Tagging of messages - wider range of tags?

[Julian Field]

Quentin,

I am only really adding new features to version 4 now, I don't want to
spend much more time on version 3. However, as you request, version 4 now
has 2 new options:

># If an attachment triggered a filename check, but there was nothing
># else wrong with the message, do you want to modify the subject line?
># This makes filtering in Outlook very easy.
># This can also be the filename of a ruleset.
>Filename Modify Subject = yes
>
># This is the text to add to the start of the subject if the
># "Filename Modify Subject" option is set.
># This can also be the filename of a ruleset.
>Filename Subject Text = {VIRUS?}

The "Filename Subject Text" is "{VIRUS?}" be default, so that sites used to
the old system won't have to change anything. However, you can change it to
whatever you like. It will be used to tag message that *only* failed a
filename check. If the message has a virus in it as well, this tag won't be
seen, just the normal virus tag.

Be warned, however, that some of the Microsoft-specific security
vulnerabilities depend on the filename traps, so don't automatically give
out any file a user asks for.

If you want to try hacking it into version 3, I have attached the patch for
version 4.

Beware I haven't had a chance to test this yet, but it's a pretty simple mod.

Jules.

At 08:05 08/10/2002, you wrote:
>Julian
>
>We are still running with MailScanner 3.20-7 (but will upgrade "soon").
>
>We can tag spam mail with one tag and virus-carrying mail with a another
>tag.
>
>I have had a request to be able to use a third tag for mail that has had
>a filename attachment removed because it violated our filename rules. At
>present this would be tagged as if it carried a virus and this is not
>helpful.
>
>Is this possible with later versions of MailScanner?
>
>The logic behind this request seems sound. Our users are quite happy to
>auto-delete all messages tagged as carrying a real virus because it is
>almost always junk mail or so mangled after MailScanner to be useless.
>However they don't want to autodelete mail with attachments deleted
>because of filename rules.
>
>We are an academic site where a lot of important research
>papers/data/etc are swapped between academics in the form of e-mail
>attachments so users are more concerned about mail that has an
>attachment dropped because of the filename rules. Our rules are pretty
>aggressive and this catches bona fide mail that the user would want to
>know about so that she can ask for it to be re-sent in a more acceptable
>form.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Computing Service, University of Newcastle
>FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: filenametrap.patch
Type: application/octet-stream
Size: 8416 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021008/efe490d5/filenametrap.obj
-------------- next part --------------
--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ