Re: [exim] Exim misses some attachments.

I mean "her solution" .. not "his solution" .. :( 
p.p. my english is worst, sorry. :)

      From: pencho kuncho <mkp_71@???>
 To: Exim-users <exim-users@???> 
 Sent: Thursday, December 17, 2015 10:47 PM
 Subject: Re: [exim] Exim misses some attachments.

I found that message from Lena to one of ours members and wil try his solution.

Insert into the beggining of Exim config:

check_rfc2047_length = false
acl_smtp_mime = acl_check_mime
begin acl
acl_check_mime:
  deny message = Windows-executable attachments forbidden
      condition = ${if def:sender_host_address}
      !authenticated = *
      log_message = forbidden attachment: filename=$mime_filename, \
                    content-type=$mime_content_type, recipients=$recipients
      condition = ${if or{\
                          {match{$mime_content_type}{(?i)executable}}\
                          {match{$mime_filename}{\N(?i)\.(exe|com|vbs|bat|pif\
    |scr|hta|js|cmd|chm|cpl|jsp|reg|vbe|lnk|dll|sys|btm|dat|msi|prf|vb)$\N}}\
                          }}

  deny message = A .zip attachment contains a Windows-executable file - \
                blocked because we are afraid of new viruses \
                not recognized [yet] by antiviruses.
      condition = ${if match{$mime_filename}{\N(?i)\.zip$\N}}
      condition = ${if def:sender_host_address}
      !authenticated = *
      decode = default
      log_message = forbidden binary in attachment: filename=$mime_filename, \
                    recipients=$recipients
      condition = ${if match{${run{/usr/local/bin/unzip -l \
                                    $mime_decoded_filename}}}\
                            {\N(?i)\n .+\.(zip|exe|com|vbs|bat|pif|scr|hta\
          |js|cmd|chm|cpl|jsp|reg|vbe|lnk|dll|sys|btm|dat|msi|prf|vb)\n\N}}

  accept

      From: Always Learning <exim@???>
 To: Exim <exim-users@???> 
 Sent: Thursday, December 17, 2015 8:45 PM
 Subject: Re: [exim] Exim misses some attachments.

On Thu, 2015-12-17 at 17:11 +0000, Jeremy Harris wrote:

> On 17/12/15 16:42, Always Learning wrote:
> >
> > warn demime    = ace:bat:btm:cab:chm:cmd:com:cpl:dat:dll:exe:hta: \
> >                    js:jsp:lnk:msi:pif:prf:reg:scr:sys:url:vbe:vbs

> At a guess, the acl_smtp_mime equivalent:
>
>  warn condition = ${if match {$mime_filename} \
>                      {\\.(ace|bat|btm|cab|chm|cmd|com|\
>                            cpl|dat|dll|exe|hta|\
>                            js|jsp|lnk|msi|pif|prf|reg|scr|\
>                            sys|url|vbe|vbs)\$}}
> >
> > .... et cetera.

Thank you. It looks correct.

> ... assuming you don't need the content of the file.

No. Being exclusively, and happily, Linux (Centos) for the last 6? years
we reject everything M$ except for word processing and spreadsheets.

Unlike some, we have the freedom to successfully reject spam and other
crap before ACL Data (and now ACL Mime) so this mime defence may never
be deployed.

Thanks again.




--
Regards,

Paul.
England, EU.      England's place is in the European Union.


--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/