Page 2 of 2
Re: rules no longer working
Posted: 13 Jun 2022, 18:05
by keat63
Filename.rules and filetype.rules look slightly different when you open them
Anyhow I added
deny \.xls$
deny \.zip$
to filetype.rules, too early to tell if this is working just yet.
Re: rules no longer working
Posted: 13 Jun 2022, 18:27
by Sarah
That is not going to work, you need to do what I suggested and check what the "file" command says about the file you want to block.
Re: rules no longer working
Posted: 14 Jun 2022, 08:48
by keat63
I've no ide what i'd be doing, and generally I would experiment and see what I get.
However, I'm not sure that I dare run the file command in this instant, the files in question are virus infected files.
so Instead I created an empt xls and then zipped this.
Running the file command gave:
Book1.xls: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Windows User, Last Saved By: Windows User, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Jun 14 08:48:53 2022, Last Saved Time/Date: Tue Jun 14 08:49:02 2022, Security: 0
Book1.zip: Zip archive data, at least v2.0 to extract
but means nothing to me.
Re: rules no longer working
Posted: 14 Jun 2022, 09:03
by Sarah
I wouldn't do the file command on the zip file but on the xls file. MailScanner will scan within zip archives. Otherwise you'll just block all zip files. Unfortunately I can't really help any further on how to use the results of the file command, you'll need to find this information elsewhere. Maybe someone else on this forum will be able to help.