sendmail blocking? Re: [plug] Spam from The Maverick Partnership

[Grahame Bowland]

On Thu, 2001-12-13 at 11:31, BaRT wrote:
> Hi again,
> 
> 
> Is there anyway to get sendmail to block/bounch email if it contains a
> string in the body say "The Maverick Partnership"?

The usual trick is to change your MDA. Make it a program that is capable
of decoding an email, and:
 - if contains "string", stop
 - otherwise, call the real MDA you were using

This is how most Linux email virus scanner programs work. Note that
doing this properly is expensive. You'll have to create a temporary
area  to unpack MIME encoded messages; the more thorough virus scanners
will then go to effort of decompressing attached files, to get very
close to the real content of the mail.

Given the amount of processing time per mail, the added disk usage and
the system time of all those fork() calls, it can be quite impressively
loading. On our student email server the load very quickly went > 200
when we tried it :-)

-- 
Grahame Bowland                       Email: grahame at ucs.uwa.edu.au
University Communications Services    Phone: +61 8 9380 1175
The University of Western Australia     Fax: +61 8 9380 1109
                                     CRICOS: 00126G