On Fri, Oct 10, 2003 at 01:17:28PM +1300, Regan Murphy wrote:
> >
> > mime header check in postfix2 can reject this before it goes
> > in :), just a suggestion.
>
> The damn headers, subjects and attachments seem to change on a daily
> basis..... Easier to let the anti-virus block them after arriving and
> let them take care of the virus signatures.

Well in case u need some semi intelligent way to deal with this kinda
mail your current approach is just fine. But if u want to minimize the
traffic on your mail server at any cost just simple attachment extension
matching (which is basically what mime header check does) is the way to
go :).

My current filter is based on only one line which goes like this:

/name=[^>]*\.(ade|adp|asd|bas|bat|chm|cmd|com|cpl|crt|dbx|dll|exe|hlp|hta|inf|ins|isp|lnk|js|jse|lnk|ocx|mde|mdt|mdw|msc|msi|msp|mst|nws|ops|pcd|pi|pif|prf|reg|scf|scr|sct|shb|shm|shs|swf|uue|vb|vbe|vbs|vbx|vxd|wab|wsc|wsf|wsh)/ REJECT Potentially dangerous file attachment. Please do not include any executable attachments in your email.

That one line has completely blocked all the crap thats been going around
last few weeks.

Regards
Milos

-- 
This message is part of the NZ ADSL mailing list. 
see http://unixathome.org/adsl/ for archives, FAQ, 
and various documents. 
To unsubscribe: send mail to majordomo@lists.unixathome.org 
with "unsubscribe adsl" in the body of the message