Possible to archive based on attachments?

[Randal, Phil]

Write a spamassassin rule to detect PDF attachments, and then use
MailScanner's "Spamassassin Rule Action" functionality to archive all
hits.

Cheers,

Phil 

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of
shuttlebox
Sent: 05 January 2010 16:59
To: MailScanner discussion
Subject: Possible to archive based on attachments?

We have found a nasty PDF attachment (targeted specifically against a
client of mine) and we would like to archive all PDF's passing through
MailScanner for analysis.

I don't know how to do this in a simple and transparent way. If I use
the filename/type rules it either blocks the PDF's or replaces the
original recipients, this won't fly as most PDF's are going to be OK,
the users shouldn't notice this.

The only way I can think of is to archive *all* mail and then find which
df-files (Sendmail) contains PDF's and extract them and delete the rest.
Is this how I should collect the samples? Or is there a better way?

--
/peter
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 
Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.
You should be aware that Herefordshire Council monitors its email service.
This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.