MCP & quarantine

[Stephen Swaney]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Quentin Campbell
> Sent: Thursday, July 21, 2005 8:27 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: MCP & quarantine
> 
> I don't normally use the MailScanner quarantine feature here. Am looking
> for some pointers to enable me to quarantine messages caught my MCP.
> 
> We are using MCP to recognise and block what looks like a new MyDoom or
> similar virus/worm that arrives as a zipped attachment in a socially
> engineered message that looks like it was sent by this site.
> 
> When the MCP action is "delete" that is working OK. However I would like
> to capture some of these messages to be better able to study their
> content and characteristics.
> 
> To that end I changed the MCP action from "delete" to "quarantine". The
> logs indicate that the action is now "quarantine" but I am seeing
> nothing under /var/spool/MailScanner/quarantine.

Quentin,

I think you want "store" not "quarantine"

Steve

Stephen Swaney
Fort Systems Ltd.
stephen.swaney at fsl.com
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!