<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Robert Lopez wrote:
<blockquote
cite="mid:edbd9f430909111434g708d939ep8ab2e4169ec7bd60@mail.gmail.com"
type="cite">
<pre wrap="">On Fri, Sep 11, 2009 at 3:07 PM, Glenn Steen <a class="moz-txt-link-rfc2396E" href="mailto:glenn.steen@gmail.com"><glenn.steen@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">2009/9/11 Robert Lopez <a class="moz-txt-link-rfc2396E" href="mailto:rlopezcnm@gmail.com"><rlopezcnm@gmail.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">Some offices of the college are being affected by some blocked data
files. They are .dat files and we do not want to unblock .dat files.
I am told in this case the data files are part of syncing blackberry
applications to desktop applications.
I considered allowing EPT.DAT, but that seems like too much of an
opportunity for the wrong persons.
Here are some of the facts:
Report: MailScanner: No programs allowed (ETP.DAT)
Received: from mailrouter1104.na.blackberry.net
(mailrouter1104.na.blackberry.net [204.187.87.55])
by xxxx.cnm.edu (Postfix) with SMTP id 625296604E2
for <a class="moz-txt-link-rfc2396E" href="mailto:slederle@cnm.edu"><slederle@cnm.edu></a>; Fri, 11 Sep 2009 06:56:02 -0600 (MDT)
Received: from ETP1107.etp.prod.on.blackberry
(etp1107.etp.prod.on.blackberry [172.23.40.50])
by mailrouter1104.na.blackberry.net (Postfix) with ESMTP id 65EBA2E257F
for <a class="moz-txt-link-rfc2396E" href="mailto:xxxxxx@cnm.edu"><xxxxxx@cnm.edu></a>; Fri, 11 Sep 2009 12:55:46 +0000 (UTC)
Would it take a custom modification to 'allow EPT.DAT files only from
*.na.blackberry.net' or could a file rule accomplish it?
The filename.rules.conf seems to not be able to deal with the domain
restriction.
Looking at CustomConfig.pm it seems there could be a
/etc/MailScanner/spam.bydomain/whitelist/blackberry file if everything
from na.blackberry.net and from prod.on.blackberry was wanted to be
allowed. As I have no idea what mail could come from
those it does not seem wise to just open for everything from them. [I
have not found a way to ask blackberry/rim any questions.]
</pre>
</blockquote>
<pre wrap="">Not really a custom thing, but unpalatable any which way you look at it.
The problem isn't the filename, which is trivially handled via a
normal ruleset (multiple filename.rules.conf, where you can allow the
relevant filename for the blaberry domain (bevare the subdomains...
aieee!!! Yes, I truly hate RIM/blackberry for this lunacy), but the
fact that they send a BINARY file without ascii armor. Oh they send
that too, but that is entirely beside the point, since they rely on
the binary attachment getting through.
The problem is that the "encrypted stuff" in that file can (and will,
as you have noticed)trigger ANY filetype line. So one need use a
"filetypewhitelist" for the blackberry domain (they, of course, have
too many sending servers to be able to keep up with using only IPs, so
you need bare yourself to forgeries here... AAAARRRGH!). It is a PITA.
It is either this, or stop using blackberries... Try selling that to
the CEOs:-).
BTW, the file is for BB activations, not synchronization.
Cheers (yeah, Am slightly drunk, so ... letting some pent-up stem loose here:-)
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
--
MailScanner mailing list
<a class="moz-txt-link-abbreviated" href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>
<a class="moz-txt-link-freetext" href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a>
Before posting, read <a class="moz-txt-link-freetext" href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</a>
Support MailScanner development - buy the book off the website!
</pre>
</blockquote>
<pre wrap=""><!---->
You have been so helpful to me and others I believe you are entitled
to some steam.
</pre>
</blockquote>
<soapbox><br>
I have to say I have had this problem, and have resorted to LAN
activation over wifi in the past. I have also sat there and whitelist
IPs until you have enough to get it through on the first few tries.<br>
<br>
Blackberrys are a PITA, but as an IT consultant they are good revenue
earners because they consume so much time. I have pointed this out to
many of my clients, but CEOs as you say, just seem to be hooked on them.<br>
<br>
The whole Blackberry system, BES etc is all badly thought out and
thrown together...and randomly stops working at times...<br>
</soapbox><br>
<br>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by the
<a href="http://www.inexcom.co.uk/"><b>Inexcom</b></a> system scanner,
<br />and is believed to be clean.
<br />Advanced heuristic mail scanning server [-].
</body>
</html>