Unusual Quantities of Spam?

[Henry Spencer]

A quick hack for getting this mess under control, if you are running a
modern sendmail but are not currently running fancier filters...

The line

define(`confMAX_MESSAGE_SIZE', `140000')dnl

in the m4 version of your sendmail configuration will produce the line

O MaxMessageSize=140000

in your sendmail.cf, and that blocks essentially all this crap.  (There is
still a sprinkling of small error messages etc., but that's easier to cope
with than a steady stream of 150KB worms.)  The smallest of the infected
messages seems to be about 145000 bytes.

Sendmail declares this limit as part of connection startup, and a fair
number of far-end mailers seem to pick up on that and just give up on
sending the thing at all.  If the far end does try, sendmail will notice
that the message is too big and refuse to accept it. 

Of course, if you regularly mail big files around, this will block that
legitimate traffic too.  You pays your money and you takes your choice.  I
was getting a megabyte of worms every few minutes -- not a problem for my
connection, but a serious disk-space issue (not to mention the way certain
mail interfaces misbehave on enormous mailboxes) -- and I don't get big
files in mail very often, so I can live with some (I hope) temporary
limitations in return for getting my mailbox back. 

                                                          Henry Spencer
                                                       henry-lqW1N6Cllo0sV2N9l4h3zg at public.gmane.org



--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml