<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 17/07/2024 4:48 am, Thomas Barth
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:f951586680fe1de19e830718de697098@txbweb.de">Hello,
<br>
<br>
today a mail has been banned (false positive). It says message
contains x.com
<br>
<br>
X-Quarantine-ID: <gUr-nLm4MOSm>
<br>
X-Amavis-Alert: BANNED, message contains x.com
<br>
<br>
<br>
I couldnt find x.com in the mail body itself, but the mail had a
zipfile as an attachment. The zip file probably contains invoices.
<br>
<br>
I grepped for x.com in the config files, but I couldnt find a
rule.
<br>
<br>
grep -nri "x.com" /etc/amavis/
<br>
/etc/amavis/conf.d/20-debian_defaults:123:# [
qr'^\.(Z|gz|bz2)$' => 0 ], # allow any in
Unix-compressed
<br>
/etc/amavis/conf.d/20-debian_defaults:200:
#'<a class="moz-txt-link-abbreviated" href="mailto:clusternews@linuxnetworx.com">clusternews@linuxnetworx.com</a>' => -3.0,
<br>
<br>
In the journal:
<br>
Jul 16 14:55:07 mx2 amavis[578842]: (578842-12) Blocked BANNED
(x.com) {DiscardedInbound,Quarantined}, [209.85.128.42]:58456
[2a02:2455:17d4:d000:2d23:f49f:1017:f822]
<a class="moz-txt-link-rfc2396E" href="mailto:user@fromexample.com"><user@fromexample.com></a> -> <a class="moz-txt-link-rfc2396E" href="mailto:user@toexample.com"><user@toexample.com></a>,
quarantine: q/banned->
<br>
Jul 16 14:55:07 mx2 postfix/smtpd[582562]: proxy-accept:
END-OF-MESSAGE: 250 2.7.0 Ok, discarded, id=578842-12 - BANNED:
x.com; ...
<br>
<br>
Anyone have any idea what's going wrong here?
<br>
<br>
Thomas B
<br>
</blockquote>
<p>Hi Thomas.</p>
<p>I believe the culprit is the following line in
/etc/amavis/conf.d/20-debian_defaults:</p>
<blockquote>
<p>qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension
- basic<br>
</p>
</blockquote>
<p>...which is designed to block filenames that have a ".com"
extension. i.e. You could try removing com from that expression?</p>
<p>Please also be aware of this one:</p>
<blockquote>
<p># block certain double extensions anywhere in the base name<br>
qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,<br>
</p>
</blockquote>
<p>...which could get a hit on directories that include ".com." in
the name (e.g. if a directory was named "google.com.au").<br>
</p>
<p>Nick.<br>
</p>
</body>
</html>