tnef madness

[Kevin Miller]

I switched to it yesterday afternoon after posting.  I’m waiting for test messages from the sender to see how it behaves.

 ...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Martin Hepworth
Sent: Friday, June 06, 2014 12:00 AM
To: MailScanner discussion
Subject: Re: tnef madness

you tried using the external tnef scanner at all?

--
Martin Hepworth, CISSP
Oxford, UK

On 6 June 2014 00:28, Kevin Miller <Kevin_Miller at ci.juneau.ak.us<mailto:Kevin_Miller at ci.juneau.ak.us>> wrote:
I've been having trouble with tnef attachements from one person.  Most get through OK, but this one is stumping me.  The sender is not using rich text format.  The mail administrator at her site sent me the following:

" I have deleted Anita's outlook profile and recreated it and have also checked the Exchange settings to see if it is enforcing rich-text format over the user's settings (it is not).  Her email still gets bounced back when sent as HTML with or without an attachment.  Her email is successful as plain text without an attachment, but fails with an attachment.  The attachment is a PDF."

It works for other users at this site - it's just her email that is acting oddly.  She's using Outlook - I'm not sure what version or which version of Exchange they're on.

Looking in the /var/spool/MailScanner/quarantine/20140605 I see a couple of odd directories:
mxg:/var/spool/MailScanner/quarantine/20140605 # l
total 145
drwxrwx---  6 root www    160 Jun  5 13:05 ./
drwxrwx--- 33 root www    800 Jun  5 09:47 ../
drwxrwx---  2 root www 123760 Jun  5 15:04 nonspam/
drwxrwx---  2 root www     72 Jun  5 12:22 s55K40Y6019591/
drwxrwx---  2 root www     72 Jun  5 13:05 s55Kkmnf026492/
drwxrwx---  2 root www  24240 Jun  5 15:01 spam/

Normally I just see nonspam and spam.
Within s55K40Y6019591/ is a single file named message.  Contents are at http://pastebin.com/kGrmSpN5
I munged the email addresses, and stripped out the middle of the attachment but all else is otherwise intact.

TNEF settings in MailScanner.conf:

Expand TNEF = yes
Use TNEF Contents = replace
Deliver Unparsable TNEF = no
TNEF Expander  = internal
TNEF Timeout = 120

In Mailwatch, I see this when looking at the message:
message/rfc822                  20140605/nonspam/s55Kkmnf026492
message/rfc822\0117bit  20140605/s55Kkmnf026492/message

No idea what rfc822\0117bit indicates but suspect it's a clue...

 ...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357


--
MailScanner mailing list
mailscanner at lists.mailscanner.info<mailto:mailscanner at lists.mailscanner.info>
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20140606/7bafbbcd/attachment.html