SOBER-I

[Kevin Miller]

Alan Cragg - Lists wrote:
>
> Does anyone know of a better way to block this without having to block
> our secondary mail server?
> Is it a performance tuning issue? We are using MailScanner 4.35.11 and
> Sophos AV, not SAVI, and SA 3.0.1.

Had a similar situation a while back.  Instead of blocking my secondary, I
used the access table in it's sendmail to drop inbound connections from the
offending IP.  That way, I could continue to receive valid email on the
secondary from elsewhere but not plug the queues with virus laden emails.  I
had the advantage, of course, of owning our secondary.

Do you have shell access to the secondary?  If not, I'd try to get your ISP
to block that address.

I also notified the sender's ISP so they could notify the owner of the
infected machine.

Good luck...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!