block msgs based on filename without using antivirus?

[Furnish, Trever G]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks, Julian and Matt.  I'll take a look at the generic scanner stuff.

Matt, I completely agree with your comments regarding the need for virus scanning.  However it's not that virus scanning isn't happening - it just happening on systems other than MailScanner, so adding it to MailScanner in this case would be redundant (not that would be a bad thing either, but it's not urgent at the moment :-) ).



> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Thursday, May 05, 2005 3:19 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: block msgs based on filename without using antivirus?
> 
> 
> You could use the "generic" virus scanner to do this. Read
> /usr/lib/MailScanner/generic-wrapper and it explains what you 
> get given
> and what you have to return.
> 
> Then just put "generic" in the list of Virus Scanners in
> MailScanner.conf and add your made-up virus name to the list of Silent
> Viruses.
> 
> Give me a shout if you want some help, (particularly if you 
> are able to
> contribute) :-)
> 
> If you can give me a simple list of the filenames you are looking for,
> then I should be able to write it in a few minutes for you.
> 
> Furnish, Trever G wrote:
> 
> >I have the terrible feeling that a way of doing this ought 
> to be jumping into my mind, but I'm not getting it.
> >
> >I have a system configured which barely meets our load under 
> the current sober onslaught and is not currently configured 
> with any virus scanning, just spam filtering.  As such I 
> hesitate to add any virus scanning as it might increase the 
> server load too much.
> >
> >We're blocking the sober attachment filenames using 
> filename.rules.conf, and I switched those rules from "deny" 
> to "deny+delete" (not sure what that option is supposed to do 
> - couldn't find documentation on it), but that doesn't stop 
> the rest of the message from being delivered.
> >
> >Using spamassassin to mark the sober messages as 'high 
> scoring spam' isn't really an option, because we still 
> deliver 'high scoring spam' for other business reasons.
> >
> >Is there any way to delete the sober messages based on 
> attachment filename, without running antivirus checks?  I 
> suppose I could look at the code that interfaces to the 
> "real" antivirus engines and hack up an engine to just reject 
> those messages - I'm hoping there's an easier way.
> >
> >Thanks,
> >Trever
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >Support MailScanner development - buy the book off the website!
> >
> >
> >
> 
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!