共236篇文章。
Finally I have built it and deployed it. Apparantly, it DOES NOT WORK(detects spams correctly, but did not take any actions!), but I hope the virus filter will be working, as the viruses are growing too fast.
It appears that there are more and more limitations applied to forums because the election happening in Taiwan. Recently, one of my friend (Sarah Lau) has been deprived board management privilege at the NetEase Beijing Community because she has some saying which is considered to be harmful.
With more and more aaazzz’s received on beastie.frontfree.net, it makes me to seriously consider the possiblity to set up a set of early filter on postfix.
From my statistics on beastie.frontfree.net, the winner is Worm.SomeFool family.
There are two common way to process unaccepted letters: One is bounce, a.k.a. give the sender a message saying “Your letter is bounced.” Another is discard, in other words, drop the letter silently.
It’s really necessary to train a new security officer lead for Frontfree, if I must leave the campaus. While it will be reasonable if I will invest some of my time maintaing the server, they must deal some real-world problems theirselves, as I may be unable to reach these boxes in time.
Gibe is still the first place, and MyDoom(here, it was called Worm.SCO.A) drastically dropped down.
beastie# bzcat maillog.0.bz2 | grep INFECT | awk ‘{print $8;}’ | sort | uniq -c | sort -rn
181 (Worm.Gibe.F),
86 (Worm.SCO.A),
2 (Worm.Dumaru.Y),
1 (Worm.Sobig.F),
Gibe and its variants are still dominant, and MyDoom is approaching to catch up:
beastie# cat drwebd.log | grep infect | grep MyDoom | wc -l
243
beastie# cat drwebd.log | grep infect | grep Gibe | wc -l
257
beastie# cat drwebd.log | grep infect | grep -v Gibe | grep -v MyDoom | wc -l
0
It’s interesting that there’s no viruses without a name “Gibe” nor “MyDoom”…