Debugging the attachments part of system filter file

km9

• February 28, 2018 08:56

Hi, I recently noticed an email delivered with an attachment that is forbidden in the system filter file. Using /usr/lib/sendmail -bF /etc/cpanel_exim_system_filter -v
I could see that the attachments lines were not matched, though the Content-Type and Content-Disposition headers were present in the body. Through a process of elimination, I found that by removing most of the large block of (HTML) text present in the main part of the body I could make the attachment test trigger. I'm clearly missing something here. Is there a limit to the amount of the body that is passed to the filter? I can reproduce the problem by crafting a simple "Hello World" test email with a forbidden attachment, which is detected correctly, then adding 15,000 characters to the body, which is then not detected. Any clues, and, more importantly, work arounds? Thanks.

• 

  cPanelMichael

  • February 28, 2018 16:35

  Hello, Do you have any additional custom Exim rules enabled, or are you using any third-party applications such as MailScanner? I understand your issue to relate to the Exim system filter itself, but I did want to note that for SpamAssassin, there's a separate limit to be aware of under the "Apache SpamAssassin" Options" tab in "WHM >> Exim Configuration Manager >> Basic Editor": Apache SpamAssassin": message size threshold to scan Per it's description: Maximum size (in kilobytes) of a message that Apache SpamAssassin" will scan. Spam emails are usually about 1-4 kB in size; therefore, it is generally wasteful to scan larger emails. Thank you.

  0
• 

  km9

  • February 28, 2018 17:31

  Good thoughts, thanks Michael, but I'm testing the filter directly using the code as above: /usr/lib/sendmail -bF /etc/cpanel_exim_system_filter -v
so I don't think any external influences would be in effect here.

  0
• 

  cPanelMichael

  • February 28, 2018 17:32

  Hello, Could you open a support ticket using the link in my signature so we can take a closer look at this issue? Thank you.

  0
• 

  km9

  • March 01, 2018 02:01

  Sure. Your Support Request ID is: 9321015

  0
• 

  km9

  • March 01, 2018 07:03

  Michael, It's the $message_body_visible Exim advanced setting that was causing the behaviour. The default cPanel value is 5k. (Exim default is 500 bytes) Exim 4.50 Specification chapter 11 Tested and working now, with the proviso that the unwanted attachment header has to occur within the first $message_body_visible bytes of the body for the filter to see it. i.e. this is not guaranteed to filter out all bad attachments. This email had just over 20k, with html text and a small jpeg before the unwanted attachment headers. I'm now using 50k as the value for the moment.

  0
• 

  cPanelMichael

  • March 01, 2018 17:32

  Hello, Thank you for sharing the outcome. I've marked this thread as solved.

  0

Please sign in to leave a comment.