6DB0D2.5543A679@nunanet.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

I have been trying to impliment that check subject rule for use on the
Snow White virus without any luck.  It just gives me a 550 error and no
one can send mail.  Does it need to be in a particular area of the
sendmail.cf?  I have the ILOVEYOU rule working (been so for about 6
months).

-- 
Chris

o----< ccook@tcworks.net >------------------------------------o
|Chris Cook - Admin     |TCWORKS.NET - http://www.tcworks.net |
|The Computer Works ISP |FreeBSD - http://www.freebsd.org     |
o-------------------------------------------------------------o


Marcel Mason wrote:
> 
> Jamie Heckford wrote:
> >
> > Hi,
> >
> > Bit stuck trying to implement the following:
> 
> Assuming that you are looking at blocking some of the pesky little virus
> files that are running around these days .......
> 
> ##### Check For ILOVEYOU in subject line....
> HSubject:       $>local_check_subject
> D{BadSubject}"ILOVEYOU"
> 
> Slocal_check_subject
> R${BadSubject}  $#error $@ 5.7.1 $: 550 message rejected: Possible I
> Love You Trojan infection
> R$* ILOVEYOU $* $#error $@ 5.7.1 $: 550 message rejected: Possible I
> Love You Trojan infection
> #####
> 
> I inserted this under S98 in the sendmail.cf to deal with the LoveBug
> last year and am putting a similiar one in this week to deal with
> Snowhite and her 7 hombres'. CAVEATS: Make sure each line is a single
> line, make sure that there is a TAB immediately before "$#error", if
> it's a SPACE it won't work.
> 
> As there are sometimes quite good reasons for sending .exe files
> (self-extracting archives for example) some users may complain if you
> block them all, the above allows you to target a specific set of files.
> 
> Marcel
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-isp" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message