Re: Incorporating logging into Russell Nelson's anti-executable patch

[Markus Stumpf <maex-qmail@xxxxxxxxx>]

On Fri, Jan 30, 2004 at 02:49:33AM -0500, Russell Nelson wrote:
> Adam McKenna writes:
>  > My point is that people who want logging are not necessarily
>  > 'idiots'.  There are many legitimate reasons that someone might
>  > want logging.
> 
> Like what?

I use logging with your patch ;-)
The lines look like:

pd95843f9.dip.t-dialin.net:217.88.67.249 rejected: <pcsupport@xxxxxx> executable content
ipz01.net.globalnet.hr:213.149.46.90 rejected: <steve@xxxxxxxxxx> executable content
dialup40-82.birch.net:216.212.40.82 rejected: <jan@xxxxxxxxxxxxxxxx> executable content
[ ... ]

A script sends me a list of hostnames each day. After a short glance to
not block large mailservers like e.g.
  mail1.bluewin.ch:195.186.1.74 rejected: <john.werner@xxxxxxxxxx> executable content
the list gets feeded to our local DNSBL, most addresses with a /24.
If they can't care for their hosts I don't want to talk with them at all
and even save the bandwith it needs to filter out their viruses.

On the mailservers for our customers I use it non rejecting. Our
customers receive and send executables *sigh*. But the logging feature
is a good indicator to find virus infected customers. We don't do graphs
or count the bytes saved, but it helps use to improve the quality of
service that we provide to our customers (and to the net by detecting
and blocking infected hosts at our customers).

So a BIG THANKS for writing it.

	\Maex

P.S. Logging also help me to discover that one post to the ezmlm list
triggered delivery of some thousand (!!!) viruses to the "ezmlm tagged"
address I use for the list.

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"