1 Topic by agroshong

  • agroshong
  • Member
  • Offline
  • Registered: 2016-03-25
  • Posts: 36

Topic: Unable to block .doc File's

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.9
- Deployed with iRedMail Easy or the downloadable installer? no
- Linux/BSD distribution name and version: CentOS7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? no
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hi,

I am having issues blocking .doc files globally for my users. I have added the doc to my amavisd.conf file as per below, and turned on full debugging. The exert from the log shows that it did not match, and does not get tagged as BANNED. What am I doing wrong, any help is appreciated.


$banned_filename_re = new_RE(

### BLOCKED ANYWHERE
# qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
  qr'^\.(exe-ms|dll)$',                   # banned file(1) types, rudimentary
  qr'^\.(exe|lha|cab|dll|doc)$',              # banned file(1) types

Dec  9 12:06:09 mx amavis[28262]: (28262-01) Passed CLEAN

Dec  9 12:06:09 mx amavis[28262]: (28262-01) lookup [banned_namepath_re] => undef, "P=p004\tL=1\tM=multipart/mixed\nP=p005\tL=1/1\tM=multipart/alternative\nP=p002\tL=1/1/2\tM=text/html\tT=asc" does not match

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,090

Re: Unable to block .doc File's

Try to block it with parameter "$banned_namepath_re" in  /etc/amavisd/amavisd.conf.

3 Reply by agroshong

  • agroshong
  • Member
  • Offline
  • Registered: 2016-03-25
  • Posts: 36

Re: Unable to block .doc File's

Hey Zang,

I made the change as you suggested(exert's below), this time it matched the rule and was identified, but the mail was still passed, even though I have DISCARD as my banned action

$banned_namepath_re = new_RE(
    #[qr'T=(rar|arc|arj|zoo|gz|bz2)(,|\t)'xmi => 'DISCARD'],     # Compressed file types
    [qr'T=x-(msdownload|msdos-program|msmetafile)(,|\t)'xmi => 'DISCARD'],
    [qr'T=(hta)(,|\t)'xmi => 'DISCARD'],

     # Dangerous file name extensions
    [qr'N=.*\.(9|386|doc|LeChiffre|.........zvz|zzz)$'xmi => 'DISCARD'],
);

# Banned
$final_banned_destiny = D_DISCARD;
$banned_files_quarantine_method = 'sql:';
$banned_quarantine_to = 'banned-quarantine';

Dec 10 11:50:03 mx amavis[3286]: (03286-01) lookup_re("P=p004\tL=1\tM=multipart/mixed\nP=p003\tL=1/2\tM=application/msword\tT=dat\tN=test.doc") matches key "(?^mix:N=.*\\.(9|386|doc|LeChiffre|........|zvz|zzz)$)", result="DISCARD"

Dec 10 11:50:05 mx amavis[3286]: (03286-01) Passed BANNED (application/msword,.dat,test.doc)

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,090

Re: Unable to block .doc File's

Amavisd is configured to query the policy from SQL database ("amavisd.policy") by default, so if there's a policy defined in SQL matched, it will override the one in config file (amavisd.conf).

Please check "amavisd.policy" and update there.

5 Reply by agroshong

  • agroshong
  • Member
  • Offline
  • Registered: 2016-03-25
  • Posts: 36

Re: Unable to block .doc File's

Hey Zang,

Thank you for your assistance, I changed the value for "banned_files_lover" from Y to N and this along with the above help worked.

Just one final followup question, is there a way to quarantine these and have the user notified instead of just dropped?

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,090

Re: Unable to block .doc File's

agroshong wrote:

Just one final followup question, is there a way to quarantine these and have the user notified instead of just dropped?

iRedAdmin-Pro ships a script to send email notification to end users if there's some email quarantined. You can run the script with a cron job.

If you're interested in iRedAdmin-Pro:

- https://www.iredmail.org/admin_panel.html
- https://www.iredmail.org/pricing.html