First Match vs All Match

[Jerry Benton]

Hello,

So, I found out the hard way after much face-to-keyboard action that "Allow
Webbugs" is an "All Match" rule. So if I have this:

user at domain yes

acme.com disarm


If user at domain sends a web bug in an email it will be allowed. Unless of
course he sends it to acme.com where it will be denied. Well, this presents
a problem if you have a valid sender you wish to allow to send web bugs to
your domain while blocking all others.

So, does anyone know if All Match and First Match is a configurable item
for rule sets? I know it is not in the MailScanner.conf, but perhaps a pm
file could be modified?

[Kevin Miller]

Without seeing your actual rule file (in the MailScanner/rules directory) it's hard to say what you're doing, but I'd do this:

In MailScanner.conf
Allow Webbugs = %rules-dir%/webbugs.rules

In MailScanner/rules directory:
Filename: webbugs.rules

FromOrTo: user at domain.com yes
FromOrTo: *@differentdomain.com yes
FromOrTo: default disarm

This will let user at domain.com<mailto:user at domain.com> and all users at differentdomain.com send webbugs and disarm all others. You can also just use From: and/or To: as the first field as appropriate to your environment.

See the EXAMPLES (in the rules directory) file for more details...

...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: [phone], Fax: [phone]
Registered Linux User No: 307357
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton
Sent: Friday, October 04, 2013 12:29 PM
To: MailScanner discussion
Subject: First Match vs All Match

Hello,

So, I found out the hard way after much face-to-keyboard action that "Allow Webbugs" is an "All Match" rule. So if I have this:

user at domain yes

acme.com<http://acme.com> disarm


If user at domain sends a web bug in an email it will be allowed. Unless of course he sends it to acme.com<http://acme.com> where it will be denied. Well, this presents a problem if you have a valid sender you wish to allow to send web bugs to your domain while blocking all others.

So, does anyone know if All Match and First Match is a configurable item for rule sets? I know it is not in the MailScanner.conf, but perhaps a pm file could be modified?

--

--
Jerry Benton
Mailborder Systems
www.mailborder.com<http://www.mailborder.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131004/12ac3cbd/attachment.html

[Jerry Benton]

Kevin,

Thank you, but I think you missed the point. Perhaps I didn't explain it
well enough. I am aware how the rules work. The question is if Allow Match
can be altered to First Match because an All Match approach is not as
flexible.



On Fri, Oct 4, 2013 at 11:03 PM, Kevin Miller

Post by Kevin Miller
Without seeing your actual rule file (in the MailScanner/rules directory)
it?s hard to say what you?re doing, but I?d do this:****
** **
In MailScanner.conf****
Allow Webbugs = %rules-dir%/webbugs.rules****
** **
In MailScanner/rules directory:****
Filename: webbugs.rules****
** **
FromOrTo: user at domain.com yes****
FromOrTo: default disarm****
** **
This will let user at domain.com and all users at differentdomain.com send
webbugs and disarm all others. You can also just use From: and/or To: as
the first field as appropriate to your environment.****
** **
See the EXAMPLES (in the rules directory) file for more details?****
** **
...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: [phone], Fax: [phone]
Registered Linux User No: 307357 ****
mailscanner-bounces at lists.mailscanner.info] *On Behalf Of *Jerry Benton
*Sent:* Friday, October 04, 2013 12:29 PM
*To:* MailScanner discussion
*Subject:* First Match vs All Match****
** **
Hello,****
** **
So, I found out the hard way after much face-to-keyboard action that
"Allow Webbugs" is an "All Match" rule. So if I have this:****
** **
user at domain yes****
** **
acme.com disarm****
** **
** **
If user at domain sends a web bug in an email it will be allowed. Unless of
course he sends it to acme.com where it will be denied. Well, this
presents a problem if you have a valid sender you wish to allow to send web
bugs to your domain while blocking all others.****
** **
So, does anyone know if All Match and First Match is a configurable item
for rule sets? I know it is not in the MailScanner.conf, but perhaps a pm
file could be modified?
****
** **
-- ****
--****
Jerry Benton****
Mailborder Systems
www.mailborder.com****
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!