[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] Customizing blocked email notification- g series sensors



You should be able to tune this with an advanced parameter -

Name: pam.email.smtp_reject_reason
Type: String
Value:  [message to display. see instructions below]
comment:  [anything]

This parameter describes the reason for the message being permanently 
rejected if Email bounce response has been enabled. By editing the Value 
of the parameter one can create a customized message to make is easier 
to track down why Email is being Non-delivered (e.g., contact information).

The beginning of the Value must include a RFC821 reject code. The 5XX 
series of codes should cause a permanent Non-delivery action on the 
sending mailserver, and the malicious Email will either be returned to 
message originator or locally discarded by the sending mailserver 
depending on it's configuration.

Default Value for pam.email.smtp_reject_reason:
541 Internet Security Systems' Proventia(TM) intrusion prevention 
appliance blocked forwarding of message.

If you wish the email server to not send a message to the sender at all, 
you can enter this for the advanced parameters, which is not guaranteed 
to work but was successful when testing it in our lab:
"250 Message accepted for delivery"

Klapot, Scott wrote:
> When an email is blocked by a signature the standard message below is
> sent to the enduser via the appliance. Is there a way to modify the
> message to include a descriptor or name of the appliance?
>
> There was a SMTP communication problem with the recipient's email
> server. Please contact your system administrator.
>
> <#5.5.0 smtp;541 Internet Security Systems' Proventia(TM) intrusion
> prevention appliance blocked forwarding of message.>
>
>  
>
> thanks,
>
> Scott
>
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxxxxxxxxxxx
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
>
> The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>
>
>   

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxxxxxxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.