Mail-scanner not able to block exe in zip

Vincent Miszczak vmiszczak at ankama.com
Wed Aug 29 09:27:13 IST 2012


Hello,

I've been running with this issue.

In my case, the setting "dangerous content scanning" was set to "no". Setting it to "yes" solved my problem.

Regards

De : mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de Ryan Braganza
Envoyé : mercredi 29 août 2012 07:13
À : MailScanner discussion
Objet : Re: Mail-scanner not able to block exe in zip

I did a fresh centos5.5 installion with the latest Mailscanner and its working perfect, It blocks all zipped exe's as desired. I guess there is some custom configuration on my production servers due to which it fails to work. Will check that out today.

:-)
On Tue, Aug 28, 2012 at 7:25 PM, Ryan Braganza <ryan.virgo at gmail.com<mailto:ryan.virgo at gmail.com>> wrote:
The File Command in my conf was /usr/bin/file , which I then set to /usr/bin/file -i .. Still no luck,

On Tue, Aug 28, 2012 at 4:14 PM, Joolee <mailscanner at joolee.nl<mailto:mailscanner at joolee.nl>> wrote:
As far as i know, this setting only applies to anti-spam features and perhaps virus scans. The other protection functions should ignore this setting. It would be pretty useless to only block executables lower than a certain file size and there is no mention in the rules files. (Although most virus executables are extremely small so they can be send in large volumes.)

@Ryan:
What is your value of the "File Command" setting? There was a discussion a while ago that this should be set to /path/to/file -i and was set to /path/to/file in older versions of MailScanner.

On 28 August 2012 09:55, Paul Bijnens <Paul.Bijnens at xplanation.com<mailto:Paul.Bijnens at xplanation.com>> wrote:

Is the setting  "Max Spam Check Size" maybe excluding your large exe-inside-zip to be slipping through the fishing net?




On 2012-08-28 05:09, Ryan Braganza wrote:
> Hi Joolee below are the contents of the files
>
> cat archives.filetype.rules.conf
>
> allow    text        -            -
> allow    \bscript    -            -
> allow    archive        -            -
> allow    postscript    -            -
> deny    self-extract    No self-extracting archives    No self-extracting archives allowed
> deny    executable    No executables        No programs allowed
> #EXAMPLE: deny    -    x-dosexec    No DOS executables    No DOS programs allowed
> deny    ELF        No executables        No programs allowed
> deny    Registry    No Windows Registry entries    No Windows Registry files allowed
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> cat archives.filename.rules.conf |grep exe
>
> deny    pretty\s+park\.exe$ "Pretty Park" virus "Pretty Park" virus
> deny    happy99\.exe$ "Happy" virus "Happy" virus
> deny    \.exe$        Windows/DOS Executable                                Executable DOS/Windows programs are
> dangerous in email
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>
> This is the ref to those files in MailScanner.conf
>
> cat MailScanner.conf |grep ^Archives: |grep Rules
>
> Archives: Filename Rules = %etc-dir%/archives.filename.rules.conf
> Archives: Filetype Rules = %etc-dir%/archives.filetype.rules.conf
>
> Yes I am zipping the exe files when I send the mail.
>
>
> On Mon, Aug 27, 2012 at 8:34 PM, Joolee <mailscanner at joolee.nl<mailto:mailscanner at joolee.nl> <mailto:mailscanner at joolee.nl<mailto:mailscanner at joolee.nl>>> wrote:
>
>     What is the contents of your (archive).filename/filetype.rules.conf ? And do you reference these files from your
>     Mailscanner.conf?
>
>     And do you zip the ryan1.exe file in your example or did you send that as a plain, non-zipped attachment?
>
>     On 27 August 2012 15:55, Ryan Braganza <ryan.virgo at gmail.com<mailto:ryan.virgo at gmail.com> <mailto:ryan.virgo at gmail.com<mailto:ryan.virgo at gmail.com>>> wrote:
>
>         Dear Users,
>
>         I have enabled blocking of exe in zip archives by setting the "Maximum Archive Depth = 5"
>
>         I have a proper exe file wininst-7.1.exe which maybe is some windows setup exe. When i do a file command for
>         this exe i get the below output
>
>         file wininst-7.1.exe
>         wininst-7.1.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
>
>         If I zip it and mail it, Mailscanner fails to block it and pass's it through.
>
>         If a create a file with an exe extension
>
>         file ryan1.exe
>         ryan1.exe: ASCII text
>
>         Mailscanner is able to block it .....
>
>         What could be wrong here ? the version am using is mailscanner-4.84.3-1
>
>
>
>
>         --
>         *_________________________________________________________________________________
>         *
>         * Someone wrote:
>         "I understand that if you play a Microsoft Windows CD backwards you hear strange Satanic messages"
>
>         To which someone replied:* *
>         "It's even worse than that; play it forwards and it installs Windows Vista !"
>         _________________________________________________________________________________*
>
>
>         --
>         MailScanner mailing list
>         mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info> <mailto:mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info>>
>         http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>         Before posting, read http://wiki.mailscanner.info/posting
>
>         Support MailScanner development - buy the book off the website!
>
>
>
>     --
>     MailScanner mailing list
>     mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info> <mailto:mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info>>
>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>     Before posting, read http://wiki.mailscanner.info/posting
>
>     Support MailScanner development - buy the book off the website!
>
>
>
>
> --
> *_________________________________________________________________________________
> *
> * Someone wrote:
> "I understand that if you play a Microsoft Windows CD backwards you hear strange Satanic messages"
>
> To which someone replied:* *
> "It's even worse than that; play it forwards and it installs Windows Vista !"
> _________________________________________________________________________________*
>
>
>



--
Paul Bijnens, Xplanation                            Tel  +32 16 397.525<tel:%2B32%2016%20397.525>
Interleuvenlaan 86, B-3001 Leuven, BELGIUM          Fax  +32 16 397.552<tel:%2B32%2016%20397.552>
***********************************************************************
* I think I've got the hang of it now:  exit, ^D, ^C, ^\, ^Z, ^Q, ^^, *
* quit, ZZ, :q, :q!, M-Z, ^X^C, logoff, logout, close, bye, /bye, ~., *
* stop, end, ^]c, +++ ATH, disconnect,  halt,  abort,  hangup,  KJOB, *
* ^X^X,  :D::D,  kill -9 1,  kill -1 $$,  shutdown,  init 0,  Alt-F4, *
* Alt-f-e, Ctrl-Alt-Del, Alt-SysRq-reisub, Stop-A, AltGr-NumLock, ... *
* ...  "Are you sure?"  ...   YES   ...   Phew ...   I'm out          *
***********************************************************************
--
MailScanner mailing list
mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info>
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!


--
MailScanner mailing list
mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info>
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!


--
_________________________________________________________________________________
 Someone wrote:
"I understand that if you play a Microsoft Windows CD backwards you hear strange Satanic messages"

To which someone replied:

"It's even worse than that; play it forwards and it installs Windows Vista !"
_________________________________________________________________________________





--
_________________________________________________________________________________
 Someone wrote:
"I understand that if you play a Microsoft Windows CD backwards you hear strange Satanic messages"

To which someone replied:
"It's even worse than that; play it forwards and it installs Windows Vista !"
_________________________________________________________________________________


--
This message has been scanned for viruses and
dangerous content by MailScanner<http://www.mailscanner.info/>, and is
believed to be clean.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120829/2f694d0a/attachment.html 


More information about the MailScanner mailing list