Hi Leonardo, on Wed, 31 Mar 2004 23:47:06 +0200 you wrote:
> I have and it works perfectly ... this is not the problem ...
Yes, you're right, sorry - my fault for not reading it carefully enough
(usually when there is something involving never_users, it's a lack of a
root alias). However in this case it looks like you have "user = root" or
similar set on the address_reply transport. Change that to a
less-privileged user; you don't need root privileges for that.
[system filter]
> This filter is on and never gave a false positive, so i have no reason
> not to use it !
It's not the filtering that's the problem, it's the fact that you end up
sending bounce messages to innocent people. When you get a .scr or a .pif
attachment, the chances are it's a virus (as you say, no false positives).
Most viruses fake the sender. Therefore, you send spam to the sender, who
has nothing to do with sending you a scr or pif.
(This issue has been done to death on this list and others)
> > With Exim 4.x, you have the excellent and widely-used option of
> > Exiscan to do additional policy-based rejection. You would be well
> > advised to compile Exim with the Exiscan patch included, and you can
> > then do rejection based on attachment type (and *much* more) reliably
> > and without generating spurious bounce messages.
> let me be accomplished with exim4 before ...
Sure. When you are, you might find this helpful:
http://www.timj.co.uk/linux/Exim-SpamAndVirusScanning.pdf
However, in the meantime, please /dev/null the bounce messages.
> 2004-03-31 23:36:32 1B8gS6-0008Rw-Me cancelled by system filter:
> \n===== WARNING! WARNING! WARNING! - POSSIBLE VIRUS! -
> ALERT!
Thanks. That's some text that will be added to the blacklist on
http://www.timj.co.uk/linux/bogus-virus-warnings.cf, then...
Tim
