- WLUG - wlug.mailman3.com

Re: [Wlug] Filtering attachments via a Sendmail ruleset?

by Orion

Dave Coutu said: > > Hey Guys, > > > > Really simple question here... A while back I had asked whether > sendmail could filter out mail based on a subject header , and > found out that it could. Now I have a situation here at work where > we want to filter out attachments, the obvious being .vbs, .exe, > basically anything that may contain a virus. We don't run > anti-virus software on the mail server that mail is being delivered > to, nor on the sendmail relays feeding into it, since they are > Solaris boxes and we currently don't have a unix version of Norton > lying about. But I believe that we can filter out attachments > through a sendmail ruleset, and I am wondering if this is the case. > If so, can someone tell me how/where to do it please? Would be > very appreciative for any help here! Thanks in advance! > > > > Dave Not sure if this helps, but a friend of mine was working on this email scanning stuff: http://pldaniels.com/ Check out Inflex and Ebola. XaMime is a commercial version of Inflex, I believe. It's also in rather early development, afaik. Any questions, he's usually on #linuxhelp on irc.slashnet.org as "inflex". -- Orion orion [at] tribble [dot] dyndns [dot] org Spund is cool. Great sounding word. Kind o' thing Meg'd say. -freakstone

April 5, 2001

Re: fwd: [Wlug] Filtering attachments via a Sendmail ruleset?

by Theo Van Dinter

On Thu, Apr 05, 2001 at 04:01:50PM -0400, Paul Lussier wrote: > As long as you have procmail installed and sendmail is configured to > use procmail, just drop this stuff in place and you'll instantly > start filtering stuff based on content and/or extension. Just an FYI: This means that procmail will have to run and filter each message *per recipient* which means it's going to cause lots of CPU overhead, depending on what kinds of filtering you're doing. -- Randomly Generated Tagline: "I sometimes think that they hire guards based on the bone content in their heads." - Londo on Babylon 5

April 5, 2001

Re: fwd: [Wlug] Filtering attachments via a Sendmail ruleset?

by Paul Lussier

In a message dated: Thu, 05 Apr 2001 15:48:11 EDT Jeffry Smith said: >OK, I know we do something to "defang" stuff, could I / you pass what it >is on to this list, to answer this question? > >jeff >------- Forwarded Message > >From: "Dave Coutu" <cout(a)alum.wpi.edu> >To: <wlug(a)mail.wlug.org> >Date: Thu, 5 Apr 2001 11:10:10 -0700 >Subject: [Wlug] Filtering attachments via a Sendmail ruleset? > >Hey Guys, > > Really simple question here... A while back I had asked whether = >sendmail could filter out mail based on a subject header , and found out = >that it could. Now I have a situation here at work where we want to = >filter out attachments, the obvious being .vbs, .exe, basically anything = >that may contain a virus. We don't run anti-virus software on the mail = >server that mail is being delivered to, nor on the sendmail relays = >feeding into it, since they are Solaris boxes and we currently don't = >have a unix version of Norton lying about. But I believe that we can = >filter out attachments through a sendmail ruleset, and I am wondering if = >this is the case. If so, can someone tell me how/where to do it please? = > Would be very appreciative for any help here! Thanks in advance! What we do here is use procmail on our local, internal mail server. There's a great filtering set of procmail rules for this located at: http://www.impsec.org/email-tools/procmail-security.html As long as you have procmail installed and sendmail is configured to use procmail, just drop this stuff in place and you'll instantly start filtering stuff based on content and/or extension. There's a lot of configuration and customization you can do with this thing, and we've found that it works fantastic. We've intercepted the "AnnaKournikova" virus many, many times since it's initial release, and I can't even count the number of other virii I've seen trapped since we installed this. HTH, Seeya, Paul -- Paul Lussier Chairman, Nashua Chapter, GNHLUG Senior Systems and Network Engineer Mission Critical Linux, Inc.

April 5, 2001

Re: [Wlug] Filtering attachments via a Sendmail ruleset?

by Theo Van Dinter

On Thu, Apr 05, 2001 at 11:10:10AM -0700, Dave Coutu wrote: > could. Now I have a situation here at work where we want to filter out att= > achments, the obvious being .vbs, .exe, basically anything that may contain= > a virus. We don't run anti-virus software on the mail server that mail is= > being delivered to, nor on the sendmail relays feeding into it, since the= > y are Solaris boxes and we currently don't have a unix version of Norton ly= > ing about. But I believe that we can filter out attachments through a send= > mail ruleset, and I am wondering if this is the case. If so, can someone t= > ell me how/where to do it please? Would be very appreciative for any help = > here! Thanks in advance! You can't filter the message content using a ruleset (which is where attachments are located), but you can use the new milter API to do filtering. It's available in 8.10.x and later, but you might as well use 8.11.3 if you're going to upgrade anytime soon. I'm currently setting up this exact type of filtering at my current client by using a tool called MIMEdefang (http://www.roaringpenguin.com/mimedefang/) The examples that come with it show you how to filter out attachments that you don't want, but the main bits are in Perl so you can configure to your heart's content. :) Basically a C program interfaces with sendmail. That C program (per message -- not per recipient/etc) then calls a perl script which reads your configuration and acts appropriately. Right now, I have it striping out vbs/exe/com/bat attachments (removed the attachment from the mail and adds a text/plain section explaining that the attachment was removed). It's not the easiest bit of software to get installed and running, but if you're comfortable with compiling/installing from source and at least semi-comfortable with sendmail configuration (the amount needed for milter isn't much), then you'll be golden. -- Randomly Generated Tagline: I expect people to expect Perl to do the right thing. -- Larry Wall in <199911192358.PAA24109(a)kiev.wall.org>

April 5, 2001

Filtering attachments via a Sendmail ruleset?

by Dave Coutu

Hey Guys, Really simple question here... A while back I had asked whether sendmail could filter out mail based on a subject header , and found out that it could. Now I have a situation here at work where we want to filter out attachments, the obvious being .vbs, .exe, basically anything that may contain a virus. We don't run anti-virus software on the mail server that mail is being delivered to, nor on the sendmail relays feeding into it, since they are Solaris boxes and we currently don't have a unix version of Norton lying about. But I believe that we can filter out attachments through a sendmail ruleset, and I am wondering if this is the case. If so, can someone tell me how/where to do it please? Would be very appreciative for any help here! Thanks in advance! Dave

April 5, 2001

Re: [Wlug] Volunteers needed!

by doug waud

Hi > Also, would somebody be kind enough to > allow me to use their laptop for the presentation since I don't own a laptop? You can certainly use mine --- provided I don't trash it in the interim :-) / :-( Seriously, it has StarOffice 5.2 on it already. You could either put your stuff on a CD which you could bring with you and/or send it to me ahead of time and I could download it onto the computer. doug

April 5, 2001

Re: [Wlug] Volunteers needed!

by Andy Stewart

Hi all, WOW! The response has been great! Here's what I've got for volunteers so far: Critique the slides ------------------- Scott Venier Dean Deaver Doug Waud Tom Manders Conduct Demos ------------- Tim Keller Doug Waud Mark Komarinski I was hoping we could get 1 or 2 more people to do demos. I suspect that 4 people is enough to sufficiently critique the slides. The Delphi Developers group meeting takes place at: Allaire Corporation 275 Grove Street Newton, MA Check out their website for directions: http://www.discom.com/delphi/meeting/MeetingDirections.html The meeting is scheduled to start at 7:00 PM so we should probably get there early enough to setup, say 6:30 PM on Monday, April 23rd. I'd expect the traffic in this area to be pretty heavy at that time of day due to rush hour. I will find out more of the logistical information, such as, how much table space do we have, how many outlets, etc. Also, would somebody be kind enough to allow me to use their laptop for the presentation since I don't own a laptop? I'll export the presentation to HTML if necessary, or if you have StarOffice already installed, I'll use that. (Maybe its time I bought one instead of lugging around my full tower...). Later, and thanks! Andy -- Andy Stewart, Founder -o) | If you want divine justice, die. -- Worcester Linux Users' Group /\ | Nick Seldon Worcester, MA, USA _\_v | http://www.wlug.org | Andy Stewart wrote: > > HI gang, > > I have been asked to be the guest speaker at the Delphi Developers Group meeting > in Newton, MA on Monday, April 23rd (http://www.discom.com/delphi) They are > interested in Linux due to the recent product announcement of Borland Kylix > (http://www.borland.com/kylix) These folks are a group of software developers > living in the Windows world. > > I had planned to prepare a 45 - 60 minute talk, Q/A, and then demonstrate some > apps for them, such as: > StarOffice > Netscape > Developer tools and utilities > VmWare > LILO > Desktops - KDE, Gnome, enlightenment, etc. > Installation of Linux > > The above list was suggested to me by their representative as a list of things > that would be interesting to their developers group. > > I am seeking 2 or 3 people would like to volunteer to demo some of these tools > at the meeting, and who can provide support for the questions which I can't > answer. I'm looking for folks with systems or laptops that they are willing to > bring to this meeting for the demos. > > I would also appreciate a volunteer or two who would be willing to critique my > presentation slides before the meeting. You would not need to actually attend > the meeting. I'd e-mail the slides to you and request your written feedback. > The Delphi group representative will also get a sneak preview. > > If you are interested in either of these opportunities, please contact me this > week if at all possible. > > Thanks in advance! > > Andy > > -- > Andy Stewart, Founder -o) | Harris's Lament: All the good ones are > Worcester Linux Users' Group /\ | taken. > Worcester, MA, USA _\_v | > http://www.wlug.org | > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

April 5, 2001

Re: [Wlug] Friendly ISP in Worcester

by Orion

Similarly, I'm on dialup with RCN (formerly Ultranet). Although, I seem to be experiencing more network problems with RCN than ultranet had. I've never had any problems with them, as far as OS (linux), dialup-connection times (24/7), or running services (http, smtp, ssh, irc) Keller, Tim said: > Well, I'm only on dialup and I've been using Erols (Its actually RCN) and > I've had > extremely good luck with them. > > Like everything, your mileage may very... > > Tim. > > -----Original Message----- > From: Rodrigo Gomes [mailto:gomes_k@dr.com] > Sent: Wednesday, April 04, 2001 5:18 PM > To: wlug(a)mail.wlug.org > Subject: [Wlug] Friendly ISP in Worcester > > > I would like to know names and url of lnx friendly ISP's in Worcester area. > > > Thanks in advance. -- Orion orion [at] tribble [dot] dyndns [dot] org I need to learn spanish..I only know one sentence, and its not very nice... got it from some Mexican brick layers - kepe

April 4, 2001

Re: [Wlug] Friendly ISP in Worcester

by Richard H Fox

I've used AT&T Worldnet with great success - much faster than other dialups... yes, the big mega-ISP but with Linux loving employees who I've spoken with for server / network related issues... how Linux friendly is AT&T??? Visit: http://www.wurd.com/eng/setup/dialers/index.htm There's other Linux stuff on the AT&T WURD site ( http://www.wurd.com ) - but I think this is what you are looking for... OH! if you want to sign up for a Linux account use this method: https://registration.att.net/cgi-bin/inregister Hit the CONTINUE REGISTRATION button - the nine-character Registration Code is not needed... The only way to avoid downloading the Wintel or MAC dialer to setup an AT&T account is through this page... and AT&T customer (tech) support forwarded me a Linux guy (Debian his preference though he runs Mandrake on one of his machines) who gave me the link, only available by direct reference... Best... Richard ----- Original Message ----- From: "Rodrigo Gomes" <gomes_k(a)dr.com> To: <wlug(a)mail.wlug.org> Sent: Wednesday, April 04, 2001 5:17 PM Subject: [Wlug] Friendly ISP in Worcester I would like to know names and url of lnx friendly ISP's in Worcester area. Thanks in advance. ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 4, 2001

Re: [Wlug] Friendly ISP in Worcester

by Richard H Fox

I've used AT&T Worldnet with great success - much faster than other dialups... yes, the big mega-ISP but with Linux loving employees who I've spoken with for server / network related issues... how Linux friendly is AT&T??? Visit: http://www.wurd.com/eng/setup/dialers/index.htm There's other Linux stuff on the AT&T WURD site ( http://www.wurd.com ) - but I think this is what you are looking for... OH! if you want to sign up for a Linux account use this method: https://registration.att.net/cgi-bin/inregister Hit the CONTINUE REGISTRATION button - the nine-character Registration Code is not needed... The only way to avoid downloading the Wintel or MAC dialer to setup an AT&T account is through this page... and AT&T customer (tech) support forwarded me a Linux guy (Debian his preference though he runs Mandrake on one of his machines) who gave me the link, only available by direct reference... Best... Richard ----- Original Message ----- From: "Rodrigo Gomes" <gomes_k(a)dr.com> To: <wlug(a)mail.wlug.org> Sent: Wednesday, April 04, 2001 5:17 PM Subject: [Wlug] Friendly ISP in Worcester I would like to know names and url of lnx friendly ISP's in Worcester area. Thanks in advance. ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

April 4, 2001