Re: [Exim] My Exim virus filter

Top Page
Delete this message
Reply to this message
Author: Greg Ward
Date:  
To: exim-users
Subject: Re: [Exim] My Exim virus filter
On 06 March 2002, Matthew Byng-Maddick said:
> Can I just mention that I think the "once" and "once_repeat" are a bad
> idea. Unlike a vacation message, where the message will still get delivered,
> this could potentially lose you mail, and breaks reliable mail delivery
> paradigms.


Good point. Problem is, I have noticed that if a system gets one virus
from joe@???, it's very likely to get another 10 or 20 viruses
over the next couple of minutes or hours. I guess my main concern is
for my mail server to not look stupid: "Geez, I *know* I have a virus
infection, why can't this stupid mailer daemon stop telling me about
it?!?".

Also, mail loops are always a possibility; if someone has an
autoresponder that responds to the "From" header ("mailer-daemon@..."),
and their autoresponder includes the original bounced virus, then the
regexes that look for virus text will trigger again, and my filter will
respond again, and ... oh, you get the picture. I suppose I could
modify my filter so that mail to postmaster or mailer-daemon always gets
through, but if there's one thing I have learned, it is to never
underestimate how stupid autoresponders can be. Anyways, using "once"
increases the period of any mail loop.

Perhaps the right solution is a once_repeat on the order of 5-10
minutes, just to reduce the impact of any mail loops.

        Greg
--
Greg Ward - software developer                gward@???
MEMS Exchange                            http://www.mems-exchange.org