File(name|type) rules - was hijacked: "Allow Script Tags" affects attachments?

[Paul Scott]

Hello Mark,

This is what I get:

[root at mail log]# grep 'Feb  8 15:41:4.*MailScanner.14031' maillog
Feb  8 15:41:46 mail MailScanner[14031]: Message v18NfGNg014804 from 216.205.24.106 (betty.tran at ioausa.com) to mp-eng.com is too big for spam checks (1572191 > 150000 bytes) 
Feb  8 15:41:46 mail MailScanner[14031]: Spam Checks: Found 1 spam messages 
Feb  8 15:41:48 mail MailScanner[14031]: Cleaned: Delivered 1 cleaned messages 
Feb  8 15:41:48 mail MailScanner[14031]: Deleted 2 messages from processing-database 
Feb  8 15:41:48 mail MailScanner[14031]: Logging message v18NfJdu014805 to SQL 
Feb  8 15:41:48 mail MailScanner[14031]: Logging message v18NfGNg014804 to SQL

So, yes...the message was still delivered, along with the odd warning message, but the 7 attachments that she was sending were stripped and gone, and the message "Too many attachments" was in the warning message.

And can you please let me know where this " EdenUSAInc-Attachment-Warning.txt" file is supposed to be, if it is supposed to be a part of the system, or?  I know where the "EdenUSAInc" is coming from.  It is as defined in the mailscanner.conf file here:

Enter a short identifying name for your organisation below, this is 
# used to make the X-MailScanner headers unique for your organisation. 
# Multiple servers within one site should use an identical value here
# to avoid adding multiple redundant headers where mail has passed
# through several servers within your organisation.
#       
# Note: Some Symantec scanners complain (incorrectly) about "."
# ***** characters appearing in the names of headers.
#       Some other mail servers complain about "_" characters
#       appearing in the names of headers as well.
#       So don't put "." or "_" in this setting.
#       
# **** RULE: It must not contain any spaces! ****
%org-name% = EdenUSAInc

The rest of the file name is being generated within MailScanner.

Thank you again, Paul Scott
Eden USA, Inc.

-----Original Message-----
From: MailScanner [mailto:mailscanner-bounces+sales=edenusa.com at lists.mailscanner.info] On Behalf Of Mark Sapiro
Sent: Friday, February 10, 2017 8:04 AM
To: mailscanner at lists.mailscanner.info
Subject: Re: File(name|type) rules - was hijacked: "Allow Script Tags" affects attachments?

On 02/09/2017 09:28 PM, Paul Scott wrote:
> 
> With regards to the attachments issue, I think I might finally be starting to get to the bottom of this.  Here is the entry from the log which corresponds to the generation of the odd message that my clients get when a sender sends an email with attachments:
> 
> Feb  8 15:41:46 mail MailScanner[14031]: Message v18NfGNg014804 from 
> 216.205.24.106 (betty.tran at ioausa.com) to mp-eng.com is too big for 
> spam checks (1572191 > 150000 bytes)
> 
> So, of course when an email has attachments, it is quite large.  This message is generated incorrectly, for two reasons:


The above message is not why you get the "too many attachments message".
All that should do is skip SpamAssassin entirely for that message. What messages do you see if you grep the log for  'Feb  8 15:41:4.*MailScanner.14031'
(dropping the last digit of the seconds and replacing [ with . are intentional).

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan


--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner