Hi Dusty,
I've been following the IMail list while evaluating, and your comments have
been consistently helpful. Now it appears we're within weeks of deployment,
so I was wondering if you'd mind sharing the rules file mentioned below.
The process is documented well in IMail, but if you've spent some time
researching and collecting data that goes in there, it would certainly a big
time saver for us. Likewise for the kill file. Your email is from over a
month ago, but if you still have da stuff, that'd be great.
BTW, there was another email posted the same day, referring to an elist for
spam rules. Address given was [EMAIL PROTECTED] Do you have any
experience with pdqlink?
Thanx. Eran.
-----Original Message-----
From: ## Dusty Carden <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: Thursday, June 17, 1999 12:48 PM
Subject: [IMail Forum] Global Rules
>Disclaimer: If it works, great. If it does not, that is great also. It is
>a little lengthy and I apologize in advance to anyone on the list that has
>not asked for this spew from me. Feel free to e-mail me with any
>questions about this or for a copy of my existing rules. (Approx 23KB).
>If I do not respond immediately please forgive me. Believe it or not
>I run an ISP on the side.
>
>Okay, here it is. It is nothing special, but it does work for me.
>Out of respect for the other users on the list I have not attached
>the actual rules.ima file to this message. Drop an e-mail to me at
>[EMAIL PROTECTED] and I will promptly return my current set of rules
>to anyone that wants them. Keep in mind that I can not type to save my
>life and my spelling and grammar is even worse.
>
>Put a file called rules.ima in your \Imail folder. Or for virtual domains,
>put this in the \Imail\virtual folder. Imail Administrator has a good
>utility
>for doing this also. I use notepad since I am editing it from different
>locations and sitting at the server is not always convenient.
>
>Setup rules.ima as follows:
>
>B~filtered content in body:spambox
>S~filtered content in subject:spambox
>H~filtered content in header:spambox
>F~filtered content in From address:spambox
>T~filtered content in To address:spambox
>N~filtered content in Sender:spambox
>
>For example if you wanted to trash any mail with the subject "Kill
>Dusty", then you would have a rule like this.
>
>S~kill dusty:spambox
>
>This would also catch messages with the subject "I want to kill Dusty" but
>it would not catch "I am going to kill that thar Dusty". For you southern
>typers out there.
>
>Where does it go?
>The ":spambox" sends the message to a folder called "spambox".
>Unfortunately
>this would create a file called "spambox.mbx" in the users folder which
>would
>then be accessible by the user. You could send it to any box you like.
The
>only
>reason I chose "spambox" is because some users have their own rules that
>send
>to "spam".
>
>But I don't want the user to have access to spambox.
>To prevent this you must put a forward file in each users folder. Yes,
each
>folder.
>This file must match the name of your rule. i.e. spambox.fwd. The only
>thing that should be in the spambox.fwd file is the account you want the
>filtered
>message to go to. In my case I forward them to my "abuse" account so my
>spambox.fwd looks like this.
>
>abuse
>
>DO NOT use a vacation message or autoresponse on the spambox folder under
>abuse. Now that the filtered mail is in the abuse-spambox I can log in to
>my
>abuse box and see who is spamming and hopefully be able to direct any
>complaints to the right people by analyzing the header info. One other
>point.
>DO NOT put the forward file in the account you are sending the mail to.
>
>Getting the forward file into the users folder is another book almost so I
>will not
>cover it here in detail. In short I have a batch file that copies the
>required files
>to the new users folder. This batch runs once per day on my server and is
>updated
>manually by the office. I know this is not practical for larger outfits so
>another
>method will have to be dreamed up.
>
>I filtered a valid message. What do I do with it?
>Remember the term throwing the baby out with the bath water? Unfortunately
>you
>are sort of stuck with it here. If you were to simply forward the message
>to
>the user, it would show up from your account. And unless you removed the
>filtered
>content from the message then you would get trapped in your own filters.
Or
>you
>could do it the hard way and open the .mbx file with notepad and copy and
>paste
>the message into the users main.mbx. Use this method with caution though
as
>it
>can easily corrupt the mailbox. It is also a PITA.
>
>So how do I filter a e-mail trojan or worm using rules?
>You have to find the common element in messages that contain the worm in
>order
>to filter them. HAPPY99 is easy.
>
>H~X-Spanska:virus
>
>That will send any mail from an infected user to a virus folder. You could
>easily send
>the same message to your spambox folder also. The reason I send that one
to
>the
>virus folder is because I have a virus.fwd file in every users folder that
>sends it to
>abuse. In the abuse-virus folder I have an autoresponse which sends
>detailed info
>back on how to remove the trojan from their computer. You could handle any
>trojan
>like this if you have a for sure rule that will detect it. Use the
>auto-response with
>extreme caution. Some users get real upset when an outsider tells them
they
>are
>infected with anything.
>
>Hopefully this helps anyone that is attempting to battle SPAM on their
>servers. If you have
>any questions, feel free to e-mail me directly.
>
>Dusty
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
