Filtering attachments via a Sendmail ruleset?
Hey Guys, Really simple question here... A while back I had asked whether sendmail could filter out mail based on a subject header , and found out that it could. Now I have a situation here at work where we want to filter out attachments, the obvious being .vbs, .exe, basically anything that may contain a virus. We don't run anti-virus software on the mail server that mail is being delivered to, nor on the sendmail relays feeding into it, since they are Solaris boxes and we currently don't have a unix version of Norton lying about. But I believe that we can filter out attachments through a sendmail ruleset, and I am wondering if this is the case. If so, can someone tell me how/where to do it please? Would be very appreciative for any help here! Thanks in advance! Dave
On Thu, Apr 05, 2001 at 11:10:10AM -0700, Dave Coutu wrote:
could. Now I have a situation here at work where we want to filter out att= achments, the obvious being .vbs, .exe, basically anything that may contain= a virus. We don't run anti-virus software on the mail server that mail is= being delivered to, nor on the sendmail relays feeding into it, since the= y are Solaris boxes and we currently don't have a unix version of Norton ly= ing about. But I believe that we can filter out attachments through a send= mail ruleset, and I am wondering if this is the case. If so, can someone t= ell me how/where to do it please? Would be very appreciative for any help = here! Thanks in advance!
You can't filter the message content using a ruleset (which is where attachments are located), but you can use the new milter API to do filtering. It's available in 8.10.x and later, but you might as well use 8.11.3 if you're going to upgrade anytime soon. I'm currently setting up this exact type of filtering at my current client by using a tool called MIMEdefang (http://www.roaringpenguin.com/mimedefang/). The examples that come with it show you how to filter out attachments that you don't want, but the main bits are in Perl so you can configure to your heart's content. :) Basically a C program interfaces with sendmail. That C program (per message -- not per recipient/etc) then calls a perl script which reads your configuration and acts appropriately. Right now, I have it striping out vbs/exe/com/bat attachments (removed the attachment from the mail and adds a text/plain section explaining that the attachment was removed). It's not the easiest bit of software to get installed and running, but if you're comfortable with compiling/installing from source and at least semi-comfortable with sendmail configuration (the amount needed for milter isn't much), then you'll be golden. -- Randomly Generated Tagline: I expect people to expect Perl to do the right thing. -- Larry Wall in <199911192358.PAA24109@kiev.wall.org>
Dave Coutu said:
Hey Guys,
Really simple question here... A while back I had asked whether sendmail could filter out mail based on a subject header , and found out that it could. Now I have a situation here at work where we want to filter out attachments, the obvious being .vbs, .exe, basically anything that may contain a virus. We don't run anti-virus software on the mail server that mail is being delivered to, nor on the sendmail relays feeding into it, since they are Solaris boxes and we currently don't have a unix version of Norton lying about. But I believe that we can filter out attachments through a sendmail ruleset, and I am wondering if this is the case. If so, can someone tell me how/where to do it please? Would be very appreciative for any help here! Thanks in advance!
Dave
Not sure if this helps, but a friend of mine was working on this email scanning stuff: http://pldaniels.com/ Check out Inflex and Ebola. XaMime is a commercial version of Inflex, I believe. It's also in rather early development, afaik. Any questions, he's usually on #linuxhelp on irc.slashnet.org as "inflex". -- Orion orion [at] tribble [dot] dyndns [dot] org Spund is cool. Great sounding word. Kind o' thing Meg'd say. -freakstone
participants (3)
-
Dave Coutu
-
Orion
-
Theo Van Dinter