	FML Security Advisory 1999-003: melissa
	========================================

Topic:	Melissa Macro Virus

			Ken'ichi Fukamachi <fukachan@sapporo.iij.ad.jp>

	Copyright (C) 1999 Ken'ichi Fukamachi
		All rights reserved.

[Abstract]

What is Melissa?

	http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html

-------------------------
------------------------------------------------------------
I	Filtering

1	Filtering Function
1.1	FML Filtering
1.2	use "makefml config"
1.3	write cf 
1.4	write config.ph
1.5	make secure

2	Add a new filtering rule
2.1	cf
2.2	config.ph

3	How MTA rejects
3.1	sendmail
II	Considerations

4	Further investigations
------------------------------------------------------------

-------------------------

See INSTALL manual for more details on how to configure fml.

	http://www.fml.org/fml/INSTALL/

I	Filtering

1	Filtering Function

1.1	FML Filtering

Fml has filtering mechanism based on mail header and body after fml
2.2 (2.2 officially but fml 2.1 current unofficially). You can
deny/reject mail with some patterns. If you can find
$USE_DISTRIBUTE_FILTER in fml source, the version has filtering
function.

In default fml filtering is off. Firstly you should turn on it. 
Consider elena ML hereafter as an example.

To enable filtering function, you can do one of the following methods
which are the same. Please use one you are familliar with.

1.2	use "makefml config"

   "makefml config elena" -> security -> USE_DISTRIBUTE_FILTER -> "y" (yes)

1.3	write cf 

Write

   USE_DISTRIBUTE_FILTER 1

and run to remake config.ph

	% make config.ph

1.4	write config.ph

   $USE_DISTRIBUTE_FILTER = 1;

1.5	make secure

To enable all typical security options, run

   % cd /var/spool/ml/elena
   % make secure

2	Add a new filtering rule

The following ruels are the same. Please use one you are familliar with.

2.1	cf

To add the rule to "cf", 

&DEFINE_FIELD_PAT_TO_REJECT("Subject", ".*Important Message From .*");

run to remake config.ph

	% make config.ph

2.2	config.ph

&DEFINE_FIELD_PAT_TO_REJECT("Subject", ".*Important Message From .*");

3	How MTA rejects

3.1	sendmail

	http://www.sendmail.com/blockmelissa.html

	ftp://ftp.cert.org/pub/cert_advisories/Patches/CA-99-04-sendmail-melissa-filter.txt

II	Considerations

4	Further investigations

Hmm, could we make filtering rule collection?

