Subject: virus filters for mailing lists hosted by ietf.org

From: Andy Bierman <[email-masked]>
Date: Thu, 18 Apr 2002 00:22:53 -0700

Hi,

The number of virus emails sent to WG mailing lists keeps increasing.
The perpetrators are routinely spoofing 'From' fields to bypass
filters that check that field for list members only.  It would
be really helpful if the SW checked for viruses instead of simply
passing the virus on to 100's or 1000's of recipients.

I run the [email-masked] and [email-masked] lists, and I've asked
several times for a simple filter to drop any incoming email containing
a binary attachment. I've been told this is not possible.  I think
it's time for the IETF to rethink this decision, and figure out a way
to filter email containing viruses.

thanks,
Andy

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 18 Apr 2002 11:23:13 +0200

Andy,

Assuming you're using mailman...

I have the maximum message size set to 25k for the diffserv list. That
catches most of the bad stuff, and keeping even desirable postings
down in size is quite a relief too.

I know it isn't ideal, but it is much better than nothing.

    Brian

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 18 Apr 2002 06:45:06 -0700

At 12:22 AM -0700 4/18/02, Andy Bierman wrote:
>a binary attachment. I've been told this is not possible.

Whoever told you that is completely wrong. It is very possible, but 
probably not yet set up at the IETF. A pre-processor that checks the 
MIME structure of incoming messages can strip out all types of MIME 
body parts not wanted. There is ample freeware to do this today.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 18 Apr 2002 10:09:17 -0500

No it is not impossible. We are using InterScan Viruswall, from Trend.
http://www.antivirus.com/products/isvw/

We run this on Solaris and some other platforms. Seams to work well.
Actually caught a virus designed for the ietf-krb-wg list today!

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Bill Fenner <[email-masked]>
Date: Thu, 18 Apr 2002 09:18:17 -0700

We have to be very careful about software like this -- one place that I
had an email account was using software that subtly munged MIME messages
passing through it, even if there was no virus.  People were mysteriously
getting 14k empty messages, because of the MIME munging.  If this kind
of problem suddenly affected everyone on the mailing list, that would
be a much bigger problem.

  Bill

---

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 18 Apr 2002 12:14:31 -0500

> be a much bigger problem.

All of the mail to that system goes through th virus scanner, no just the 
IETF mailing list. So far we have not had any problems like you have seen. 

--