filename extension problem

[Gareth]

On Thu, 2007-07-05 at 12:41, jayesh shinde wrote:
> Dear All,
>                  I have one query , I am using MailScanner version
> 4.34.8  on FC2 with sendmail. Some of my users are sending there email
> with an attachments with double or multiple extention ( Ex:--
> my.com.location.doc)
>                 When it goes through MailScanner  for  scanning
> attachment , it give me the following error as :--
> 
> #####
>   At Fri Jun 29 18:00:56 2007 the virus scanner said:
>    MailScanner: Attempt to hide real filename extension
> (my.com.location.doc)
> ###### 

filename.rules.conf contails this line :-

# Deny all other double file extensions. This catches any hidden
filenames.                                deny   
\.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible filename
hiding                          Att
empt to hide real filename extension

This blocks any filename ending with a two or 3 character extension
followed by a 3 character extension. I cant see how this would block the
specific example you gave though.
I am not running the very latest version of mailscanner though so
perhaps yours has been updated.


>                  My queries are :--
> 1) Is  there any way to by pass above such multiple extension mail
> through MailScanner. If yes then where should i define this ruleset &
> how to write this rule for 
> single user.

Just remove the section in the file mentioned above.

> 2) If i bypass the above such multiple extension attachment , will it
> affect the block extention list ( define under
> /etc/MailScanner/filename.rules.conf )