[Snort-users] RE: [Snort-sigs] capture email

Ricardo Londono rlondono at ...10462...
Wed Nov 5 07:41:59 EST 2003


yeah... that does not work for me... :)

I turned that feature on a few months ago and it was scary!

I have 4,000 plus users who love their email!

Ricardo


>>> "Schmehl, Paul L" <pauls at ...6838...> 11/4/2003 11:23:49 AM >>>
> -----Original Message-----
> From: Snort [mailto:Snort at ...7941...] 
> Sent: Tuesday, November 04, 2003 10:35 AM
> To: Ricardo Londono
> Cc: Snort-users at lists.sourceforge.net 
> Subject: [Snort-users] RE: [Snort-sigs] capture email
> 
> You might want this option for postfix, have it bcc a new 
> e-mail box on your groupwise server and setup rules that will 
> delete all e-mails except those destined for your teacher or 
> coming from that suspected student.
> 
> The postfix always_bcc parameter is what you're looking for: 
> /usr/share/doc/packages/postfix/samples/sample-misc.cf: 
> 
> # The always_bcc parameter specifies an optional address that 
> # receives a copy of each message that enters the Postfix system, 
> # not including bounces that are generated locally. 
> # 
> always_bcc = 
> 
Oof dah!  Hope he has a very small user base or a very large hard
disk!

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 




More information about the Snort-users mailing list