Hi, thank's - that helps. I'm still looking for a rule to block packets content based with ip-tables. ( I understood this "is" stateful inspection ) Mit freundlichen Grüßen / Best regards Bruno Leonhardt LPI Level 1 Certified Watchguard Certified System Professional CLP Domino R5 Systemadministrator "Ulrich Roth" <Roth@impact.de> schrieb am 25.08.2003 09:22:10:
Hi Bruno,
does anybody know a short solution how to check if a special squence is inside a packet ( like the string of sobig ) ? I guess you want to block Sobig.F before it hits your MTA. There exist mail filters for sendmail, exim and postfix. Have a look at this: http://www.heise.de/newsticker/data/dab-20.08.03-004/ If you have postfix, you shouldn't use the solution suggested on this page, but use the original solution. There is a link on the page, but for your convenience I give you the URL in this mail: http://sbserv.stahl.bau.tu-bs.de/~hildeb/postfix/postfix_sobigf.shtml This one works great for us. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de
-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here