We've been doing something similar with per-user filters,
but I would suggest replacing 'contains' with IS
since this might result in fewer accidentally rejected
messages.
Cheers,
Terry.
>I like this solution.
>
>It's simple and it certainly does work.
>
>Thank you.
>
>Michael J. Tubby B.Sc. (Hons) G8TIC wrote:
>> All,
>>
>> Here's how we are blocking sobig.f on our public mail machines:
>>
>>
>> a) create a file called /usr/exim/filter.sobig
>>
>> if $header_subject: contains "Re: Your Application"
>> or $header_subject: contains "Re: My Details"
>> or $header_subject: contains "Re: Details"
>> or $header_subject: contains "Your Details"
>> or $header_subject: contains "Re: That movie"
>> or $header_subject: contains "Re: Wicked screensaver"
>> or $header_subject: contains "Re: Details"
>> or $header_subject: contains "Re: Thank you!"
>> or $header_subject: contains "Thank you!"
>> or $header_subject: contains "Re: Approved"
>> then
>> seen finish
>> endif
>>
>>
>> b) configure exim to use it, in /usr/exim/configure:
>>
>> #
>> # filter for Sobig
>> #
>> system_filter = /usr/exim/filter.sobig
>>
>>
>>
>> Okay, its going to get some false positives (maybe) ...
>>
>>
>> Mike
>>
>> PS. Credit to Pete Bowyer who hacked this together early this
>> morning
>>
>>
>>
>>
>>
>>
>>
>>
>> --
>>
>> ## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>>
>>
>
>--
>
>Regards
>
>Frank S. Bernhardt
>b.c.s.i.
>14 Halton Court
>Markham, ON. Canada
>L3P 6R3
>
>905-471-1691 Voice
>905-471-3016 FAX
>
>frank@???
>
>Registered Linux-User #312398 with the Linux Counter, http://counter.li.org.
>
>
>--
>
>## List details at http://www.exim.org/mailman/listinfo/exim-users Exim details at http://www.exim.org/ ##
>
>
