Scott, your experience with rules working in an unexpected manner
illustrates the danger of piping filtered output to NUL instead of to a
directory where the filtered content can be examined in order to tweak the
rules. I've been using the Knowledgebase suggested rules for virus
filtering myself with reasonable success,
B~(name=".*\.ext1"|name=".*\.ext2"|name=".*\.ext3"):quarantine
B~(begin 6.*\.ext1|begin 6.*\.ext2|begin 6.*\.ext3):quarantine
(where extn represents any extension you're trying to filter)
but last week a number of messages end up in our "virus:quarantine"
directory, each of which contained a single Uuencoded .gif file as an
attachment. Clearly they were being snagged by the second rule above for
Uuencoded files, and a search of the message revealed that the string
".ext1" occurred in the attachment.
To decrease the likelihood of this occurring, I would recommend that the
Uuencode rule be further adjusted by adding \s to end of the individual
search strings. This filters white space, including carriage returns, which
occur after the initial filename in the header of a Uuencoded attachment.
Thus:
B~(name=".*\.ext1"|name=".*\.ext2"|name=".*\.ext3"):quarantine
B~(begin 6.*\.ext1\s|begin 6.*\.ext2\s|begin 6.*\.ext3\s):quarantine
This may not have been your problem, but unless you start capturing filtered
messages, you'll never know.
http://support.ipswitch.com/kb/IM-19990609-DM06.htm
Rules caveats:
1. Thorough testing is advised.
2. Your mileage may vary.
3. Don't blame me.
Michael
> ----------------------------------------------------------------------
>
> From: "Scot Rager" <[EMAIL PROTECTED]>
> Subject: [IMail Forum] Filtering
> Date: Tue, 20 Mar 2001 14:12:42 -0500
>
> I have attached Ipswitch Knowledgebase document number
> IM-19990609-DM06. I
> am trying to keep all .vbs and js files from being delivered to
> my users. I
> implemented this rule into my rules.ima file under the Imail directory. I
> am using IMail 6.06. At first, it seemed to work fine until I
> realized ALL
> messages with attachments of any kind were being delivered to
> NUL. This was
> obviously not the desired result. Can anybody offer any help? It's
> definitely not a syntax error as I copied and pasted the text into the
> rules.ima file.
>
> Thanks,
> Scot A. Rager
> Network Manager
> Earth Sciences Consultants, Inc.
> [EMAIL PROTECTED]
>
> ----------------------------------------------------------------------
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
