Feature Request

[am.lists]

On 4/11/07, Dennis Willson <taz at taz-mania.com> wrote:
>
> Hmmmmm... How does scanning the outgoing messages generate an "Alert"?
> While it is in fact good to scan outgoing messages, I believe he wants
> notification that a client is comprimised or a Spammer, not just
> filtering.
>
> Personally I use a different outgoing server with different rule sets
> than the MX. You can then set the rules to notify the sender that they
> have sent Spam/Virus, etc... and copy the postmaster (you).
>
>
> On Wed, 11 Apr 2007 16:33:27 -0700
>  Scott Silva <ssilva at sgvwater.com> wrote:
> >Jay Chandler spake the following on 4/11/2007 4:11 PM:
> >> Recently had a user account become compromised and start spewing
> >>spam.
> >>
> >> Is there any functionality within MailScanner that can alert me once
> >>one
> >> user sends more than a predefined number of messages in a given time
> >> period?  If not, I'd dearly love to see this implemented...
> >>
> >Yes... scan incoming and outgoing messages!
> >This is the precise reason I do this. Scan everything, and allow no
> >smtp
> >traffic to leave the site except from the MX's.
> >The little bit of overhead to scan the traffic is better than the
> >blacklisting
> >you might get from spewing spam.
> >

Although you didn't say which MTA is in use, if I may offer a
postfix-oriented suggestion: Take a look at policyd -- it is a policy
plug-in for postfix and can reject based on certain throttle
thresholds. Although seemingly designed for use in a gateway setup, it
could be used on your postfix server to check outbound against the
policyd service.

Angelo