<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 5/17/11 2:05 PM, Andreas Schulze wrote:
<blockquote
cite="mid:20110517180504.GA26054@spider.services.datevnet.de"
type="cite">
<pre wrap="">Michael,
</pre>
<blockquote type="cite">
<pre wrap="">what is best way to do it? I think I can have clamav do it, or
amavisd-do it, right?
</pre>
</blockquote>
<pre wrap="">
yes you can use both.
as far as I know, amavisd can detect all what clamav also can detect.
but keep in mind that the next clamav release will improve the handling of encrypted pdf.
Andreas
</pre>
</blockquote>
hint as to how to do it in amavisd-new with policy based sql?<br>
<br>
test file is a password protected (-e) zip with a jpg in it.<br>
<br>
I got for @. (id1), policy=101<br>
for policy 101, I have banned_rulenames: NO-ENCRYPT,NO-EXE<br>
<br>
in amavisd.conf<br>
<br>
%banned_rules = (<br>
''NO-EXE' => new_RE(
qr'.\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|url|vbe|vbs)$'i,
),<br>
'NO-ENCRYPT' => new_RE( qr'.\.(UNDECIPHERABLE)$'i, ),<br>
'DEFAULT' => new_RE( [ qr'.*' => 0 ]),<br>
);<br>
<br>
amavisd does know its protected, the subject line gets changed to
*** UNCHECKED ***<br>
<br>
<br>
<br>
<br>
<div class="moz-signature">-- <br>
Michael Scheidell, CTO<br>
o: 561-999-5000<br>
d: 561-948-2259<br>
ISN: 1259*1300<br>
<font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
Network Security Corporation
<style type="text/css">
<!--
.unnamed1 {
margin: 1em;
padding: 1px;
} -->
</style>
<ul class="unnamed1">
<li>Best Intrusion Prevention Product, Networks Product Guide</li>
<li>Certified SNORT Integrator</li>
<li>Hot Company Award, World Executive Alliance</li>
<li>Best in Email Security, 2010 Network Products Guide</li>
<li>King of Spam Filters, SC Magazine</li>
</ul>
</div>
<br>
<div id="disclaimer.secnap.com"><hr />
<p>This email has been scanned and certified safe by SpammerTrap®.
<br />For Information please see
<a href="http://www.secnap.com/products/spammertrap/">http://www.secnap.com/products/spammertrap/</a></p> <hr /></div>
<br>
</body>
</html>