Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Wed, May 19, 2004 at 02:14:29PM -0400, MBS wrote:
> >Define "heavy handed" ;)
> 
> I've noticed when attempting to send a person an email 
> after a networking event it gets blocked out.

I'm not sure what you mean when you say "blocked out". Spam can either
be rejected (during the SMTP handshake), bounced (accepted, then not
delivered to the target address, usually with a delivery status
notification sent - the source of 5%-25% of our rejected mail here:
bogus DSNs from idiot mail servers) or filtered (either by the server or
by way of filter fodder: headers, subject keywords, etc. added by the
server or some interim filtering software, e.g., spamassassin, procmail,
razor, etc.) Which of these do you mean when you say "blocked out"?

> I'd like for emails like this to come through. At a later point
> if I decide I'd like to block an email it would be cool 
> to have that option.

Again, I'm not sure what you might mean by this. You want to receive
mail from certain addresses at certain times but not others? 

> > Any experienced input would be helpful.
> 
> >Can you give us a little more information? 
> 
> In a perfect world I would like to say to my cleints who have 1 to 
> 12 computers, Try X company or X software so it'd be a client 
> side solution.

OK. You didn't answer any of the questions I asked, though - what platforms
are you talking about here? (OS, mail client, mail server)?

> I really like spam blocking using Procmail, a server side
> solution.

You can't block mail using Procmail. Procmail is a delivery agent, not a
mail server solution. Thus, procmail /only/ sees the message /after/ it
has been accepted and handed off by sendmail (or whatever MTA you're
using) for final delivery to the user.

The best you can do is accept the message, run procmail on it and decide
that it's spam, and then silently delete it. If you bounce it back to
the sender (which is usually forged) you're just adding to the spam
problem. Don't get me wrong - I use procmail for a lot of things, and to
quarantine mail I'm not ready to reject outright yet. But it ain't an
antispam solution. It's just a message delivery program with some
extensive capabilities for checking messages using other software or by
way of arbitrarily defined rules. That's it.

> It sounds like the cleanest option but I would need some training
> on how to use it. That's why I'm interested in seeing if there is some
> interest in a class. You can check it out here 
> http://www.angel.net/~nic/spam-x/this  

Procmail is powerful, but really ugly as a scripting language. Try
"man procmailrc" and "man procmailex" for examples.
 
> I get 12 legit emails per account (3 accounts)

In what time period? Daily? Yearly? Every second?

> 200 spams which probabaly half are carrying some zipped or other file 
> extension virus.

Spam != viruses. They're two different problems, and shouldn't be
confused. Sure, spammers are using viruses to install proxy software on
Windows boxes they don't own, and that is why I reject mail from generic
dynamic/broadband hosts. But the two problems aren't the same - and
you're unlikely to find anything that tackles both in one solution;
partly because spam is annoying but mostly harmless (and people can
tolerate a lot of spam simply to avoid inadvertent blocking of legit
mail) whereas viruses can not only affect (and infect) you, but can raise
all sorts of havoc on your local network as well as beyond, so the rules
for filtering viruses tend to be more fine-grained and strict, IME.

Fortunately, if you're using procmail it's really pretty easy to catch
all or most of these, as they all have Content-Type and
Content-Disposition headers, and you can filter on their filename and/or
extension. You can even do this from sendmail.

> My clients needs are all over the place. I'd would like 
> to point them to a decent tool for a small company.

I suspect there won't be one tool that will satisfy all of your needs,
insofar as you described them above. Maybe some clarification on what
those needs actually are will help narrow the field down a bit.

Steve

PS: sorry for the delay; I've been out of town.

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/