Report: MailScanner: No programs allowed

[ausdamo]

Hi,

I read in the FAQ's (#12) that it may be an issue with the Linux File command if the file is being reported incorrectly. When I run File on these attachments (after uploading them to the server) they are reported as images, not programs.

Report: MailScanner: No programs allowed (ByMaxRibbonforNev.eps)
Report: MailScanner: No programs allowed (ByMaxRibbonforNev.psd)
Report: MailScanner: No programs allowed (._ByMaxRibbonforNev.psd)

How do I go about allowing these files?

[ausdamo]

Is anyone able to offer any suggestions or direction on which settings to look at?

[Sarah]

It may be that the files are being wrongly identified by the Linux file command. You can test this by placing a copy of the attachment on the server and running this command in that directory:

file filename.psd

If the file command is giving the wrong filetype and attachments are being blocked that shouldn't be, you can use the MIME type for the filetype rules in addition.

Run "file -i" on the file on the server to find out the correct type to use, it will be the phrase before the semicolon, i.e.:

root@server[/]# file -i test.txt
test.txt: text/plain; charset=us-ascii

It's "text/plain". You would put this as the THIRD field in filetype.rules.conf file, i.e.:

allow<tab>text<tab>text/plain<tab>-<tab>-

So there are five fields in all, separated by tabs.

Alternatively you can list it in the MailScanner configuration by adding the MIME type to the "Allow File MIME Types = " setting.

NOTE: We can't make any guarantees about how this will work as we have not done any testing ourselves.

[ausdamo]

Unfortunately this didn't work. I even added it to archives.filetype.rules.conf and performed a mailscanner reload each time I edited.

I'm at a loss to how to get these files accepted. It's only been happening for the past few weeks that I'm aware of. Is no-one else that's reading this experiencing the same issue?

Even when I release the file via quarantine it just gets blocked again. The email subject is "Warning: E-mail viruses detected"

[ausdamo]

Just adding to my last post. This is the contents of the .conf file (I added extra ... and .... to see which rule was triggered. It turns out to be the first rule with ...)

Code: Select all

allow   text            -                       -
allow   \bscript        -                       -
allow   archive         -                       -
allow   postscript      -                       -
allow   EPS     image/x-photoshop       -       -
allow   PSD     application/octet-stream        -       -
deny    self-extract    No self-extracting archives     No self-extracting archives allowed
deny    executable      No executables          No programs allowed...
#EXAMPLE: deny  -       x-dosexec       No DOS executables      No DOS programs allowed
deny    ELF             No executables          No programs allowed....
deny    Registry        No Windows Registry entries     No Windows Registry files allowed

#deny   MPEG            No MPEG movies          No MPEG movies allowed
#deny   AVI             No AVI movies           No AVI movies allowed
#deny   MNG             No MNG/PNG movies       No MNG movies allowed
#deny   QuickTime       No QuickTime movies     No QuickTime movies allowed
#deny   ASF             No Windows media        No Windows media files allowed
#deny   metafont        No Windows Metafont drawings    No WMF drawings allowed

The PSD file is reported as "application/octet-stream" by file -i

[ausdamo]

Ok, after some more digging around in the mailscanner list it appears to be an issue with Archive::Zip. The following thread (you'll need to read the entire thread) details it nicely.

http://lists.mailscanner.info/pipermail ... 95861.html

Until it's sorted in a release of mailscanner I've just turned off scanning into archives (depth 0) to get around it

[netfluence]

Has the following been resolved in v2.78 update and MailScanner - v4.81.4?

=================================

Ok, after some more digging around in the mailscanner list it appears to be an issue with Archive::Zip. The following thread (you'll need to read the entire thread) details it nicely.

http://lists.mailscanner.info/pipermail ... 95861.html

Until it's sorted in a release of mailscanner I've just turned off scanning into archives (depth 0) to get around it

=================================

Thanks

[Sarah]

If it is a problem in MailScanner you should check the changelog to see if it has been fixed in the latest version that we've released with our install script. It's not something we can fix ourselves.

Regards,
Sarah