Slashdot Mirror

Yes, it actually works on SP2. Fire up Task Manager and watch CPU load reach 100% for ~10 seconds for a single packet.

Here's the code that should compile on Linux.

I can't get to the article to check, but I was thinking exactly the same thing. I'm using Exim / Exiscan for e-mail. Messages first get scanned for viruses, then, scanned for spam content. Messages containing malware or which rate highly for spam content (10 points or above in SpamAssassin) aren't delivered - not quarantined, just logged, and bounced with a brief log message for the sender. Which, generally, is a piece of spam software or a virus, neither of which really care.

Come to think of it, I should replace those messages, just to see if anyone notices. "This message contained malware (Troj-JS-Script-A). Baby, you know that ain't right. Get with Smoove B. He shall procure for you the finest anti-virus software in all of the land."

Or something.

In your situation, I would simply suggest saving messages above 5 to a special folder and forward messages above 12 to Dave Null.

As others have mentioned, never, never send auto-replies or configure your MTA to send bounce messages.

If you want to reject messages, you have to do it in the SMTP dialogue with the spammer or his raped relay. If you accept the message first, or your ISP does it for you in your case, it is too late allready: Any generated bounce will go to whoever was forged into MAIL FROM: or whatever. And that's really nasty.

But if you control the MTA, then Exim 4 is pretty good at this. If you want the excrutating details, check out Marc Merlins page on using SA with Exim

But there is actually a much simpler version that can do rejection at SMTP-time for messages over a certain threshold and let message between this and another threshold marked as such, using exiscan-acl. You'll find some detailed instructions there.

About time. I've been doing this with Exim and Exiscan for almost 2 years now. It's nice to see other MTA's begin to incorporate this functionality. Now, if everyone upgrades and takes advantage of this wonderful feature, maybe the number of false NDR's I receive due to forged senders will start to go down...

Two days ago, I upgraded our mail server from Debian/Stable to Debian/Testing. In the process, I installed the nicely packagized version of exim4-daemon-heavy, which includes the exiscan patch.

Yesterday morning, one of my coworkers (a network engineer) apologized to me for being over quota, and promised he'd remove some mail soon. I blinked - I hadn't instituted mail quotas. Turned out he'd received a virus disguising itself as a system "over quota" message. The virus was hidden in a password protected zip (which Sophos for libc6 on Linux did not catch). And, since I'd just upgraded a boatload of software, it took a little while for either of us to figure out that the message was completely bogus.

Never doubt that a little chaos can cause otherwise highly competent people to act like morons.

Bouncing high scoring mail works pretty well, as long as you do it right.

This can be a *big* problem for *nix/mac users which normally don't need or use AV software.

• 139 out of 338 discarded mails
• 188 out of 423
• 169 out of 397
• 113 out of 267
• 143 out of 238
• 179 out of 347
• 228 out of 424

Exim patched with Exiscan does that. You can bounce incoming messages based on a virus check, too. Any message is checked before Exim sends "250 Message OK" so it won't enter any local queues.

I have had my Rio500 for a while too, and I use RioFXP (found here and all over the net) instead of the bundled software that came with it. You can upload and download songs to/from the Rio500. You can also do any kind of binary file, which makes it a nice file transport mechanism, provided the file is 64MB. Just don't try to play one of them. :-)