MS Office 2007 File Problems

[Alex Neuman]

It's not an ACL. It doesn't work that way. It's "or", or "any", not "first
hit".

Still, IMHO that rule is now somewhat outmoded and I, for one, turn it off.

On Wed, Jun 10, 2009 at 7:11 PM, Andrew Bruce <abruce at hope-st.ath.cx> wrote:

> Are rules not processed in order?
>
> Surely an allow line higher in the list would be matched first and the
> attachment allowed through, before the deny rule stops them?
>
> AB
>
> On Wed, 10 Jun 2009 18:27:51 -0500, Alex Neuman  wrote:
>
> Because you have the "double file extension" rule set, and files inside
> the compress office docx files have dotsomethingdotsomethinelsedotblah in
> them.
> On Wed, Jun 10, 2009 at 4:15 PM, Andrew Bruce  wrote:
> Hi,
>
> I'm having some trouble with Office 2007 files not being allowed through
> MailScanner.
>
> I've got these (applicable) rules in my filename.rules.conf:
>
> # docx
> allow .docx$ - -
> allow .xml[0-9].rel$ - -
>
> # Allow repeated file extension, e.g. blah.zip.zip
> allow (.[a-z0-9]{3})1$ - -
>
> # Deny all other double file extensions. This catches any hidden
> filenames.
> deny .[a-z][a-z0-9]{2,3}s*.[a-z0-9]{3}$ Found possible filename hiding
> Attempt to hide real filename extension
>
> Yet am still seeing results like this:
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml.rel)
> MailScanner: Attempt to hide real filename extension (settings.xml.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml1.rel)
> MailScanner: Attempt to hide real filename extension (settings.xml1.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml1.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (document.xml.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (settings.xml.rel)
> Report: MailScanner: Attempt to hide real filename extension
> (settings.xml1.rel)
>
> I'm running MailScanner version 4.61.7 (yes, I will be upgrading this
> when
> I can afford the server downtime).
>
> Any idea why this would be?
>
> Thanks,
>
> Andrew
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info [2]
> http://lists.mailscanner.info/mailman/listinfo/mailscanner [3]
>
> Before posting, read http://wiki.mailscanner.info/posting [4]
>
> Support MailScanner development - buy the book off the website!
>
> --
> Alex Neuman van der Hans
> Reliant Technologies
> +507 6781-9505
> +507 202-1525
> alex at rtpty.com [5]
> Skype: alexneuman
>
>
>
> Links:
> ------
> [1] mailto:abruce at hope-st.ath.cx
> [2] mailto:mailscanner at lists.mailscanner.info
> [3] http://lists.mailscanner.info/mailman/listinfo/mailscanner
> [4] http://wiki.mailscanner.info/posting
> [5] mailto:alex at rtpty.com
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>



-- 
Alex Neuman van der Hans
Reliant Technologies
+507 6781-9505
+507 202-1525
alex at rtpty.com
Skype: alexneuman
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090611/9b005c58/attachment.html