Virus Scanning = rule question

[Jim Dickenson]

I do not see how this would do what I want.

Basically I want to allow email attachments from a single user sending email
from a single IP address without virus scanning them.

I do not want to not scan stuff from a particular email address because
anyone can use any address they want. I do not want to not scan stuff from a
particular IP address because if they are hacked I want some protection.
--
Jim Dickenson
mailto:dickenson at cfmc.com

CfMC
http://www.cfmc.com/



> From: Peter Russell <pete at ENITECH.COM.AU>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> Date: Tue, 15 Feb 2005 13:11:21 +1100
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Subject: Re: Virus Scanning = rule question
>
> What if you had a rule in your MTA that didnt accept mail from domains
> that dont resolve properly, and then youn can just block the email
> address in the MS rulesets. This will provide coverage against all those
> using domain names they shouldnt?
>
> I have this turned on, but i cannot remember for the life of me where it
> controlled :)
> Pete
>
> Jim Dickenson wrote:
>> Is is possible to use a rule like
>>
>> From: address at domain.com   and   From: 192.168.1.2   no
>>
>> To not virus check email from a specific user at a specific IP address?
>>
>>
>>
>>
>>
>> Just to let you all know I just went online with an inbound mail gateway
>> using the GreetPause feature in sendmail 8.13.1 and it looks like the amount
>> of spam has been dramatically reduced. It has only been a few hours but it
>> is nice not getting a hundred spam messages every couple hours in my inbox.
>>
>> The system is running Fedora Core 3 with all updates as of a few days ago. I
>> am using clamAV 0.82 and will update to 0.83 once I am sure things are
>> stable for this change. Mail is scanned on the front-end sever and pushed
>> over to a Linux 9 box where the mailboxes actually live. This other system
>> is used as our outbound server as well.
>>
>>
>> This is Fedora Core release 3 (Heidelberg)
>> This is Perl version 5.008005 (5.8.5)
>>
>> This is MailScanner version 4.38.10
>> Module versions are:
>> 1.00    AnyDBM_File
>> 1.14    Archive::Zip
>> 1.03    Carp
>> 1.119   Convert::BinHex
>> 1.00    DirHandle
>> 1.05    Fcntl
>> 2.73    File::Basename
>> 2.08    File::Copy
>> 2.01    FileHandle
>> 1.06    File::Path
>> 0.14    File::Temp
>> 1.29    HTML::Entities
>> 3.45    HTML::Parser
>> 2.30    HTML::TokeParser
>> 1.21    IO
>> 1.10    IO::File
>> 1.123   IO::Pipe
>> 3.05    MIME::Base64
>> 5.417   MIME::Decoder
>> 5.417   MIME::Decoder::UU
>> 5.417   MIME::Head
>> 5.417   MIME::Parser
>> 3.03    MIME::QuotedPrint
>> 5.417   MIME::Tools
>> 0.10    Net::CIDR
>> 1.08    POSIX
>> 1.77    Socket
>> 0.05    Sys::Syslog
>> 1.02    Time::localtime
>>
>> Optional module versions are:
>> 1.810   DB_File
>> 1.10    Digest
>> 1.01    Digest::HMAC
>> 2.33    Digest::MD5
>> 2.10    Digest::SHA1
>> 0.44    Inline
>> 0.13    Mail::ClamAV
>> 3.000002        Mail::SpamAssassin
>> 1.997   Mail::SPF::Query
>> 0.15    Net::CIDR::Lite
>> 0.48    Net::DNS
>> 0.32    Net::LDAP
>> 1.94    Parse::RecDescent
>> missing SAVI
>> 1.2     Sys::Hostname::Long
>> 2.46    Test::Harness
>> 0.54    Test::Simple
>> 1.95    Text::Balanced
>> 1.35    URI
>>
>>
>> --
>> Jim Dickenson
>> mailto:dickenson at cfmc.com
>>
>> CfMC
>> http://www.cfmc.com/
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!