Skip to main content

Comments

5 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  Instead of a comma these would need to be separated with a pipe - |

    Can you post the exact formatting of the file you used so I can test this on my end?

    0
  • Stavros S
    • Edited

    Hello cPRex thank you for your response! 

    Of course here is it: 

    # Look for single part MIME messages with suspicious name extensions
    # Check Content-Type header using quoted filename [content_type_quoted_fn_match]
    if $header_content-type: matches "(?:file)?name=(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]|lzh|xlsx|Z|z|img|IMG|arj|GZ|gz|jar|dot|html|htm|xlam|xla|tar|rar|zipx|tar.gz|exe|zip|7z)\")"
    then
      fail text "This message has been rejected because it has\n\
    	     potentially executable content $1\n\
    	     This form of attachment has been used by\n\
                 recent viruses or other malware.\n\
    	     If you meant to send this file then please\n\
    	     use a file sharing platform like Wetranfer."
      seen finish
    endif
    # same again using unquoted filename [content_type_unquoted_fn_match]
    if $header_content-type: matches "(?:file)?name=(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]|lzh|xlsx|Z|z|img|IMG|arj|GZ|gz|jar|dot|html|htm|xlam|xla|tar|rar|zipx|tar.gz|exe|zip|7z))([\\\\s;]|\\$)"
    then
      fail text "This message has been rejected because it has\n\
    	     potentially executable content $1\n\
    	     This form of attachment has been used by\n\
                 recent viruses or other malware.\n\
    	     If you meant to send this file then please\n\
    	     use a file sharing platform like Wetranfer."
      seen finish
    endif

    # Attempt to catch embedded VBS attachments
    # in emails.   These were used as the basis for
    # the ILOVEYOU virus and its variants - many many varients
    # Quoted filename - [body_quoted_fn_match]
    if $message_body matches "(?:Content-(?:Type:(?\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?\\\\s*)attachment);(?\\\\s*)(?:file)?name=|begin(?\\\\s+)[0-7]{3,4}(?\\\\s+))(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]|lzh|xlsx|Z|z|img|IMG|arj|GZ|gz|jar|dot|html|htm|xlam|xla|tar|rar|zipx|tar.gz|exe|zip|7z)\")[\\\\s;]"
    then
      fail text "This message has been rejected because it has\n\
    	     a potentially executable attachment $1\n\
    	     This form of attachment has been used by\n\
                 recent viruses or other malware.\n\
    	     If you meant to send this file then please\n\
    	     use a file sharing platform like Wetranfer."
      seen finish
    endif
    # same again using unquoted filename [body_unquoted_fn_match]
    if $message_body matches "(?:Content-(?:Type:(?\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?\\\\s*)attachment);(?\\\\s*)(?:file)?name=|begin(?\\\\s+)[0-7]{3,4}(?\\\\s+))(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]|lzh|xlsx|Z|z|img|IMG|arj|GZ|gz|jar|dot|html|htm|xlam|xla|tar|rar|zipx|tar.gz|exe|zip|7z))[\\\\s;]"
    then
      fail text "This message has been rejected because it has\n\
    	     a potentially executable attachment $1\n\
    	     This form of attachment has been used by\n\
                 recent viruses or other malware.\n\
    	     If you meant to send this file then please\n\
    	     use a file sharing platform like Wetranfer."
      seen finish
    endif

    Two spots need to be take under consideration:

    1. I’m using Z and GZ, which could also appear as .z and .gz.
      Will they still work if I leave them in uppercase, or should I convert them to lowercase because of case sensitivity?
    2. I block the .zip file attachments and i am wondering if the message could be updated to something else. What's your suggestion?

    Thank you!

    0
  • cPRex Jurassic Moderator

    1 - From what I'm seeing in an older post, that specific area shouldn't be case sensitive:

    https://support.cpanel.net/hc/en-us/community/posts/23655120337943-Facing-an-issue-while-adding-a-exim-filter-that-the-working-is-case-sensitive

    2 - Did you want to change this for only the .zip? I'm not sure that's possible.

    In general, it looks like your file is formatted properly so I'm not sure why that isn't processing the requests as you are expecting.  It might be best to create a ticket so this can be tested on your machine.

    0
  • Stavros S
    • Edited

    I have updated the custom_attachments file in my previous message above. Once i create the file with nano command and this content (see above), rebuild the exim configuration and restart the exim... i receive no messages at all. Not only the one i have attachment but also the messages with no attachments at all!

    Can we guess what could cause such issue?

    0
  • cPRex Jurassic Moderator

    No, I'm not sure what would be causing that as nothing obvious sticks out to me.  If you're not seeing any obvious warnings from the Exim rebuild or restart, I'd recommend creating a ticket.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post