If you want to block IP addresses from any access, your best bet is to use Imail Control Access list in the SMTP service, that way neither Imail nor Declude ever have to touch it in the first place.
John T eServices For You "Life is a succession of lessons which must be lived to be understood." Ralph Waldo Emerson (1802-1882) > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J Porter > Sent: Monday, December 25, 2006 10:30 PM > To: [email protected] > Subject: Re: [Declude.Virus] How to block an IP > > I guess I've forgotten the order in which processes occur. I thought it was > kill.lst, rules.ima, and then Declude. > > I thought I was clear. I want to block certain IP addresses which get > stopped by Declude AV for a vulnerability. Certain ones are prolific and > tend to leave a couple of hundred in my virus hold file each day. I want to > have them deleted so I don't have to deal with them. > > They don't get caught by my Declude IP blacklist since they are stopped by > AV first. It's only about 6 or 8 IP blocks which have never show a valid > email in over 2 years. > > BTW.. I responded to you off-list on my last subject a few days ago. After > thinking about it, I didn't think the subject had much place on the Declude > list. > > ----- Original Message ----- > From: "John T (Lists)" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Monday, December 25, 2006 11:38 PM > Subject: RE: [Declude.Virus] How to block an IP > > > Using Imail rules, no! Imail rules are the last to run of all other items. > > Exactly what are you intending to do? > > John T > eServices For You > > "Life is a succession of lessons which must be lived to be understood." > Ralph Waldo Emerson (1802-1882) > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of J > Porter > > Sent: Monday, December 25, 2006 8:07 PM > > To: [email protected] > > Subject: [Declude.Virus] How to block an IP > > > > Is there a way to block an IP address before analysis by Declude's AV (Ver > > 1.82 - Imail 8.x)? > > > > I thought I should be able to do this with rules.ima by looking for a line > > in the header. So I have a line that says > > H~xxx\.yyy\.zz\. > > but it doesn't work. (In case you can't see it, the lines read \. = slash > > dot per Ipswitch docs) I don't think the H~ (header contains) command > reads > > everything in the header. > > > > ~Joe > > > > > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > [This E-mail scanned for viruses at HNB.com] > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
