Re: [SLUG] Oh goodie - again....(sober.q strikes again)

[James Gray <james@xxxxxxxxxxxxxxxx>]

On Sat, 21 May 2005 09:48 am, Voytek wrote:
> <quote who="James Gray">
>
> > http://www.techweb.com/wire/security/163106139
> >
> > Hold onto your mail servers folks - looks like Monday could be ground-hog
> >
> > I can catch some samples in the wild to modify the spamassassin filters.
> > Will let people know if I (or other admins I know) manage to achieve
> > this.
>
> isn't it simpler to DISCARD with a header check ?
> that's what I done with the current crop

Indeed, you are correct - discarding at the MTA level is by far the better 
option.  However, the method for doing this varies between 
Postfix/Sendmail/Exim/Qmail/etc.  SpamAssassin is pretty universal to all of 
these and if there's a Perl regex available, most admins will be able to mash 
that into a header check for their particular MTA (which is what I've done 
for my machines).

Cheers,

James
-- 
I am firm.  You are obstinate.  He is a pig-headed fool.
  -- Katharine Whitehorn