Re: [exim] Trouble filtering attachments

Góra strony
Delete this message
Reply to this message
Autor: Lena
Data:  
Dla: exim-users
Temat: Re: [exim] Trouble filtering attachments
> From: Raymond Jette

> I'm having some trouble setting my EXIM to filter attachments correctly.
> I would like to extract all attachments and then make sure they do not
> contain any binaries. If they do EXIM should reject the message.


>   deny message = Attachment has unsupported file format inside zip file
>        demime = zip


> egrep -I '[.](bat|btm|cmd|com|cpl|dat|dll|exe|lnk|msi|pif|prf|reg|scr|vb|vbs)$' | \


Try (untested):

acl_smtp_mime = acl_check_mime
begin acl
acl_check_mime:
  deny message = A .zip attachment contains a Windows-executable file - \
                 blocked because we are afraid of new viruses \
                 not recognized [yet] by antiviruses.
       condition = ${if match{$mime_filename}{\N(?i)\.zip$\N}}
       condition = ${if def:sender_host_address}
       condition = ${if !def:sender_host_authenticated}
       decode = default
       log_message = forbidden binary in attachment: filename=$mime_filename, \
                     recipients=$recipients
       condition = ${if match{${run{/usr/local/bin/unzip -l \
                                    $mime_decoded_filename}}}\
                             {\N(?i)\.(exe|com|vbs|bat|pif|scr|hta|js\
           |cmd|chm|cpl|jsp|reg|vbe|lnk|dll|sys|btm|dat|msi|prf|vb)\n\N}}


  deny message = Windows-executable attachments forbidden because we are \
                 afraid of new viruses not recognized [yet] by antiviruses.
       condition = ${if def:sender_host_address}
       condition = ${if !def:sender_host_authenticated}
       log_message = forbidden attachment: filename=$mime_filename, \
                     content-type=$mime_content_type, recipients=$recipients
       condition = ${if or{\
                           {match{$mime_content_type}{(?i)executable}}\
                           {match{$mime_filename}{\N(?i)\.(exe|com|vbs|bat|pif\
    |scr|hta|js|cmd|chm|cpl|jsp|reg|vbe|lnk|dll|sys|btm|dat|msi|prf|vb)$\N}}\
                          }}


accept