[Mimedefang] Filtering new Mirosoft virus email ...

[Cormack, Ken]

> Hi Ken,
> I tried installing your script on my mailserver, but it has a strange
> behaviour.
> I added these lines into subjects_full:

> re:.thanks!
> re:.approved

Mirko -

I'm assuming by "script" you mean the sendmail LOCAL_RULESET "CheckSubject"
rule that I use, in sendmail.mc/cf.  Generally speaking, I use the
subjects_part list far more that the subjects_full list, simply because if I
declare a full match on "approved", and then an email comes in "re:
approved", the complete subject obviously no longer matches.

So technically, if you wanted to use the subjects_full file, you'd have to
account for all of the following variants:

approved
re: approved
fwd: approved
... and so on.

On the other hand, you have to be carefule with what you put in the partial
subjects file (subjects_part), because adding the word "approved" there
would also bounce emails with subjects such as "management just approved
your project".

If the likelyhood of clashes such as that example bother you, then add all
the permutations you can think of, to the full file.  Other times, the
partial list can cover you, with less likelyhood of causing clashes like the
one I just described.

Lastly, it sounds like you may be forgetting that recent versions of
sendmail actually now use TWO .cf files... sendmail.cf (for files received
via port 25), and submit.cf (for messages "submitted" locally on the
machine... with the "mail" command, for example.)

Be sure you have the rule added to BOTH .cf files, or you will have
different behavior, depending upon whether the mail was received via port
25, or whether you typed a "mail" command at the commandline.

mirko

_______________________________________________
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang