<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi list,<br class=""> <br class="">I am struggling with the ”magic” fifth field in filetype.rules.conf – as so many others in the past, as far as I understand old posting.<br class=""> <br class="">Let me explain my settings:<br class=""> <br class="">I have a list of attachments, I do allow in filetype.rules.conf (like text, pics, html, pdf and other stuff) and the last line is a deny for every other attachment. I did this, because I do not want to get anything to my mailserver, where I am not 100% sure of the filetype – so executables are banned and also every unknown filetype.<br class=""> <br class="">This file looks like this:<br class=""> <br class=""> <br class="">-<font face="Courier" class="">------<br class="">allow ASCII text ASCII text ASCII text<br class="">allow PC bitmap PC bitmap PC bitmap<br class="">allow Emacs v18 Emacs v18 Emacs v18<br class="">allow C++ source C++ source C++ source<br class="">allow source diverse source diverse source<br class="">[…]<br class="">deny .* Deny unidentified attachments Deny unidentified attachments<br class="">----------</font><br class=""> <br class=""> <br class="">But from time to time I get a false positive, often non-english text-parts are not very good identified, like Finnish or east-European languages. Often the pdf attachment is identified fine and mailscanner processes it, but txt and html-parts are too often blocked.<br class=""> <br class=""><br class=""> <br class="">But using the file –I command I have a much higher rate of messages identified as text or html mail-part.<br class=""> <br class="">So I wanted to use this feature Julian implemented 2008:<br class=""> <br class=""> <br class=""><font face="Courier" class="">------------<br class="">This 5th field is optional, and specifies a regular expression which is<br class="">matched against the MIME type as determined by the "file -i" command.<br class=""> <br class="">If it is never specified, then the "file -i" command will never be run<br class="">on your message attachments so there is no appreciable overhead on the<br class="">speed of MailScanner caused by this new feature.<br class=""> <br class="">If the "mime type" *and* the filetype fields are both specified (and are<br class="">not "-") then either matching will cause the rule to fire. In a "deny"<br class="">rule like the example above, then *either* test firing will cause the<br class="">attachment to be blocked. In an "allow" rule then *both* of the tests<br class="">must pass to cause the attachment to be allowed and hence no more rules<br class="">to be checked. This sounds a bit odd but actually ends up doing pretty<br class="">much what you expect it to. I'm sure you'll let me know if I'm wrong<br class="">there :-)<br class="">---------</font><br class=""> <br class="">I added a line like this in my filetype.rules.conf:<br class=""> <br class=""><font face="Courier" class="">allow - text/plain - -</font><br class=""> <br class="">But the message mentioned above still triggered my last line<br class=""> <br class=""><font face="Courier" class="">deny .* Deny unidentified attachments Deny unidentified attachments<br class=""> </font><br class=""><br class=""><div class="">For example: Yesterday I realized, the text-message of an email (starting with the string “THX!”) war identified as “<b class="">AHX version</b>” from my file (version 5.14) command but as <font face="Courier" class=""><b class="">text/plain</b></font> with „file -i"</div><div class=""><br class=""></div><div class="">I understand the text from Julian, that both the “file” and the “file -i”-field has to match and added a line like this:<br class=""> <br class=""><font face="Courier" class="">allow AHX version text/plain - -</font><br class=""> <br class="">Which works – but only because I have added the “file”-regex to that line, too.<br class=""> <br class="">I am looking for a “match all” at that point – the dash “-“ did not work for me.<br class=""> <br class="">I wonder if there is a way to allow any attachments, that give you a “text/plain” when using “file –i”.<br class=""> <br class=""> <br class="">Any help appreciated!<br class=""> <br class="">I am using MS-4.84.6-1 on a CentOS 6.6 32 bit.<br class=""> <br class="">And by the way: I love MailScanner – thanks to all of you helping make the software work.<br class=""> <br class="">Best regards<br class="">Volker</div></body></html>