File Attachment Rules

[Jim Holland]

On Thu, 24 Aug 2006, Colin Jack wrote:

> Putting it in the MailScanner.conf direct seems to work ... except that
> I now have a heckova long line.
> 
> Would be tidier if I could get a ruleset working .. how does everybody
> else do it?
> 
> Thanks
> 
> Colin

Remember that there are now two separate mechanisms for managing file 
names and file types:

(a) Default configuration files:

Filename Rules = %etc-dir%/filename.rules.conf
Filetype Rules = %etc-dir%/filetype.rules.conf

These are not normal rulesets, so are in the Configuration directory not 
the Rules directory.  They set the basic system-wide policy for acceptance 
and rejection, and the error notices that are issued when files are 
blocked.

(b) The allow and deny rules which can be rulesets, and which override the 
above configuration files if a match is found:

Allow Filenames =
Deny Filenames =

I would start by editing the filename.rules.conf and filetype.rules.conf
files if you want to change the overall defaults and then set up the
ruleset files:

Allow Filenames = %rules-dir%/filename_allow.rules
Deny Filenames = %rules-dir%/filename_deny.rules

So then instead of putting all the filenames in a line in
MailScanner.conf, you can put them in the above two rulesets, and also
customise them for individual users, eg:

filename_allow.rules:

	To:		*@*		\.pdf$ \.zip$ \.jpg$ \.eps$ \.ico$ \.ai$ \.qxd$ \.tif$
	FromOrTo:	root at domain	\.exe$ \.com$

	# Default (whitelist nothing)
	FromOrTo:	default

and if the lines are too long I guess you could split them, although I 
haven't tested this, eg:

	To:		*@*		\.pdf$ \.zip$ \.jpg$ \.eps$
	To:		*@*		\.ico$ \.ai$  \.qxd$ \.tif$
	
and for filename_deny.rules:

	To:     user1 at mango.zw		\.gif$ \.jpg$
	To:     user2 at mango.zw		\.gif$ \.jpg$ \.pdf$ \.xls$ \.mid$ \.pps$ \.doc$

	# Default (block nothing)
	FromOrTo:       default

Finally, if you want full control, you can do it the old way:

Filename Rules = %rules-dir%/filename.rules
Filetype Rules = %rules-dir%/filetype.rules

and then in these files you can specify individual configuration files by 
user, eg:

filename.rules:

	# List of users allowed to send any filenames
	From:	user1 at mango.zw		%etc-dir%/filename.rules.allowall.conf

	# Users sending anything between each other
	From:	user2 at mango.zw and To: user3 at mango.zw	%etc-dir%/filename.rules.allowall.conf
	From:	user3 at mango.zw and To: user2 at mango.zw	%etc-dir%/filename.rules.allowall.conf

	# Customised settings
	To:	user4 at mango.zw	%etc-dir%/filename.rules.user4.conf

	# Default
	FromOrTo:	default		%etc-dir%/filename.rules.conf

and similarly for filetype.rules.
	
All of these configuration files will have the same type of format as the 
original default %etc-dir%/filename.rules.conf and %etc-dir%/filetype.rules.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service
 
> Julian Field Wrote: 
> > Try removing the rules file and putting them straight on the 
> > config line, so you will have allowfilenames  = \.pdf$ \.zip$ 
> > \.jpg$ \.eps$ \.ico$ \.ai$ \.qxd$ \.tif$
> > 
> > Colin Jack wrote:
> > > Hi Julian,
> > >
> > > Still not working ... people complaining it won't allow .ico files 
> > > through.
> > >
> > > In MailScanner.conf I have:
> > >
> > > Allow Filenames = %rules-dir%/filenames.rules
> > >
> > > In the /rules directory I have a file called 
> > filenames.rules with this 
> > > entry
> > >
> > > FromOrTo: default \.pdf$ \.zip$ \.jpg$ \.eps$ \.ico$ \.ai$ \.qxd$ 
> > > \.tif$
> > >
> > >
> > > I have restarted MailScanner
> > >
> > > Any ideas
> > >
> > > Thanks
> > >
> > > Colin
> > >
> > >   
> > >> -----Original Message-----
> > >> From: mailscanner-bounces at lists.mailscanner.info
> > >> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
> > >> Colin Jack
> > >> Sent: 23 August 2006 09:41
> > >> To: MailScanner discussion
> > >> Subject: RE: File Attachment Rules
> > >>
> > >> Sorry Julian - I meant
> > >>
> > >> FromOrTo: *@* \.zip$
> > >>
> > >> etc.
> > >>
> > >>
> > >>
> > >>     
> > >>> -----Original Message-----
> > >>> From: mailscanner-bounces at lists.mailscanner.info
> > >>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of 
> > >>> Julian Field
> > >>> Sent: 23 August 2006 09:21
> > >>> To: MailScanner discussion
> > >>> Subject: Re: File Attachment Rules
> > >>>
> > >>>
> > >>>
> > >>> Colin Jack wrote:
> > >>>       
> > >>>> I'm a newbie to MailScanner, so please be gentle ...
> > >>>>
> > >>>> I want to create a ruleset for Allow Filenames but am not
> > >>>>         
> > >>> sure of the
> > >>>       
> > >>>> syntax
> > >>>>
> > >>>> If I edit MailScanner.conf then I use
> > >>>>
> > >>>> Allow Filenames = /.pdf$ /.zip$ etc.
> > >>>>
> > >>>>         
> > >>> They should \ and not /
> > >>>       
> > >>>> If however I change that to
> > >>>>
> > >>>> Allow Filenames = %ruledir%/filenames.rules
> > >>>>
> > >>>>         
> > >>> %rules-dir% not %ruledir%
> > >>>       
> > >>>> then create a filenames.rules file do I just put
> > >>>>
> > >>>> /.pdf$
> > >>>> /.zip$
> > >>>> /.ico$
> > >>>>
> > >>>>
> > >>>> in the rules file or do I have to put in other stuff?
> > >>>>
> > >>>>         
> > >>> In the filename.rules file you need to put rules that would like
> > >>>
> > >>> From: user1 at domain.com \.pdf$ \.zip$ \.ico$
> > >>> To: *@domain2.com \.pdf$
> > >>> FromOrTo: abuse at domain.com .
> > >>>
> > >>> This would
> > >>> 1) Allow *.pdf *.zip *.ico in mail from the address 
> > user1 at domain.com
> > >>> 2) Allow *.pdf in mail to anyone at domain2.com
> > >>> 3) Allow everything ('.' matches any character and so will
> > >>>       
> > >> match every
> > >>     
> > >>> filename) in mail from or to abuse at domain.com.
> > >>>
> > >>>
> > >>>       
> > >>>> Thanks
> > >>>>
> > >>>> Colin
> > >>>>
> > >>>>