Re: Sendmail and GoBig

From: Chris Cook (ccook_at_tcworks.net)
Date: 08/22/03

  • Next message: Rowan Crowe: "sobig effects - batten down the hatches" 
    Date: Fri, 22 Aug 2003 14:06:49 -0500
To: Rowan Crowe <rowan@sensation.net.au>

    Thanks a million!

    Rowan Crowe wrote:
    >
    > On Fri, 22 Aug 2003, Steve Ames wrote:
    >
    > >
    > > Anyone got a quick sendmail ruleset to block the GoBig worm? A couple
    > > of machines I help admin got beat pretty hard yesterday...
    >
    > Steve,
    >
    > You're in luck. I was just testing this literally 2 minutes ago. Try this:
    >
    > ##
    > ## Common Virus Subjects
    > ##
    > HSubject: $>Check_Subject
    > D{VMsg}"Message blocked due to subject line - if this was sent by a human\, please change the subject and resend."
    >
    > SCheck_Subject
    > RRe : Approved $#error $: 550 5.7.0 ${VMsg}
    > RRe : Details $#error $: 550 5.7.0 ${VMsg}
    > RRe : Re : My details $#error $: 550 5.7.0 ${VMsg}
    > RRe : Thank you ! $#error $: 550 5.7.0 ${VMsg}
    > RRe : That movie $#error $: 550 5.7.0 ${VMsg}
    > RRe : Wicked screensaver $#error $: 550 5.7.0 ${VMsg}
    > RRe : Your application $#error $: 550 5.7.0 ${VMsg}
    > RThank you ! $#error $: 550 5.7.0 ${VMsg}
    > RYour details $#error $: 550 5.7.0 ${VMsg}
    >
    > Note that you will need to convert the large areas of space to tabs for
    > sendmail to recognise it.
    >
    > Disclaimer - not 100% tested yet, but so far it's correctly accepted and
    > rejected the subject lines I've thrown at it, and it's already eaten up a
    > couple of real world sobig emails.
    >
    > Cheers.
    >
    > --
    > Rowan Crowe - Melbourne, Australia
    >
    > _______________________________________________
    > freebsd-isp@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org" 

    -- 
Chris
o----< ccook@tcworks.net >------------------------------------o
|Chris Cook - Admin     |TCWORKS.NET - http://www.tcworks.net |
|The Computer Works ISP |FreeBSD - http://www.freebsd.org     |
o-------------------------------------------------------------o
_______________________________________________
freebsd-isp@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
  • Next message: Rowan Crowe: "sobig effects - batten down the hatches"

    Relevant Pages