block msgs based on filename without using antivirus?

[Martin Hepworth]

Trevor

have to considered doing some filtering at the MTA? I mean only allow
valid users to recieve email on the inbound MTA. I find this drops about
70% if my traffic.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Furnish, Trever G wrote:
> I have the terrible feeling that a way of doing this ought to be jumping into my mind, but I'm not getting it.
>
> I have a system configured which barely meets our load under the current sober onslaught and is not currently configured with any virus scanning, just spam filtering.  As such I hesitate to add any virus scanning as it might increase the server load too much.
>
> We're blocking the sober attachment filenames using filename.rules.conf, and I switched those rules from "deny" to "deny+delete" (not sure what that option is supposed to do - couldn't find documentation on it), but that doesn't stop the rest of the message from being delivered.
>
> Using spamassassin to mark the sober messages as 'high scoring spam' isn't really an option, because we still deliver 'high scoring spam' for other business reasons.
>
> Is there any way to delete the sober messages based on attachment filename, without running antivirus checks?  I suppose I could look at the code that interfaces to the "real" antivirus engines and hack up an engine to just reject those messages - I'm hoping there's an easier way.
>
> Thanks,
> Trever
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!