RE: [cobalt-users] Mailscanner question

["Paul Shuttleworth" <paul@xxxxxxxxxxxxxx>]

> -----Original Message-----
> From: cobalt-users-admin@xxxxxxxxxxxxxxx
> [mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Larry Smith
> Sent: 23 August 2003 16:00
> To: cobalt-users@xxxxxxxxxxxxxxx
> Subject: Re: [cobalt-users] Mailscanner question
>
>
> On Saturday 23 August 2003 08:41, Greg Hewitt-Long wrote:
> > >Hi,
> > >I know you can disable admin alerts for all viruses picked up,
> but is it
> > >possible to do it for just one virus, i.e this sobigF thing
> thats hitting
> > >hard still.
> > >I know I could filter it in Outlook - but with outlook 2000
> and multiple
> > >accounts it tends to hang with stupid rules in error type messages.
> > >
> > >This is Bassi's Mailscanner on a Raq4
> > >
> > >TIA
> > >
> > >Phil
> >
> > I don't think so - because the quiet deletion option in
> MailScanner still
> > alerts the postmaster.
> >
> > What MIGHT work, but I haven't verified this, is to use filters on a web
> > based email if you have it.
> >
> > We have openwebmail on our boxes, if you do too, then perhaps setting a
> > filter to delete them on the server would work to remove them before you
> > collected them , or have them forwarded.  Worth a try...
> >
> > hth
> >
> > Greg H-L
>
> Yes, and no.  There is a second option in MailScanner that says
> "Notify local
> postmaster = yes/no"
>
> Believe the ones you are interested in are:
>
> Deliver To Recipients = no
> Notify Senders = no
> Action = delete
> Notify Local Postmaster = no
>
> Basically these four will 1.  Not deliver the message IF it contained a
> virus/bogus attachment; 2.  not notify the sender; 3. simply delete the
> message; 4. Not send a message to the admin/postmaster that it
> deleted the
> message.....
>
> Probably not "good" under normal circumstances, but right now I
> am doing it on
> all our servers to cut down on the "bogus" reporting and number
> of "you sent
> me a virus" reports that our people have been getting...


You could always try putting the so big in the section below.


# Filename containing a list (1 on each line) of the exact names of
# viruses you want to quietly delete or quarantine without informing
# the sender. Any email messages containing one
# of the viruses listed in this file will be quietly deleted. The only
# person who will be warned about the virus will be the local postmaster.
#
# Make the virus names in this file as specific as possible, in order
# to avoid any accidents with files which both
# 1) have a filename containing the name of a listed viruses, *and*
# 2) are infected with viruses whose names are not listed.
#
# In other words, you will be just fine so long as you list the exact
# names of viruses, e.g. "W32/Klez-H" and "W32/Klez-G", not just
# generic names that catch many different viruses, e.g. "Klez".
#Viruses To Quietly Delete =
/home/opt/MailScanner/etc/viruses.to.delete.conf


Paul.