6 messages in net.sourceforge.lists.courier-usersRe: [courier-users] Problems with fil...
FromSent OnAttachments
Pascal BleserDec 12, 2001 2:42 am 
Alexander LazicDec 12, 2001 4:00 am 
Roland SchneiderDec 12, 2001 5:25 am 
Pascal BleserDec 12, 2001 7:22 am 
Roland SchneiderDec 12, 2001 8:02 am 
Roland SchneiderDec 12, 2001 8:24 am 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: [courier-users] Problems with filtersActions...
From:Alexander Lazic (al_s@none.at)
Date:Dec 12, 2001 4:00:41 am
List:net.sourceforge.lists.courier-users

Hi,

On 12.12.2001 11:41, Pascal Bleser wrote:

- how can I set up a mail filter that drops or modifies mails that have MS-virus-like attachments (vbs, exe, ...) - we had some examples on the mailing-list but it's not included in the examples nor in the documentation of Courier, and it's definately one of the most frequent uses of filtering (IMHO)

Hm you can use some of the "filters" but IMHO ;-) Such as the "perlfilter"-Example for overlength Date.

- where can I put a maildrop filter configuration file so that it is used by courier for *all* accounts ? (not ~/.mailfilter) /etc/courier/maildroprc ?

I think so, but if you want to allow users to filter to i think you must add:

include "$HOME/.mailfilter"

I'm not sure it this work, does anybody know?

I've set up such a filter from an example seen on this list:

if ( /^[:space:]+filename=.*\.vbs\"$/:b || \ /^[:space:]+filename=.*\.exe\"$/:b || \ /^[:space:]+filename=.*\.com\"$/:b || \ /^[:space:]+filename=.*\.pif\"$/:b || \ /^[:space:]+filename=.*\.scr\"$/:b || \ /^[:space:]+filename=.*\.bat\"$/:b ) { xfilter "/usr/local/courier/bin/reformail -A'X-Antispam: Possible
Virus'" /^Subject: !.*/ xfilter "/usr/local/courier/bin/reformail -I'Subject: [CAUTION:
POSSIBLE VIRUS] $MATCH2'" }

http://www.courier-mta.org/maildropfilter.html

Look at "Patterns"

. . "pattern" may not start with a space, because the leading slash will be interpreted as a division sign. If you must search for something that starts with a space, use something like "/[ ] ... /" . .

I dont't know if this true for [:space:] ;-)

Hth

al ;-)