<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-NZ link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Can anyone point me to some extensive documentation on the Banned_filename_maps handling??<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’ve looked and looked and can’t find any that covers it extensively. I’m hitting walls with my rules – Because I don’t want to block TNEF as many businesses send each other mail in this format I have a lot getting through that shouldn’t. I try and allow DOC (with ClamAV stopping any containing macro’s) but AMAVIS identifies it as a mime type of DAT. If I allow DAT then that rule then allows pretty much any application/octet-stream through.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>What I’m trying hard to achieve is essentially a whitelist of extensions so allow<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>.DOC .DOCX .XLS .XLSX .JPG .JPEG .GIF .PNG .TXT .ASC .PDF<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>And then block anything else but because of the way it seems to put Mime mapping ahead of literal filename extensions things end up not working. A .DOC gets blocked on the mime type, adding the rule to allow that mime type means a .GFD random binary file gets let through. I know if we ignore mime types and real file type analysis in theory a user could be emailed an EXE file with instructions to save it and rename it and then run it but in reality the people who are going to be stupid enough to open what most would see as an obvious malware dropper aren’t going to handle those instructions.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I know that with REGEX a ^ at the start is if looking for a match at the beginning of the string but I saw another thread talking about Banned_Filename_maps that having the ^ (or perhaps not having it, lost the thread) denoted whether looking at the filename as detected by the file command or looking at the filename reported in the email body but it didn’t work for me. I’d like to be handling the email reported filename as that the one that counts.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Again – Its not just Regular expressions I need as the problem is I’m not certain of what data is being fed to the regular expression to handle.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The idea of having a list of types to block is becoming too dangerous as the Cryptolocker authors are getting too clever with their droppers. Nearly every attachment blocking example I’ve seen for amavis ignores .JAR and yet I’ve seen a .JAR dropper via email recently so relying on people to thing of every potentially dangerous file type is too risky. These guys will try the super obscure as it’s a numbers game and even if they try a filetype that only one piece of proprietary software will script they’ll try it if it gets around blockers.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any help on this is greatly appreciated. I don’t want to have to learn python and get the source code for Amavisd-new to understand how the feature works but the documentation I’ve found is either VERY simplistic or missing altogether. I can’t find ANY reference to the BANNED_FILENAME_MAPS in the manual at all other than a mention of the command existing.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>