HOWTO: use sendmail to block messages

1. Make a backup copy of sendmail.cf
2. Add rules to the sendmail.cf file
3. Modify the rules
4. restart sendmail

Note: All these steps must be done as the root user.

This is important! You don't want to mess up your sendmail config file and not have a backup copy.

Login: root
Password: *****

cd /etc/mail
cp sendmail.cf sendmail.cf.SAVE

I have provided a basic rule that will filter email based on the subject line text of the email. Here is what that rule looks like:

## NEW VIRUS RULE

HSubject: $>Check_Subject
D{MPat}YOUR VIRUS SUBJECT HERE!
D{MMsg}Rejected! This message may contain the XYZ virus.

SCheck_Subject
R${MPat} $* $#error $: 553 ${MMsg}
RRe: ${MPat} $* $#error $: 553 ${MMsg}

## END VIRUS RULE

Note: Download the virusrule.txt file I have provided (uppper right of this page) tabs and spacing in the text file are very important!

To add this text to your sendmail.cf file, all you have to do is download it and append it to the file with the cat command. Place the downloaded virusrule.txt file in the /etc/mail directory.

cd /etc/mail
cat virusrule.txt >> sendmail.cf

The text will now be appended to the end of your sendmail.cf file, which is right where you want it to be.

In this step you will need to modify the rules to match a particular subject line text that you would like to have sendmail block. In the case of our pain in the butt W32.Sobig.f@mm worm we could use Re: Wicked screensaver. Here's how...

Using your favorite editor (ee, vi etc) and edit the new sendmail.cf file line that reads:

D{MPat}YOUR VIRUS SUBJECT HERE!

Change it to:

D{MPat}Re: Wicked screensaver

You may also want to modify the message line that reads: D{MMsg}Rejected! This message may contain the XYZ virus You can have the message portion be anything you would like.

There are two ways to do this; restart your server or send a restart signal to sendmail.

To send a restart signal to sendmail you use the killall command with the SIG HUP modifier.

killall -HUP sendmail

Next, you will want to see that sendmail restarted successfuly and is lstening. You can use the ps command to do this. Type:

ps -ax|grep sendmail

You should see something like the following to indace a success:

111 ?? Ss 0:38.45 sendmail: accecpting connections (sendmail)

Related Links
Articles on Sendmail Also by Jason Contact author If you have ever wanted to learn about Cisco Routers, check out my new book "Cisco Routers for the Small Business" - it's Cisco CLI for the Regular Guy!
Sponsors

File Attachment
virusrule.txt 0KB (228 bytes)