block msgs based on filename without using antivirus?

[Christiaan den Besten]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi !

Virusscanning will add some load on you machine -if- these message would also be spamscanned. With an outbreak like this all message
catched by the virusscanner will not be processes by SpamAssassin. This will drop the load on the machine significantly :)....

So overall it will probably be ok to add a virusscanner to the system.

Using recipient verification on the MTA is also a must have! (Someone else mentioned this already). It can never be told to many
times :)

bye,
Chris

----- Original Message -----
From: "Furnish, Trever G" <TGFurnish at HERFFJONES.COM>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Thursday, May 05, 2005 10:02 PM
Subject: block msgs based on filename without using antivirus?


I have the terrible feeling that a way of doing this ought to be jumping into my mind, but I'm not getting it.

I have a system configured which barely meets our load under the current sober onslaught and is not currently configured with any
virus scanning, just spam filtering.  As such I hesitate to add any virus scanning as it might increase the server load too much.

We're blocking the sober attachment filenames using filename.rules.conf, and I switched those rules from "deny" to "deny+delete"
(not sure what that option is supposed to do - couldn't find documentation on it), but that doesn't stop the rest of the message
from being delivered.

Using spamassassin to mark the sober messages as 'high scoring spam' isn't really an option, because we still deliver 'high scoring
spam' for other business reasons.

Is there any way to delete the sober messages based on attachment filename, without running antivirus checks?  I suppose I could
look at the code that interfaces to the "real" antivirus engines and hack up an engine to just reject those messages - I'm hoping
there's an easier way.

Thanks,
Trever

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!