Mail-scanner not able to block exe in zip

[Joolee]

As far as i know, this setting only applies to anti-spam features and
perhaps virus scans. The other protection functions should ignore this
setting. It would be pretty useless to only block executables lower than a
certain file size and there is no mention in the rules files. (Although
most virus executables are extremely small so they can be send in large
volumes.)

@Ryan:
What is your value of the "File Command" setting? There was a discussion a
while ago that this should be set to /path/to/file -i and was set to
/path/to/file in older versions of MailScanner.

On 28 August 2012 09:55, Paul Bijnens <Paul.Bijnens at xplanation.com> wrote:

>
> Is the setting  "Max Spam Check Size" maybe excluding your large
> exe-inside-zip to be slipping through the fishing net?
>
>
>
>
> On 2012-08-28 05:09, Ryan Braganza wrote:
> > Hi Joolee below are the contents of the files
> >
> > cat archives.filetype.rules.conf
> >
> > allow    text        -            -
> > allow    \bscript    -            -
> > allow    archive        -            -
> > allow    postscript    -            -
> > deny    self-extract    No self-extracting archives    No
> self-extracting archives allowed
> > deny    executable    No executables        No programs allowed
> > #EXAMPLE: deny    -    x-dosexec    No DOS executables    No DOS
> programs allowed
> > deny    ELF        No executables        No programs allowed
> > deny    Registry    No Windows Registry entries    No Windows Registry
> files allowed
> >
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> > cat archives.filename.rules.conf |grep exe
> >
> > deny    pretty\s+park\.exe$ "Pretty Park" virus "Pretty Park" virus
> > deny    happy99\.exe$ "Happy" virus "Happy" virus
> > deny    \.exe$        Windows/DOS Executable
>    Executable DOS/Windows programs are
> > dangerous in email
> >
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> >
> > This is the ref to those files in MailScanner.conf
> >
> > cat MailScanner.conf |grep ^Archives: |grep Rules
> >
> > Archives: Filename Rules = %etc-dir%/archives.filename.rules.conf
> > Archives: Filetype Rules = %etc-dir%/archives.filetype.rules.conf
> >
> > Yes I am zipping the exe files when I send the mail.
> >
> >
> > On Mon, Aug 27, 2012 at 8:34 PM, Joolee <mailscanner at joolee.nl <mailto:
> mailscanner at joolee.nl>> wrote:
> >
> >     What is the contents of your (archive).filename/filetype.rules.conf
> ? And do you reference these files from your
> >     Mailscanner.conf?
> >
> >     And do you zip the ryan1.exe file in your example or did you send
> that as a plain, non-zipped attachment?
> >
> >     On 27 August 2012 15:55, Ryan Braganza <ryan.virgo at gmail.com<mailto:
> ryan.virgo at gmail.com>> wrote:
> >
> >         Dear Users,
> >
> >         I have enabled blocking of exe in zip archives by setting the
> "Maximum Archive Depth = 5"
> >
> >         I have a proper exe file wininst-7.1.exe which maybe is some
> windows setup exe. When i do a file command for
> >         this exe i get the below output
> >
> >         file wininst-7.1.exe
> >         wininst-7.1.exe: PE32 executable for MS Windows (GUI) Intel
> 80386 32-bit
> >
> >         If I zip it and mail it, Mailscanner fails to block it and
> pass's it through.
> >
> >         If a create a file with an exe extension
> >
> >         file ryan1.exe
> >         ryan1.exe: ASCII text
> >
> >         Mailscanner is able to block it .....
> >
> >         What could be wrong here ? the version am using is
> mailscanner-4.84.3-1
> >
> >
> >
> >
> >         --
> >
> *_________________________________________________________________________________
> >         *
> >         * Someone wrote:
> >         "I understand that if you play a Microsoft Windows CD backwards
> you hear strange Satanic messages"
> >
> >         To which someone replied:* *
> >         "It's even worse than that; play it forwards and it installs
> Windows Vista !"
> >
> _________________________________________________________________________________*
> >
> >
> >         --
> >         MailScanner mailing list
> >         mailscanner at lists.mailscanner.info <mailto:
> mailscanner at lists.mailscanner.info>
> >         http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >         Before posting, read http://wiki.mailscanner.info/posting
> >
> >         Support MailScanner development - buy the book off the website!
> >
> >
> >
> >     --
> >     MailScanner mailing list
> >     mailscanner at lists.mailscanner.info <mailto:
> mailscanner at lists.mailscanner.info>
> >     http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >     Before posting, read http://wiki.mailscanner.info/posting
> >
> >     Support MailScanner development - buy the book off the website!
> >
> >
> >
> >
> > --
> >
> *_________________________________________________________________________________
> > *
> > * Someone wrote:
> > "I understand that if you play a Microsoft Windows CD backwards you hear
> strange Satanic messages"
> >
> > To which someone replied:* *
> > "It's even worse than that; play it forwards and it installs Windows
> Vista !"
> >
> _________________________________________________________________________________*
> >
> >
> >
>
>
>
> --
> Paul Bijnens, Xplanation                            Tel  +32 16 397.525
> Interleuvenlaan 86, B-3001 Leuven, BELGIUM          Fax  +32 16 397.552
> ***********************************************************************
> * I think I've got the hang of it now:  exit, ^D, ^C, ^\, ^Z, ^Q, ^^, *
> * quit, ZZ, :q, :q!, M-Z, ^X^C, logoff, logout, close, bye, /bye, ~., *
> * stop, end, ^]c, +++ ATH, disconnect,  halt,  abort,  hangup,  KJOB, *
> * ^X^X,  :D::D,  kill -9 1,  kill -1 $$,  shutdown,  init 0,  Alt-F4, *
> * Alt-f-e, Ctrl-Alt-Del, Alt-SysRq-reisub, Stop-A, AltGr-NumLock, ... *
> * ...  "Are you sure?"  ...   YES   ...   Phew ...   I'm out          *
> ***********************************************************************
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120828/cbc6434a/attachment.html