Not blocking executables

[rob]

On Mon, 29 Jan 2007 17:05:20 +0100, Glenn Steen wrote
> On 29/01/07, rob <rob at robhq.com> wrote:
> (snip)
> >From /etc/MailScanner/MailScanner.conf
> >
> >
> > File Command = /usr/bin/file
> > Allow Filenames =
> > Deny Filenames =
> > Filename Rules = %etc-dir%/filename.rules.conf
> > Allow Filetypes =
> > Deny Filetypes =
> > Filetype Rules = %etc-dir%/filetype.rules.conf
> >
> Ok good. Then what does
> grep -i exe /etc/MailScanner/filename.rules.conf
> /etc/MailScanner/filetype.rules.conf
> give? Be as verbose as possible, redirect into a file and attach
> that... Both files are a bit hysterical about whitespace... They
> absolutely need have <TAB> as field separator... and I'd like to see
> if these lines have that (or you could just check it:-). Then again,
> MailScanner --lint is supposed to catch those:-).
> But that is the secondary thing... the primary thing to check for here
> is any "allow" lines that shouldn't be there.
> 
> Perhaps time to start looking at the messages themselves too, how do
> you send them? MIME type etc?
> 
> Cheers
> -- 
> -- Glenn
> email: glenn < dot > steen < at > gmail < dot > com
> work: glenn < dot > steen < at > ap1 < dot > se

Just testing this sending from a yahoo account via their webmail client.  Just checked
and this is happening on both our installs of MailScanner.  My install at the house does
block the same message.  

Microsoft Mail Internet Headers Version 2.0
Received: from XXXXXXXXXXXXXXXXXXXX by stymie.fleetone.com with Microsoft
SMTPSVC(6.0.3790.1830);
	 Mon, 29 Jan 2007 10:22:56 -0600
Received: from web58011.mail.re3.yahoo.com (web58011.mail.re3.yahoo.com [68.142.236.119])
	by XXXXXXXXXXXXXXXXXXX (8.12.11.20060308/8.12.11) with SMTP id l0TGMNhx018076
	for <XXXXXXXXXXXXXXXXXXXX>; Mon, 29 Jan 2007 10:22:25 -0600
Received: (qmail 96988 invoked by uid 60001); 29 Jan 2007 16:22:28 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Message-ID;
 
b=QtlZicUefe6otxmKuLou6iEDrwyYOkBFvYbNB+yDwUf5En855F2aTUWiBefZYGF7/cxa4Ffm9IV2tbG4U4cTHgwSYuqAf8vrKcc7yqn1dNQjpPrYILgDOoEBRlH/wm4JoQ7Qdb1pak3pIvjKSg/5jm9LZWpK5Y+HNziJCrfrVCs=;
X-YMail-OSG:
tJGQyMAVM1lm83K8oq_QNfdePe4z_3rCfhTDYHSBztbAFOutHBpv8IO_TcVFLwed0j9FX45jy6Eq0Nw1PB5o5nMCwjtlDAax2h73lpquog--
Received: from [XXXXXXXXXXXXX] by web58011.mail.re3.yahoo.com via HTTP; Mon, 29 Jan 2007
08:22:28 PST
X-Mailer: YahooMailRC/368.3 YahooMailWebService/0.6.132.7
Date: Mon, 29 Jan 2007 08:22:28 -0800 (PST)
From: Rob Freeman <XXXXXXXXX at yahoo.com>
Subject: test 6
To: XXXXXXXXXXXXXXXXXXXXX
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-1342646654-1170087748=:92000"
Message-ID: <324593.92000.qm at web58011.mail.re3.yahoo.com>
-------------- next part --------------
deny	pretty\s+park\.exe$	"Pretty Park" virus								"Pretty Park" virus
deny	happy99\.exe$		"Happy" virus									"Happy" virus
deny	\.com$		Windows/DOS Executable								Executable DOS/Windows programs are dangerous in email
deny	\.exe$		Windows/DOS Executable								Executable DOS/Windows programs are dangerous in email
-------------- next part --------------
deny	executable	No executables		No programs allowed
deny	ELF		No executables		No programs allowed