Re: amavisd/clamav Virus Recipient email notification template woes

From: Warren Block (wblock_at_wonkity.com)
Date: 07/31/04

  • Next message: Loren M. Lang: "Re: Problems after IP change" 
    Date: Fri, 30 Jul 2004 18:22:00 -0600 (MDT)
To: Tim Schutt <tim@square1consulting.com>

    On Fri, 30 Jul 2004, Tim Schutt wrote:

    > On Jul 30, 2004, at 4:09 PM, Bill Moran wrote:

    >> If you're going to send notification, there is only one _proper_ way
    >> to do it: analyze the Received: headers and find out where the virus
    >> _really_ originated, then contact the abuse@ address for that domain
    >> with the message.

    > I completely understand where you are coming from, and I am only intending on
    > notifying the intended recipient of the email, not the "sender" for the very
    > reason that you note. If it was just me, I would can the message and be done
    > with it. However, I am in the midst of marketing this service to some highly
    > security conscious people so I would like the reinforcement of the
    > notifications for their piece of mind and a little customer-stroking
    > reminding them how great the service is. :-)

    [Format recovered--please don't top-post. It makes responding to your
    messages difficult and time-consuming, to the point that many people
    won't bother.]

    "Virus detected" messages are generally abusive. Here are some problems
    I've experienced on the receiving end of antivirus notification
    messages:

    * Sent to the forged From address. We'll skip the issue of a virus
       checker that trusts any content in a virus-generated message;
       what about long CC: and BCC: lists?

    * Sent to the intended victim--"Hey, you almost got away without being
       harassed, but we wanted to brag about our antivirus system."

    * Some include "this message guaranteed virus-free" text. It's like the
       sender is saying "please sue me".

    * Sent outside the detecting system's domains, spreading the damage.
       If you must send notifications, send them only to those systems you
       control, and where you are responsible to your users.

    * Antivirus software forges "postmaster@victim'sdomain" into the From:
       line. Senders of these messages get a 550 reject for all further
       mail.

    * Some notifications include the virus. Yes, there are actual
       "antivirus" programs out there that are dumb enough to do this.

    Bearing that in mind, here's a suggestion for clamav flags:

    clamav_milter_flags="--quiet --local --outgoing --max-children=50 --dont-log-clean --noxheader --outgoing"

    -Warren Block * Rapid City, South Dakota USA
    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Loren M. Lang: "Re: Problems after IP change"

    Relevant Pages

    • Re: Why do I get replies to DSNs? (policy response)
      ... >> D. Stussy wrote: ... >> Sending back virus notifications doesn't help that a bit. ... >> on the infected computer and used as a fake sender address. ...
      (comp.mail.sendmail)
    • Re: Exchange 5.5 - Virus in Non-Deliverable E-mail
      ... Isn't that 'just' referring to the notifications that the admin receives? ... My scenario is that I don't want to send the virus back to the spoofed ... >> back to the sender of the E-mail? ...
      (microsoft.public.exchange.admin)
    • Re: Notice of infected emails
      ... for viruses e-mail server returns a notification to the sender (sender ... field" you are the one that gets the notifications... ... > I am using active and up to-date virus protection and firewall and keep my ...
      (microsoft.public.security)
    • Re: Mystery process
      ... > I also tried a system restore, but can't do a restore either. ... > online virus scan at one of the following sites: ... Some other applications to try for ANTIVIRUS and SPYWARE elimination can be ...
      (microsoft.public.windowsxp.perform_maintain)
    • Re: Anti-spy wear
      ... had a Norton Antivirus alert that tells me it has detected a virus and is ... I have been on MSN since it came out in year ... Any threats around and we can take care of it. ...
      (microsoft.public.security)