Full Disclosure mailing list archives
Re: Re: Filtering sobig with postfix
From: Andrew J Caines <A.J.Caines () halplant com>
Date: Sat, 23 Aug 2003 19:04:14 -0400
vogt () hansenet com said...
Thought about that, but doesn't quite work. The headers only say multipart/mime. The .pif part comes later in the attachment.
You want mime_header_checks, eg. # postconf mime_header_checks mime_header_checks = pcre:/etc/postfix/mime_header # cat /etc/postfix/mime_header /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.*\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|dll|doc|exe|hlp|hta|inf|ins|isp|js|jse|lnk|mde|mdt|mdw|msc|msi|msp|mst|nws|ops|pcd|pif|ppt|prf|reg|scf|scr|sct|shb|shs|shm|swf|vb|vbe|vbs|vbx|vxd|wsc|wsf|wsh|xls))"?\s*$/x REJECT Attachment violates server policy. See http://your.web.site/Mail_ToS.html There is much discussion of this in the postfix-users mailing list archives[1]. [1] See eg. http://msgs.securepoint.com/postfix/ -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines () halplant com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 | _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Re: Filtering sobig with postfix, (continued)
- Re: Re: Filtering sobig with postfix martin f krafft (Aug 20)
- Re: Re: Filtering sobig with postfix gregh (Aug 20)
- AW: Re: Filtering sobig with postfix vogt (Aug 20)
- Re: Re: Filtering sobig with postfix martin f krafft (Aug 20)
- Re: Re: Filtering sobig with postfix martin f krafft (Aug 20)
- AW: Re: Filtering sobig with postfix vogt (Aug 21)
- RE: Re: Filtering sobig with postfix Bojan Zdrnja (Aug 21)
- Re: Re: Filtering sobig with postfix Irwan Hadi (Aug 21)
- RE: Re: Filtering sobig with postfix Bojan Zdrnja (Aug 21)
- RE: Re: Filtering sobig with postfix Bojan Zdrnja (Aug 21)
- Re: Re: Filtering sobig with postfix Robert Banniza (Aug 23)
- Re: Re: Filtering sobig with postfix Andrew J Caines (Aug 23)