Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Problem with @banned_files_lovers_maps...
36 views
Skip to first unread message
Klaus Tachtler
Mar 20, 2012, 3:10:32 AM3/20/12
to
Hello List,
we dont want to have exe send via e-mail, but sometimes it is
necassary to get some on a special e-Mail address. BUT when configured
@banned-files_lovers_maps with this special address
(speci...@ourdomain.tld), the e-Mail was deliverd, BUT the
attachment was NOT? But in this case, we need the attachment.
We have defined following in our /etc/amavisd.conf,
--- SNIP ---
...
@banned_files_lovers_maps = (
{ 'speci...@ourdomain.tld' => 1,
} );
...
$final_banned_destiny = D_REJECT;
...
qr'^\.(exe|lha|cab|dll)$', # banned file(1) types
...
--- SNIP ---
Please, can someone help us, what is our fault?
Some experimens with $bypass_decode_parts = 1; - passes all exe, and
not needed files to all the users...
--> amavisd -V
--> amavisd-new-2.6.6 (20110518)
Thank you,
Klaus.
--
------------------------------------------------
e-Mail : kl...@tachtler.net
Homepage: http://www.tachtler.net
DokuWiki: http://www.dokuwiki.tachtler.net
------------------------------------------------
we dont want to have exe send via e-mail, but sometimes it is
necassary to get some on a special e-Mail address. BUT when configured
@banned-files_lovers_maps with this special address
(speci...@ourdomain.tld), the e-Mail was deliverd, BUT the
attachment was NOT? But in this case, we need the attachment.
We have defined following in our /etc/amavisd.conf,
--- SNIP ---
...
@banned_files_lovers_maps = (
{ 'speci...@ourdomain.tld' => 1,
} );
...
$final_banned_destiny = D_REJECT;
...
qr'^\.(exe|lha|cab|dll)$', # banned file(1) types
...
--- SNIP ---
Please, can someone help us, what is our fault?
Some experimens with $bypass_decode_parts = 1; - passes all exe, and
not needed files to all the users...
--> amavisd -V
--> amavisd-new-2.6.6 (20110518)
Thank you,
Klaus.
--
------------------------------------------------
e-Mail : kl...@tachtler.net
Homepage: http://www.tachtler.net
DokuWiki: http://www.dokuwiki.tachtler.net
------------------------------------------------
Michael Scheidell
Mar 20, 2012, 7:55:42 AM3/20/12
to
On 3/20/12 3:10 AM, Klaus Tachtler wrote:
Hello List,
we dont want to have exe send via e-mail, but sometimes it is necassary to get some on a special e-Mail address. BUT when configured @banned-files_lovers_maps with this special address (speci...@ourdomain.tld), the e-Mail was deliverd, BUT the attachment was NOT? But in this case, we need the attachment.
We have defined following in our /etc/amavisd.conf,
look elsewhere.
amavisd-new does not strip out attachments, google for this. some people have asked to be able to get amavisd-new to strip out the attachment and just deliver the email without the attachment. amavisd-new does not have any code that would enable it to do this.
Since it can't strip out attachments, then it didn't strip out the attachment.
These are not the droids you are looking for.
This email has been scanned and certified safe by SpammerTrap®.
amavisd-new does not strip out attachments, google for this. some people have asked to be able to get amavisd-new to strip out the attachment and just deliver the email without the attachment. amavisd-new does not have any code that would enable it to do this.
Since it can't strip out attachments, then it didn't strip out the attachment.
These are not the droids you are looking for.
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
> | SECNAP Network Security Corporation
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
> | SECNAP Network Security Corporation
- Best Mobile Solutions Product of 2011
- Best Intrusion Prevention Product
- Hot Company Finalist 2011
- Best Email Security Product
- Certified SNORT Integrator
This email has been scanned and certified safe by SpammerTrap®.
For Information please see
http://www.spammertrap.com/
Klaus Tachtler
Mar 20, 2012, 9:59:28 AM3/20/12
to
Hello Michael,
hello List,
so, we wonder a little bit, because when we set
$bypass_decode_parts = 1;
the we can GET the e-mail WITH attachment. If we doesn't set
$bypass_decode_parts, the we GET the e-mail WITHOUT the attachment.
The $bypass_decode_parts = 1; in conjunction with set
conjunction with amavis (controlling spamassassin and clamav), and the
mp3 (for example) we send, had no virus inside...
Any ideas?
> On 3/20/12 3:10 AM, Klaus Tachtler wrote:
>> Hello List,
>>
>> we dont want to have exe send via e-mail, but sometimes it is
>> necassary to get some on a special e-Mail address. BUT when
>> configured @banned-files_lovers_maps with this special address
>> (speci...@ourdomain.tld), the e-Mail was deliverd, BUT the
>> attachment was NOT? But in this case, we need the attachment.
>>
>> We have defined following in our /etc/amavisd.conf,
> look elsewhere.
> amavisd-new does not strip out attachments, google for this. some
> people have asked to be able to get amavisd-new to strip out the
> attachment and just deliver the email without the attachment.
> amavisd-new does not have any code that would enable it to do this.
>
> Since it can't strip out attachments, then it didn't strip out the
> attachment.
>
> These are not the droids you are looking for.
>
>
> --
> Michael Scheidell, CTO
Thank you
hello List,
so, we wonder a little bit, because when we set
$bypass_decode_parts = 1;
the we can GET the e-mail WITH attachment. If we doesn't set
$bypass_decode_parts, the we GET the e-mail WITHOUT the attachment.
The $bypass_decode_parts = 1; in conjunction with set
@banned_files_lovers_maps = (
{ 'speci...@ourdomain.tld' => 1,
} );
We tried this e few minutes ago, and we only have postfix in
{ 'speci...@ourdomain.tld' => 1,
} );
conjunction with amavis (controlling spamassassin and clamav), and the
mp3 (for example) we send, had no virus inside...
Any ideas?
> On 3/20/12 3:10 AM, Klaus Tachtler wrote:
>> Hello List,
>>
>> we dont want to have exe send via e-mail, but sometimes it is
>> necassary to get some on a special e-Mail address. BUT when
>> configured @banned-files_lovers_maps with this special address
>> (speci...@ourdomain.tld), the e-Mail was deliverd, BUT the
>> attachment was NOT? But in this case, we need the attachment.
>>
>> We have defined following in our /etc/amavisd.conf,
> look elsewhere.
> amavisd-new does not strip out attachments, google for this. some
> people have asked to be able to get amavisd-new to strip out the
> attachment and just deliver the email without the attachment.
> amavisd-new does not have any code that would enable it to do this.
>
> Since it can't strip out attachments, then it didn't strip out the
> attachment.
>
> These are not the droids you are looking for.
>
>
> --
> Michael Scheidell, CTO
Mark Martinec
Mar 20, 2012, 11:50:01 AM3/20/12
to
Klaus,
> so, we wonder a little bit, because when we set
>
> $bypass_decode_parts = 1;
>
> the we can GET the e-mail WITH attachment. If we doesn't set
> $bypass_decode_parts, the we GET the e-mail WITHOUT the attachment.
>
> The $bypass_decode_parts = 1; in conjunction with set
> @banned_files_lovers_maps = (
> { 'speci...@ourdomain.tld' => 1,
> } );
>
> We tried this e few minutes ago, and we only have postfix in
> conjunction with amavis (controlling spamassassin and clamav),
> and the mp3 (for example) we send, had no virus inside...
This is most unusual. As Mihael said, amavisd does not
modify mail body. The only exception to that is if you have
defanging enabled. In this case amavisd can call external
programs like altermime or Anomy::Sanitizer or use a very
simple built-in sanitizer. The altermime or Anomy::Sanitizer
are capable of stripping attachments, but the built-in
sanitizer cannot, it can only wrap the original mail body in an
extra level of MIME structure (pushes it to an attachment).
If you do not have defanging through altermime or Anomy::Sanitizer
enabled, then I don't see how you could get the results you see.
Perhaps some further mail processing at delivery time or in a MUA
is used. Or maybe the attachent is still there but perhaps a MIME
structure got botched somehow. Checking the log at level 5 may
provide some answers.
Mark
> so, we wonder a little bit, because when we set
>
> $bypass_decode_parts = 1;
>
> the we can GET the e-mail WITH attachment. If we doesn't set
> $bypass_decode_parts, the we GET the e-mail WITHOUT the attachment.
>
> The $bypass_decode_parts = 1; in conjunction with set
> @banned_files_lovers_maps = (
> { 'speci...@ourdomain.tld' => 1,
> } );
>
> We tried this e few minutes ago, and we only have postfix in
> conjunction with amavis (controlling spamassassin and clamav),
> and the mp3 (for example) we send, had no virus inside...
modify mail body. The only exception to that is if you have
defanging enabled. In this case amavisd can call external
programs like altermime or Anomy::Sanitizer or use a very
simple built-in sanitizer. The altermime or Anomy::Sanitizer
are capable of stripping attachments, but the built-in
sanitizer cannot, it can only wrap the original mail body in an
extra level of MIME structure (pushes it to an attachment).
If you do not have defanging through altermime or Anomy::Sanitizer
enabled, then I don't see how you could get the results you see.
Perhaps some further mail processing at delivery time or in a MUA
is used. Or maybe the attachent is still there but perhaps a MIME
structure got botched somehow. Checking the log at level 5 may
provide some answers.
Mark
Andreas Schulze
Mar 21, 2012, 2:14:07 AM3/21/12
to
Am 20.03.2012 14:59 schrieb Klaus Tachtler:
> Any ideas?
You could use @debug_recipient_maps / @debug_sender_maps
to trace the difference when $bypass_decode_part is on or off.
--
Andreas Schulze
Internetdienste | P252
DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
> Any ideas?
You could use @debug_recipient_maps / @debug_sender_maps
to trace the difference when $bypass_decode_part is on or off.
--
Andreas Schulze
Internetdienste | P252
DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Dipl.-Kfm. Dr. Robert Mayr
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
Klaus Tachtler
Mar 21, 2012, 4:02:22 AM3/21/12
to
Hallo Mark,
thank you for your information, but we do not use alterMIME or any
similar programm to change something. From our yesterdays Test, this
is the message source of the e-Mail, please can you see something,
where the problem can occur?
---- message source start ----
Return-Path: <mic...@nausch.org>
X-Original-To: speci...@ourdomain.tld
Delivered-To: speci...@ourdomain.tld
Received: from mx11.ourdomain.tld (mx11.ourdomain.tld [172.25.10.169]) by
relay.ourdomain.tld (Postfix) with ESMTP id DF5A01F708D for
<speci...@ourdomain.tld>; Tue, 20 Mar 2012 14:55:52 +0100 (CET)
Received: from viruswallvz.ourdomain.tld (amavisvz.ourdomain.tld
[172.25.10.167]) by mx11.ourdomain.tld (Postfix) with ESMTP
id CC4B83FC87 for
<speci...@ourdomain.tld>; Tue, 20 Mar 2012 14:55:52 +0100 (CET)
X-Amavis-Modified: Mail body modified (defanged) - viruswallvz.ourdomain.tld
X-Virus-Scanned: amavisd-new at ourdomain.tld
X-Amavis-Alert: BANNED, message contains audio/mpeg,.dat,01 Test.mp3
Received: from mx11.ourdomain.tld ([172.25.10.169]) by
viruswallvz.ourdomain.tld
(viruswallvz.ourdomain.tld [172.25.10.167]) (amavisd-new,
port 10024) with
ESMTP id 3GTahVLQfNnf for <speci...@ourdomain.tld>; Tue,
20 Mar 2012 14:51:03 +0100
(CET)
X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5
NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_FROM_MX=-3.1; rate: -7.6
Received: from mx1.nausch.org (mx1.nausch.org [88.217.187.21]) (using TLSv1
with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate
requested) by mx11.ourdomain.tld (Postfix) with ESMTPS for
<sspeci...@ourdomain.tld>; Tue,
20 Mar 2012 14:51:01 +0100 (CET)
Received: from viruswall.dmz.nausch.org (localhost.localdomain [127.0.0.1])
by mx1.nausch.org (Postfix) with ESMTP id 66F0811587D0 for
<speci...@ourdomain.tld>;
Tue, 20 Mar 2012 14:50:58 +0100 (CET)
X-Virus-Scanned: amavisd-new at nausch.org
Received: from mx1.nausch.org ([127.0.0.1]) by viruswall.dmz.nausch.org
(amavis.nausch.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id
M4assf7QFjqb for <speci...@ourdomain.tld>; Tue, 20 Mar
2012 14:48:03 +0100 (CET)
Received: from [192.168.2.186] (ppp-93-104-67-124.dynamic.mnet-online.de
[93.104.67.124]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256
bits)) (No client certificate requested) by mx1.nausch.org
(Postfix) with
ESMTP for <speci...@ourdomain.tld>; Tue, 20 Mar 2012
14:48:03 +0100 (CET)
Message-ID: <4F688A91...@nausch.org>
Date: Tue, 20 Mar 2012 14:48:01 +0100
From: Michael Nausch <mic...@nausch.org>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.2) Gecko/20120216
Thunderbird/10.0.2
MIME-Version: 1.0
To: speci...@ourdomain.tld
Subject: test
Content-Type: multipart/mixed; boundary="------------010607060102020703080209"
X-Evolution-Source: imap://specialuser%40ourdo...@ourdomain.tld/
This is a multi-part message in MIME format.
--------------010607060102020703080209
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
test
--------------010607060102020703080209
--------------010607060102020703080209--
---- message source end ----
Thank you, for your help!
thank you for your information, but we do not use alterMIME or any
similar programm to change something. From our yesterdays Test, this
is the message source of the e-Mail, please can you see something,
where the problem can occur?
---- message source start ----
Return-Path: <mic...@nausch.org>
X-Original-To: speci...@ourdomain.tld
Delivered-To: speci...@ourdomain.tld
Received: from mx11.ourdomain.tld (mx11.ourdomain.tld [172.25.10.169]) by
relay.ourdomain.tld (Postfix) with ESMTP id DF5A01F708D for
<speci...@ourdomain.tld>; Tue, 20 Mar 2012 14:55:52 +0100 (CET)
Received: from viruswallvz.ourdomain.tld (amavisvz.ourdomain.tld
[172.25.10.167]) by mx11.ourdomain.tld (Postfix) with ESMTP
id CC4B83FC87 for
<speci...@ourdomain.tld>; Tue, 20 Mar 2012 14:55:52 +0100 (CET)
X-Amavis-Modified: Mail body modified (defanged) - viruswallvz.ourdomain.tld
X-Virus-Scanned: amavisd-new at ourdomain.tld
X-Amavis-Alert: BANNED, message contains audio/mpeg,.dat,01 Test.mp3
Received: from mx11.ourdomain.tld ([172.25.10.169]) by
viruswallvz.ourdomain.tld
(viruswallvz.ourdomain.tld [172.25.10.167]) (amavisd-new,
port 10024) with
ESMTP id 3GTahVLQfNnf for <speci...@ourdomain.tld>; Tue,
20 Mar 2012 14:51:03 +0100
(CET)
X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5
NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_FROM_MX=-3.1; rate: -7.6
Received: from mx1.nausch.org (mx1.nausch.org [88.217.187.21]) (using TLSv1
with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate
requested) by mx11.ourdomain.tld (Postfix) with ESMTPS for
<sspeci...@ourdomain.tld>; Tue,
20 Mar 2012 14:51:01 +0100 (CET)
Received: from viruswall.dmz.nausch.org (localhost.localdomain [127.0.0.1])
by mx1.nausch.org (Postfix) with ESMTP id 66F0811587D0 for
<speci...@ourdomain.tld>;
Tue, 20 Mar 2012 14:50:58 +0100 (CET)
X-Virus-Scanned: amavisd-new at nausch.org
Received: from mx1.nausch.org ([127.0.0.1]) by viruswall.dmz.nausch.org
(amavis.nausch.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id
M4assf7QFjqb for <speci...@ourdomain.tld>; Tue, 20 Mar
2012 14:48:03 +0100 (CET)
Received: from [192.168.2.186] (ppp-93-104-67-124.dynamic.mnet-online.de
[93.104.67.124]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256
bits)) (No client certificate requested) by mx1.nausch.org
(Postfix) with
ESMTP for <speci...@ourdomain.tld>; Tue, 20 Mar 2012
14:48:03 +0100 (CET)
Message-ID: <4F688A91...@nausch.org>
Date: Tue, 20 Mar 2012 14:48:01 +0100
From: Michael Nausch <mic...@nausch.org>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.2) Gecko/20120216
Thunderbird/10.0.2
MIME-Version: 1.0
To: speci...@ourdomain.tld
Subject: test
Content-Type: multipart/mixed; boundary="------------010607060102020703080209"
X-Evolution-Source: imap://specialuser%40ourdo...@ourdomain.tld/
This is a multi-part message in MIME format.
--------------010607060102020703080209
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
test
--------------010607060102020703080209
--------------010607060102020703080209--
---- message source end ----
Thank you, for your help!
0 new messages