Can't block wmv files

[Michael Mansour]

Hi Scott,

--- Scott Silva <ssilva at sgvwater.com> wrote:

> on 11/27/2007 7:56 PM Michael Mansour spake the
> following:
> > Hi Julian,
> > 
> > */Julian Field <MailScanner at ecs.soton.ac.uk>/*
> wrote:
> > 
> >     -----BEGIN PGP SIGNED MESSAGE-----
> >     Hash: SHA1
> > 
> >     shuttlebox wrote:
> >      > On Nov 27, 2007 3:08 PM, Michael Mansour
> wrote:
> >      >
> >      >> %etc-dir%/example.com.filename.rules:
> >      >>
> >      >> and %etc-dir%/example.com.filetype.rules:
> >      >>
> >      >
> >      > Those filenames don't match what you have
> in your rulesets, note the
> >      > missing .conf at the end:
> >      >
> >      >> FromOrTo: *@example.com
> >      >>
> /etc/MailScanner/example.com.filename.rules.conf
> >      >> FromOrTo: default
> /etc/MailScanner/filename.rules .conf
> >      >>
> >      >> FromOrTo: *@example.com
> >      >>
> /etc/MailScanner/example.com.filetype.rules.conf
> >      >> FromOrTo: default
> /etc/MailScanner/filetype.rules.conf
> >      >>
> >      >
> >      > Also, you do have tabs as whitespace in
> both files and no strange
> >      > end-of-lines, common if you edit the files
> in Windows?
> >      >
> >     The only places you need tabs instead of
> spaces are in the
> >     example.com.filetype/name.rules.conf and
> filetype/name.rules.conf files.
> >     You can use any whitespace in *.rules files.
> > 
> > Any ideas why the movie files still get through?
> > 
> > Is there some sort of MailScanner command I could
> use in debug mode or 
> > similar which I can input an email or attachment
> and see why MailScanner 
> > let the message or file through?
> > 
> > This setup works for so many other domains I host
> for, just not this 
> > particular one?
> > 
> > Michael.
> > 
> >     Jules
> Does mailscanner.conf have the correct path to file
> command?

Yes, all servers have:

File Command = /usr/bin/file

and:

# which file
/usr/bin/file

In MailScanner debug mode it also shows:

Dec  3 01:15:34 server MailScanner[17504]: Completed
checking by /usr/bin/file
Dec  3 01:15:34 server MailScanner[17504]: Virus
Scanning completed at 5014 bytes per second
Dec  3 01:15:34 server MailScanner[17504]: About to
deliver 1 messages
Dec  3 01:15:34 server MailScanner[17504]: Uninfected:
Delivered 1 messages
Dec  3 01:15:34 server MailScanner[17504]: Virus
Processing completed at 743464 bytes per second
Dec  3 01:15:34 server MailScanner[17504]: Batch
completed at 2200 bytes per second (117672 / 53)
Dec  3 01:15:34 server MailScanner[17504]: Batch (1
message) processed in 53.47 seconds
Dec  3 01:15:35 server MailScanner[17504]: Logging
message lB2EEVPw017610 to SQL
Dec  3 01:15:35 server MailScanner[17504]: "Always
Looked Up Last" took 0.06 seconds
Dec  3 01:15:35 server MailScanner[17504]: Config:
calling custom end function SQLSpamScores
Dec  3 01:15:35 server MailScanner[17504]: Closing
down SQL Spam Scores
Dec  3 01:15:35 server MailScanner[17504]: Config:
calling custom end function SQLBlacklist
Dec  3 01:15:35 server MailScanner[17504]: Closing
down by-domain spam blacklist
Dec  3 01:15:35 server MailScanner[17504]: Config:
calling custom end function MailWatchLogging
Dec  3 01:15:35 server MailScanner[17504]: Config:
calling custom end function SQLHighSpamScores
Dec  3 01:15:35 server MailScanner[17504]: Closing
down SQL High Spam Scores
Dec  3 01:15:35 server MailScanner[17504]: Config:
calling custom end function SQLWhitelist
Dec  3 01:15:35 server MailScanner[17504]: Closing
down by-domain spam whitelist
Dec  3 01:15:35 server MailScanner[17507]:
lB2EEVPw017610: Logged to MailWatch SQL
Dec  3 01:15:35 server MailScanner[17504]: MailScanner
child dying of old age

So it is using the command, just not doing anything
with the attachment.

Michael.



      Make the switch to the world's best email. Get the new Yahoo!7 Mail now. www.yahoo7.com.au/worldsbestemail