Filetypes and filenames not being checked

[Dhawal Doshy]

DAve wrote:
> Dhawal Doshy wrote:
>> DAve wrote:
>>> DAve wrote:
>>>> Golden, James wrote:
>>>>> I'm pretty new to this MailScanner stuff, so this may be too 
>>>>> simple.  So
>>>>> please excuse me.  What about the file permissions on your
>>>>> filename.rules.conf or filetype.rules.conf? 
>>>>
>>>> I am in no position to question anyone's suggestions ;^)
>>>>
>>>> bash-2.05b# ls -la
>>>> total 388
>>>> dr-xr-xr-x   7 root  cvs     1024 Jul 26 10:21 .
>>>> drwxr-xr-x  16 root  wheel   1024 Jul 25 09:04 ..
>>>> drwxr-xr-x   2 root  cvs      512 Aug  9  2004 CVS
>>>> -rw-r--r--   1 root  cvs    99589 Jul 26 10:21 MailScanner.conf
>>>> drwxr-xr-x   2 root  cvs      512 Jul 27 13:02 bayes
>>>> -r--r--r--   1 root  wheel  11426 Jun  4 13:27 country.domains.conf
>>>> -rw-r--r--   1 root  cvs      197 Jul 21 12:59 
>>>> filename.allow.rules.conf
>>>> -rw-r--r--   1 root  cvs     6851 Jul 21 12:51 filename.deny.rules.conf
>>>> -rw-r--r--   1 root  cvs      929 Jul 21 13:01 
>>>> filetype.allow.rules.conf
>>>> -rw-r--r--   1 root  cvs      921 Jul 21 12:51 filetype.deny.rules.conf
>>>> dr-xr-xr-x   2 root  cvs      512 Jul 21 16:44 mcp
>>>> -r--r--r--   1 root  wheel  14618 Jun  4 13:27 phishing.safe.sites.conf
>>>> drwxr-xr-x   2 root  cvs     2048 Jun  4 13:44 reports
>>>> dr-xr-xr-x   3 root  cvs      512 Jul 21 16:43 rules
>>>> -rw-r--r--   1 root  cvs     9692 Jul 21 16:15 spam.assassin.prefs.conf
>>>> -r--r--r--   1 root  cvs     2969 Feb 14  2005 spam.lists.conf
>>>> -r--r--r--   1 root  wheel   2969 Jun  4 13:27 spam.lists.conf.sample
>>>> -rw-r--r--   1 root  cvs     2834 Nov  2  2005 virus.scanners.conf
>>>>
>>>> bash-2.05b# ls -la rules
>>>> total 40
>>>> dr-xr-xr-x  3 root  cvs     512 Jul 21 16:43 .
>>>> dr-xr-xr-x  7 root  cvs    1024 Jul 26 10:21 ..
>>>> drwxr-xr-x  2 root  cvs     512 Aug  9  2004 CVS
>>>> -r--r--r--  1 root  wheel  2817 Jun  4 13:27 EXAMPLES
>>>> -r--r--r--  1 root  wheel  2964 Jun  4 13:27 README
>>>> -rw-r--r--  1 root  cvs      90 Jun  4 13:50 bounce.rules
>>>> -rw-r--r--  1 root  cvs    1743 Jun  6 18:40 highscore.delivery.rules
>>>> -rw-r--r--  1 root  cvs    1529 Jun  6 18:40 mcp.delivery.rules
>>>> -rw-r--r--  1 root  cvs      71 Jun  6 18:40 spam.blacklist.rules
>>>> -rw-r--r--  1 root  cvs     961 Jun  6 18:40 spam.whitelist.rules
>>>> -rw-r--r--  1 root  cvs     369 Jun  6 18:40 user.content.rules
>>>> -rw-r--r--  1 root  cvs    1878 Jul 17 17:05 user.delivery.rules
>>>> -rw-r--r--  1 root  cvs     636 Jul 21 12:49 user.filename.rules
>>>> -rw-r--r--  1 root  cvs     636 Jul 21 12:50 user.filetype.rules
>>>> -rw-r--r--  1 root  cvs     722 Jul 19 10:30 user.filtering.rules
>>>> -rw-r--r--  1 root  cvs     251 Jun  6 18:40 user.mcp.rules
>>>> -rw-r--r--  1 root  cvs     419 Jun  6 18:40 user.scanning.rules
>>>>
>>>>>
>>>>> One other thought is your max or minimum size for attachments 
>>>>> setting in
>>>>> the Mailscanner.conf file?
>>>>
>>>> I'm testing with a 76k text file named test.scr and a copy named 
>>>> test.sxw.doc.
>>>>
>>>> Maximum Message Size = 0
>>>> Maximum Attachment Size = -1
>>>> Minimum Attachment Size = -1
>>>>
>>>> Should be no checking going on (I do RBLs, size checking, max 
>>>> recipients on the MTA).
>>>>
>>>> I would be perfectly willing to post any and all conf files online 
>>>> for viewing.
>>>
>>> http://pixelhammer.com/MS/MailScanner.conf
>>> http://pixelhammer.com/MS/user.filename.rules
>>>
>>> Last act of desperation. This is as simple as I can make it and it 
>>> still is not stopping double suffix or even test.scr.
>>>
>>> Is there a stupid mistake I am just not seeing or is it time to 
>>> reinstall everything?
>>>
>>> DAve
>>
>> And what is the content of 
>> /usr/local/etc/MailScanner/rules/user.content.rules?
>>
>> - dhawal
> 
> http://pixelhammer.com/MS/user.content.rules
> 
> DAve

Well there lies your problem.. and i had previously hinted on this as 
well. You have

Dangerous Content Scanning = %rules-dir%/user.content.rules

and /usr/local/etc/MailScanner/rules/user.content.rules
To:	default		no	
From:	default		no	

Which indicates that you are not checking for 'Dangerous Content 
Scanning'. Filename/type checks depend on 'Dangerous Content Scanning'.. 
set the From to 'yes' and re-test.

- dhawal