Baltimore's MAILSweeper will do this very easilly, www.mailsweeper.com,
install this between your ISP and your existing maileserver, add a scenario
to strip out whatever you want (it's so customizable it'll do pretty much
anything....header filtering will not be a problem), eg you could store
these filtered emails on the server, which can then be autodeleted after xx
days (or immediately) and you can also audit how many hits on this scenario
you are recieving to find out whether your �10k investment pays off (this is
roughly how much it'll cost to buy/install).
But to be honest I can't see the point in stopping the delivery of these
outlook messages, for if you isntalled mailsweeper you won't get any more
outlook infected emails because it'll virus check and disable any payload
infested emails of any description. checkout the product, because in the
last 18 months it's never delivered an infected email into our 4,000 user
company, and we get about 12,000 emails per day.
-----Original Message-----
From: Michael Cobb
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: 28/11/01 04:19
Subject: Re: Filtering e-mail from outlook users
Antti,
I agree that potentially this is an e-mail server question. But the
concern was wacking the mail
from outlook clients before it hit the mail server, hence the firewall
listserver thread.
Best Regards
Michael
At 05:57 AM 11/28/2001 +0200, Antti Tolamo wrote:
This message was created automatically by mail delivery software (Exim).
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[EMAIL PROTECTED]
unrouteable mail domain "lists.gnac.ne"
------ This is a copy of the message, including all the headers. ------
Return-path: <[EMAIL PROTECTED]>
Received: from localhost ([127.0.0.1] helo=linux.tola.org)
by linux.tola.org with esmtp (8.9.3/8.9.3)
id 168vmc-00035m-00
for <[EMAIL PROTECTED]>; Wed, 28 Nov 2001 05:53:14 +0200
Message-ID: <[EMAIL PROTECTED]>
Date: Wed, 28 Nov 2001 05:53:13 +0200
From: Antti Tolamo <[EMAIL PROTECTED]>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.6)
Gecko/20011120
X-Accept-Language: fi, en
MIME-Version: 1.0
CC: [EMAIL PROTECTED]
Subject: Re: Filtering e-mail from outlook users
References: <[EMAIL PROTECTED]>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Michael Cobb wrote:
Folks,
I have a customer who has asked the "best" way to filter, remove, not
accept and or disallow ALL e-mail sent to their domain from ALL users
of outlook regardless of version.
I think this is a question that goes more to area of mailservers
than firewalls.
The key word here is "best" way. These people want ALL e-mail sent by
anyone running an outlook client wacked and they also want a message
sent back to the user explaining the reason for the bounced mail.
Quite frankly, I applaud their decision but let's not debate the "why do
the want to do that" when we all know the answer to that question.
Regards
Michael
I don't know what is the best way, but I don't
think one can stop mails coming from outlook
clients except by filtering messages by the headers
outlook clients create to messages. One
needs to just know some headers and strings that all outlook
clients create and which are specific to the outlook clients.
With some knowledge of some good
and flexible mailserver(like Sendmail or
Exim in Unix/linux) , making filter that spots
outlook produced message by headers, destroys the message and
sends a preformattted message to senders address isn't
a big feat. Learning such mailserver and it's filter language
isn't a days job, but certainly worth of it learning. If
I can recommend, I think Exim is quite easy mailserver because
it uses quite easily understandable syntax and configuration
files among mailservers. But there are other which can
it do.
Don't know how it is done in WIndows world, though.
Antti
_______________________________________________
Firewalls mailing list
[EMAIL PROTECTED]
http://lists.gnac.net/mailman/listinfo/firewalls
<http://lists.gnac.net/mailman/listinfo/firewalls>
Michael Cobb
President/CEO
Cobb Communications Corporation
760-443-9700
_______________________________________________
Firewalls mailing list
[EMAIL PROTECTED]
http://lists.gnac.net/mailman/listinfo/firewalls
