By default all incoming email at Green Apple is scanned for spam. If an email is determined to be spam, the tag "{Spam?}" is added to the subject line. You can use this to write message rules in your email program directing the spam to its own folder, greatly lowering the volume of email in your Inbox.

Also by default, all incoming email attachments are scanned for viruses, spyware, and phish (scam emails). Such attachments are stripped from the email and the tag "{Virus?}" is added to the subject line. As with spam, you can easily write message rules, keying off the tag, to direct the emails away from your Inbox.

While our Email Protection System is very effective, we do not guarantee that it will detect all spam, viruses, spyware, and phish. Moreover, email is only one mechanism for their transference. All users should use good sense and exercise caution when using the Internet; keep backups; have the necessary hardware and software in place to protect your computer and its data, learn how to use them all correctly, and keep them up-to-date -- these are just some of the guidelines to keep in mind in order to use the Internet securely.

The remainder of this document gives further information about the Email Protection System and the settings you can use to control your email.

Mailbox Filters

Green Apple's Email Protection System is implemented as filters on a mailbox which are applied to incoming email and trigger an action when the criteria of the filter is met. The following filters and actions are supported:

Filter	Filter Description	Action	Action Description
spam	Email is scanned using SpamAssassin, Realtime Block Lists (RBLs), Spam URI Realtime Block Lists (SURBLs), and locally maintained Block Lists.	allow	Allow spam.
		tag	Add "{Spam?}" to the subject line.
		bounce	Bounce the email back to the sender.
		delete	Delete the email (silently discard it).
virus	Email attachments are scanned using MailScanner and ClamAV for viruses, spyware, and phish (scam emails).	allow	Allow viruses, spyware, and phish.
		strip	Add "{Virus?}" to the subject line. Add three lines similar to the following to the start of the message body:     Warning: This message has had one or more         attachments removed     Warning: (mail_7420.scr).     Warning: Please read the "GreenApple-            Attachment-Warning.txt"... Add an attachment with more information.
		delete	Delete the email (silently discard it).
suspect attachments	Email is scanned by MailScanner for attachments with extensions common to Windows, but not commonly used in email except by viruses.	allow	Allow suspect attachments.
		strip	Strip suspect attachments from email.
html	Email is scanned by MailScanner for HTML appearing in the message body.	allow	Allow html in the body of email.
		strip	Strip html from the body of email.

Setting Up A Mailbox Filter

A mailbox (also called a pop account) is a server account, secured by a login and password, which keeps email for a user. On Green Apple a mailbox will exist for your login account and for any domain logins or additional mailboxes you may have. By default, mailboxes are spam tagged and virus stripped.

You can set up your own mailbox filters through the "Email Maintenance" section of My Account by combining a mailbox with a tag indicating the filter and action to take. The available tags are

Filter / Action	Individual Tag	All Tag
allow spam	@spam	@spamall
check for spam and tag	@spamtag	@spamtagall
check for spam and bounce	@spambounce [formerly, @antispam]	@spambounceall [formerly, @allantispam]
check for spam and delete	@spamdel	@spamdelall
allow viruses, spyware, and phish	@virus	@virusall
check for viruses, spyware, and phish and strip	@virusstrip	@virusstripall
check for viruses, spyware, and phish and delete email	@virusdel	@virusdelall
allow suspected file attachments	@suspect	@suspectall
check for suspect attachments and strip	@suspectstrip	@suspectstripall
allow html in the message body	@html	@htmlall
strip html from message body	@htmlstrip	@htmlstripall

An "Individual Tag" applies the filter to the mailbox only. An "All Tag" applies the filter to the mailbox and, if the mailbox is a login account, to all domain logins and additional mailboxes owned by the account -- in which case an alternative filter may be applied to a particular domain login or additional mailbox by setting up a filter on it.

Consider the login account "joe" having the additional mailboxes of "betty", "john", and "mike". Suppose "joe" wanted to set filters a) bouncing spam for all mailboxes except "betty", who would receive spam tagged and b) deleting viruses for all mailboxes except "mike", who would not have his email scanned for viruses. The following four filters would do the trick: joe@spambounceall, joe@virusdelall, betty@spamtag, mike@virus.

Suspect Attachments

Choosing to strip suspect attachments from email provides enhanced security against viruses. The downside is that an attachment may be legitimate, but meets the suspect qualifications. Although this should be very rare, our current policy is to have suspect attachment stripped on a per user basis and not via a system-wide default.

The following extensions are deemed suspect:

Extension	Description
.bat	Microsoft batch file.
.ceo	Used by "WinEvar" virus.
.chm	Microsoft compiled help file. See http://office.microsoft.com/2000/articles/Out2ksecFAQ.htm
.cmd	Microsoft batch file.
.cnf	Microsoft speeddial script.
.com	Microsoft executable file.
.cpl	Microsoft control panel item.
.hta	Microsoft HTML archive.
.ins	Microsoft Internet communication setting.
.jse	Microsoft JScript file.
.job	Microsoft task scheduler.
.lnk	Eudora *.lnk security hole.
.ma[dfgmqrstvw]	Microsoft access files.
.mhtml	Eudora meta-refresh attack.
.pif	MS-Dos program shortcut.
.reg	Microsoft Windows registry.
.scf	Microsoft Windows Explorer command.
.scr	Microsoft screensaver file.
.sct	Microsoft Windows Script Component.
.shb	Microsoft document shortcut.
.shs	Microsoft Shell Scrap Object.
.vb[es]	Microsoft Visual Basic scripts.
.ws[cfh]	Microsoft Windows Script Host.
.xnk	Microsoft Exchange Shortcut.

In addition, files with names resembling Microsoft CLSIDs, containing many white spaces, or that are very long are considered suspect.