Re: [Exim] MyDoom filtering?

Top Page
Delete this message
Reply to this message
Author: Jez Hancock
Date:  
To: Nigel Metheringham
CC: David Woodhouse, Chris Edwards, Exim-users
Subject: Re: [Exim] MyDoom filtering?
On Mon, Feb 02, 2004 at 10:30:16AM +0000, Nigel Metheringham wrote:
> On Sat, 2004-01-31 at 13:46, David Woodhouse wrote:
> > This is my experience too -- but Matthew reported that blocking messages
> > without Message-ID 'caught only a small number of cases' though. I'm not
> > really sure why; I suspect his incoming mail comes through a box which
> > adds its own Message-ID, perhaps. Looking at the hostname in the
> > Message-ID of the offending messages, and at the Received: headers,
> > would shed some light on the reason.
>
> If you are running an older exim it helpfully adds the Message-Id header
> before the ACL kicks in - that burnt me on one box. [You could test
> for a message ID that looks like one of your own]


Has anyone seen any false positives with the message-id acl? I've had a
few from just a single mail server that inserts a message-id header:

X-Qmail-Scanner-Message-ID:

Is there any way to tweak the acl to accomodate variations like this -
perhaps a regexp?

The ACL I'm referring to is the one mentioned above kindly submitted by
Nigel in this thread along the lines of:

  deny    condition       = ${if !def:h_Message-ID: {1}}



--
Jez Hancock
- System Administrator / PHP Developer

http://munk.nu/
http://jez.hancock-family.com/  - Another FreeBSD Diary
http://ipfwstats.sf.net/        - ipfw peruser traffic logging