File Type Check Problem

[Julian Field]

Mike Kercher wrote:
>  
>
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Julian
> Field
> Sent: Thursday, April 03, 2008 3:21 PM
> To: MailScanner discussion
> Subject: Re: File Type Check Problem
>
>
>
> Mike Kercher wrote:
>   
>> I've been searching and haven't found a resolution for this yet.
>>
>> Periodically, we get emails with attachments coming through that are 
>> not being detected properly.  MailScanner reports:
>>
>> MailScanner: No programs allowed (msg-10410-101.txt)
>>   
>>     
> This is being caught by the filetype trap.
>   
>> If I go look at the quarantined email in MailWatch and download the 
>> attachment, it is a PDF.
>>     
> That may be what the filename says, but what does the "file" command
> report?
>   
>>   There was talk of the file -i command switch.
>> Is this something that needs to be set in MailScanner.conf?
>>   
>>     
> No, just read the latest filetype.rules.conf and filename.rules.conf
> files, the comments at the top of each file tell you how to use it. 
> There is also an example line in filetype.rules.conf for you to copy.
>
>   
>> TIA
>>
>> Mike
>>   
>>     
>
> Jules
>
> --
>
> Jules,
>
> Running file against the message yields the following:
>
> [root at HOUPMS02 m334jSTE009852]# file message 
> message: smtp mail text
> [root at HOUPMS02 m334jSTE009852]# file -i message 
> message: message/rfc822\011
>
> Not quite sure what changing the filetype.rules.conf would do for me
> here.
>   
No! I meat you to run the "file" command on the attachment, not the 
message! :-(
Funnily enough, when you run it on the message it says it's a message :-)

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
PGP public key: http://www.jules.fm/julesfm.asc


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.