1 Topic by Nychary (edited by Nychary 2015-12-09 16:51:24)

  • Nychary
  • Member
  • Offline
  • Registered: 2015-12-09
  • Posts: 8

Topic: Checking attachments

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.2
- Linux/BSD distribution name and version: Ubuntu Server 14 LTS
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MSQL
- Web server (Apache or Nginx): Apache

iRedMail-0.9.2 на Ubuntu Server 14 LTS is installed.

What should I do to implement scan of .zip and .rar attachhements for .exe, .bat and other malware? And which of the following components - Amawis, SpamAssassin or ClamAV - dooes it?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,787

Re: Checking attachments

With default settings, Amavisd will invoke SpamAssassin for spam scanning, ClamAV for virus scanning. No additional change required.

To verify whether it's working as expected, try this tutorial:
http://www.iredmail.org/docs/no.x-spam.headers.html

3 Reply by Nychary

  • Nychary
  • Member
  • Offline
  • Registered: 2015-12-09
  • Posts: 8

Re: Checking attachments

Sorry for my english (it is not my native language). In my previous message I didn't meant "scanning". I will try to rephrase my question:

Which module (or settings) is responsible for removing files without any scanning from the mail with potentially dangerous extensions (.exe, .bat, etc.)

It is possible to setup this module to check and remove files (with unwanted extentions) from archives?

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,787

Re: Checking attachments

Nychary wrote:

Which module (or settings) is responsible for removing files without any scanning from the mail with potentially dangerous extensions (.exe, .bat, etc.)

Amavisd+SpamAssassin+ClamAV.

Nychary wrote:

It is possible to setup this module to check and remove files (with unwanted extentions) from archives?

Amavisd may ban or quarantine these emails.

*)  if you configure AMavisd to quarantine them into SQL database, you need to run /opt/www/iredadmin/tools/cleanup_amavisd_db.py to remove them.

*) If you didn't configure Amavisd to quarantine them into SQL database, they will be isolated to /var/lib/amavisd/virusmails, you can remove them after review their content.

5 Reply by Nychary (edited by Nychary 2015-12-10 14:50:24)

  • Nychary
  • Member
  • Offline
  • Registered: 2015-12-09
  • Posts: 8

Re: Checking attachments

Ok. I will try to rephrase it again.
Which module generates such messages:

BANNED CONTENTS ALERT

Our content checker found
    banned name: text/plain,.empty,NewText.bat,=?utf-8?Q?=D0=9D=D0=BE=D0=B2=D1=8B=D0=B9_=D1=82=D0=B5=D0=BA=D1=81=D1=82=D0=BE=D0=B2=D1=8B=D0=B9_=D0=B4=D0=BE=D0=BA=D1=83=D0=BC=D0=B5=D0=BD=D1=82.bat?=,=?UTF-8?B?0J3QvtCy0YvQuSDRgtC10LrRgdGC0L7QstGL0Lkg0LTQvtC60YPQvNC1?=
      =?UTF-8?B?0L3Rgi5iYXQ=?=

in email presumably from you <test@****.ru>
to the following recipient:
-> postmaster@******.ru

Our internal reference code for your message is 10790-01/I4y9LLwxQRVD

First upstream SMTP client IP address: [10.2.44.15]
According to a 'Received:' trace, the message apparently originated at:
  [10.2.44.15], [127.0.0.1] unknown [10.2.44.15]

Return-Path: <test@*****.ru>
From: test <test@******.ru>
Message-ID: <56614E58.1080903@*****.ru>

Delivery of the email was stopped!

The message has been blocked because it contains a component
(as a MIME part or nested within) with declared name
or MIME type or contents type violating our access policy.

To transfer contents that may be considered risky or unwanted
by site policies, or simply too large for mailing, please consider
publishing your content on the web, and only sending an URL of the
document to the recipient.
[....]

How can I setup it (add or remove some MIME-types or extantions)?

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,787

Re: Checking attachments

Nychary wrote:

How can I setup it (add or remove some MIME-types or extantions)?

It's defined in /etc/amavis/conf.d/*, parameter "$banned_filename_re".

7 Reply by Nychary

  • Nychary
  • Member
  • Offline
  • Registered: 2015-12-09
  • Posts: 8

Re: Checking attachments

ZhangHuangbin wrote:
Nychary wrote:

How can I setup it (add or remove some MIME-types or extantions)?

It's defined in /etc/amavis/conf.d/*, parameter "$banned_filename_re".

Thanks for reply! How can add possibility to check extensions inside compressed files (eg inside .zip or .rar)?

8 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,787

Re: Checking attachments

Amavisd will extract compressed file, then check the file type. it's enabled by default.

9 Reply by Nychary

  • Nychary
  • Member
  • Offline
  • Registered: 2015-12-09
  • Posts: 8

Re: Checking attachments

But I testes it it. Inside zip was exe-file and it passed this test.

10 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,787

Re: Checking attachments

Could you please turn on debug mode in Amavisd, then test again? we need FULL debug log in /var/log/mail.log related to this testing, please copy them all and paste here for troubleshooting.

Reference: http://www.iredmail.org/docs/debug.amavisd.html

11 Reply by Nychary (edited by Nychary 2015-12-21 17:35:32)

  • Nychary
  • Member
  • Offline
  • Registered: 2015-12-09
  • Posts: 8

Re: Checking attachments

ZhangHuangbin wrote:

Could you please turn on debug mode in Amavisd, then test again? we need FULL debug log in /var/log/mail.log related to this testing, please copy them all and paste here for troubleshooting.

Reference: http://www.iredmail.org/docs/debug.amavisd.html

Post's attachments

maillog.txt 118.31 kb, 2 downloads since 2015-12-21 

You don't have the permssions to download the attachments of this post.

12 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,787

Re: Checking attachments

Search 'zip' in your log file, you can find Amavisd unzip detected 7zip archive file.