Re: Sendmail and GoBig

From: Rowan Crowe (rowan_at_sensation.net.au)
Date: 08/22/03

  • Next message: Marleen Callahan: "Virus alert" 
    Date: Fri, 22 Aug 2003 23:42:45 +1000 (EST)
To: freebsd-isp@freebsd.org

    On Fri, 22 Aug 2003, Steve Ames wrote:

    >
    > Anyone got a quick sendmail ruleset to block the GoBig worm? A couple
    > of machines I help admin got beat pretty hard yesterday...

    Steve,

    You're in luck. I was just testing this literally 2 minutes ago. Try this:

    ##
    ## Common Virus Subjects
    ##
    HSubject: $>Check_Subject
    D{VMsg}"Message blocked due to subject line - if this was sent by a human\, please change the subject and resend."

    SCheck_Subject
    RRe : Approved $#error $: 550 5.7.0 ${VMsg}
    RRe : Details $#error $: 550 5.7.0 ${VMsg}
    RRe : Re : My details $#error $: 550 5.7.0 ${VMsg}
    RRe : Thank you ! $#error $: 550 5.7.0 ${VMsg}
    RRe : That movie $#error $: 550 5.7.0 ${VMsg}
    RRe : Wicked screensaver $#error $: 550 5.7.0 ${VMsg}
    RRe : Your application $#error $: 550 5.7.0 ${VMsg}
    RThank you ! $#error $: 550 5.7.0 ${VMsg}
    RYour details $#error $: 550 5.7.0 ${VMsg}

    Note that you will need to convert the large areas of space to tabs for
    sendmail to recognise it.

    Disclaimer - not 100% tested yet, but so far it's correctly accepted and
    rejected the subject lines I've thrown at it, and it's already eaten up a
    couple of real world sobig emails.

    Cheers. 

    --
Rowan Crowe - Melbourne, Australia
_______________________________________________
freebsd-isp@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
  • Next message: Marleen Callahan: "Virus alert"