'empty' messages

Vernon Schryver wrote:

>>From: Pavel Urban <pavel.urban@ct.cz>
> 
> 
>>I'm receiving user complaints about empty messages marked as spam by 
>>dcc. Some people in our company routinely send messages with just 
>>Subject: and 'empty' body. I've tried to add a rule for the most common 
>>destination, but it obviously doesn't work. Is there a way to whitelist 
>>this kind of traffic? Thanks!
> 
> 
> Are the messages really empty or do they consist of empty MIME attachements
> as in the spam you sent?  Such empty MIME attachements are difficult
> to whitelist by body checksum because they consist mostly of random
> MIME boundary strings.  If they really are empty, they can be whitelisted
> with John Levine's list of empty and test body checksums.  That can
> be fetched automatically into /var/dcc/testmsg-whitelist with
> /var/dcc/libexec/fetch-testmsg-whitelist run by cron.
> It should be used by including it in /var/dcc/whiteclnt:
> 
>   include testmsg-whitelist
>  
> 
> 

Yes, I've tried this whitelist and it will probably help. The problem is 
that some stupid MUA/Webmail/something that is used somewhere in our 
company produces such empty-in-quotes messages (as the one I've 
attached). I'll try to work around this somehow... maybe on Amavis level.

>>ok      env_to  postmaster
>>         env_to  postmaster@iol.cz
>>         env_to  abuse@iol.cz
>>         env_to  tech@iol.cz
> 
> 
> In what way do those whitelist entries not work?  They should exempt
> mail sent to those mailboxes from DCC checks.
> 

The attached 'spam' was addressed To: tech@iol.cz. I thought this rule 
would skip dcc check... am I wrong?

> Do you trust your local users to never send evil spam?  If so,
> could you whitelist your local IP addresses, perhaps with
> 
>     ok  ip 192.168.0.0/16
>     ok  ip 194.228.2.64/26
> 

Not an option. I have four antivirus systems that are in mail system DMZ 
(192.168/16). They are global, for all customers - approx 500.000, and 
they should filter both incoming and outgoing mail. I can add some 
selected IP addresses - does this rule mean 'if mail passed through this 
IP anywhere in the chain, it is OK'? If it is the last IP before 
antivirus system, I'm stuck again.

> 
> Vernon Schryver    vjs@rhyolite.com
> _______________________________________________
> DCC mailing list      DCC@rhyolite.com
> http://www.rhyolite.com/mailman/listinfo/dcc


-- 
***********************************************************************
Pavel Urban (pavel.urban@imaginet.cz)
IOL system disaster
Internet OnLine, owned by Cesky Telecom, a.s. (www.ct.cz)
***********************************************************************
    Vegetables should not operate electronic equipment.
           Computer Stupidities, http://rinkworks.com/stupid/
***********************************************************************