[Esa-l]Sendmail Distribution Lists

[Karl.Dunn at vmic.com]

Leonard:

We filter our outgoing mail through John's filter.  That would not do what
you suggest, i.e. keep from expanding the list for a bad post, but it
would quarantine each bad mail that sendmail attempts to send outwards.

We have a setup that made this easy.  John has discussed filtering outging
mail before, in a generic way.  If you want to see how we did it for our
specific setup, I'll be happy to help, but in the interest of our own
(VMIC's) security I'd rather give you specific details "offline", that is
not on this list, but just between us.  It invloves a slightly different
fix to sendmail.cf, but otherwise works just like the incoming case.

If anybody else is interested, I'll be happy to help you also, the same
way.  If there is enough response, maybe we can whip up a fairly generic
setup that would do as an example.

Karl Dunn     (KLD13)
VMIC
12090 South Memorial Parkway
Huntsville AL USA 35803
VOICE: (256) 382-8211 or (800) 322-3616
FAX:   (256) 650-5472 or (256) 882-0859

On Thu, 26 Jul 2001, Leonard L. Goldenstein wrote:

> Hi all,
> With this whole sircam worm spread, we experienced one oddity that put a
> little egg on our face.
> As several companies do, we keep some distribution lists configured in
> sendmail.  These distro lists contain both internal e-mail addresses and
> also addresses for external people.  One external person unfortunately sent
> the sircam to a distro list on our system.  Sendmail expanded the list and
> attempted to deliver the sircam to all recipients in the list.  The local
> recipients were protected by John's excellent procmail script but the sircam
> was forwarded on to the external e-mail addresses listed in the distribution
> list.
>
> Now is there any way to do the procmail check before a distribution list is
> expanded?  Might save some people a little embarrassment in the future :)
>
> -----------------------------------------------------
> Leonard L. Goldenstein
> Information Services Consultant
>
> Geo. H. Young & Co. Ltd.
> 809 - 167 Lombard Ave.
> Winnipeg, MB R3B 3H8
> Phone: (204) 947-6851
> Fax: (204) 947-3306
>
> len at ghy.com
> http://www.ghy.com
> _______________________________________________
> E-mail Security Announce list mailing list
> E-mail Security Announce list at spconnect.com
> http://www.spconnect.com/mailman/listinfo/esa-l