🚀 go-pugleaf

> Hi Ben.
>
>    If I understand you correctly, your McAfee product generated a XML file
> that your firewall/filter understood. I can't think of a product that
> generates that file format, but like you said, it's only XML and therefore
> easily reproducible. Is XML the only format your firewall/filter
> understands? Can it also import regular old everyday lists of email
> addresses?
>
>    Also, what do you do about email addresses that are forged? Do you just
> assume that the victims of the forgery will never send an email to 
> you/your
> co.? Do you also assume that the spammer will continue to use that forged
> email address? I'm not badgering your method of filtering. I'm just trying
> to understand the goal.
>
>    Anyways, I think you're gonna be stuck making your own. I have a
> suggestion though. If you're willing to make a web page that users will 
> log
> on to add the addresses, then maybe you can bypass that part and make a
> script or program that reads a mailbox. Have your users send the email
> addresses in an email to that box. The script checks the box periodically
> and generates the list from that.
>
> for example (per your example), the user can send an email to
> BLOCKthisBASTARD@domain with a list of just the email addresses to block 
> or
> allow like this:
>
> B badperson@baddomain
> B anotherbaduser@anotherbaddomain
> A agooduser@anicedomian
> B someScume@aCreepyDomain
>
>    Then your script would read B for block and A for allow. If I 
> understand
> the xml you provided, then Mailbox name refers to the local user that 
> wants
> to do the blocking. In that case, just have them send the list from that
> mailbox and your script will know what box to apply the rule to.
>
>    Now, depending on whether your filter can take just plain lists, you 
> can
> easily parse this into straight lists. Or, if your filter can only
> understand the xml, then you can still supply that from this input. Still
> that all depends on if my assumptions about your setup is correct.
>
>    You mentioned that your firewall/filter can "check against a 
> white/black
> list server". Are you meaning a dns type server?
>
> lemme know.
> -Dr.X
> PS: Please don't top post your replies. It makes it difficult to follow a
> conversation if one of us posts at the top and the other posts at the
> bottom. The general rule is to bottom post and/or insert where 
> appropriate.
> Thanks.
>

Hi Dr. X,

I was looking more into the McAfee product yesterday after my reply.  I was 
only partly correct about the XML file, what appears to happen, is the 
firewall reads a url, in this case an internal server hosting the mcafee 
list server, what it reads is a .dll file, that creates the XML document. 
Now each mailbox has a directory under the McAfee product program files 
folder, i.e. joe.bloggs@DOMAIN under this directory are a few files, config 
(contains mailbox owner & email address), allowRecipient, AllowSender, 
denyRecipient, and denySender (no file extensions). What happens it it opens 
each file, and creates the XML output based on the contents of these files.

If this is the case, then it still shouldn't be too difficult to write some 
code that will create/edit these files based on the users mailbox. I like 
your idea of having a specific mailbox that people can send email address to 
and have a script that process those emails. If I can't get McAfee working I 
will definatly look into setting up a system like that, I could even have 2 
address whitelist@ourdomain.com and blacklist@ourdomain.com or allow@... and 
block@... (if you only have one you just know that one user is going to 
forget to add the A or B in from of the addresses, or end up blocking people 
they want to allow).

What most people in our company want is not so much a blacklist but just a 
whitelist, mainly because our spam filter catches some false positives, so 
people (especially sales & marketing) just want to be able to add email 
addresses that never get filtered out. A blacklist may be used a bit, but 
only from persistant spammer (i.e. I get 3 or 4 emails every day from some 
guy called Stephen Cooper offering trade stocks, no matter how much I try 
and unsubscribe).

I looked more at the McAfee product code yesterday, to see if I could find 
what the problem was (McAfee support have been working on this for 8 weeks). 
When I add a mailbox in the form of "joe.bloggs@DOMAIN" it says the owner is 
in valid. Now tracing the code through I found a file called 
mailboxpicker.js that appears to validate the mailbox owner & email address 
format. In that validate function is a line that reads "var rx = 
/^[\-_a-zA-Z0-9]+(\\|\@)[\-_a-zA-Z0-9]+$/" it seems that this would only 
validat a mailbox owner if the username contains alphanumerical characters, 
hyphens & underscores, but not periods. However by adding a period to the 
allowed strings, it should mean that a mailbox owner with a period in the 
username is now valid too.

I have added the period, and just need to test the product again. I have 
emailed McAfee support with the possible solution, so we'll see what they 
say. (Can't believe it's taken them over 8 weeks, when I managed to find a 
possible solution in under 8 hours!).

If this fix works great, if not I'll setup a mailbox like you suggested, and 
have a script process emails people send to it!

Ben

P.S. Sorry about the TP, I usually don't but forgot yesterday, damn outlook 
express!