Rules to catch filetype extensions of attachments

[Geoff Soper <ge...@alphaworks.co.uk>]

Could someone point me in the direction of a rule that would let me catch
certain filetype extensions in attachements to emails?

Thanks,
Geoff

Re: Rules to catch filetype extensions of attachments

[John Hardin <jo...@aproposretail.com>]

On Sat, 2004-05-22 at 16:29, Geoff Soper wrote:
> Could someone point me in the direction of a rule that would let me catch
> certain filetype extensions in attachements to emails?

http://www.impsec.org/email-tools/procmail-security.html

--
John Hardin  KA7OHZ                           <jo...@aproposretail.com>
Internal Systems Administrator                    voice: (425) 672-1304
Apropos Retail Management Systems, Inc.             fax: (425) 672-0192
-----------------------------------------------------------------------
  Failure to plan ahead on someone else's part does not constitute an
  emergency on my part.
                                  - David W. Barts in a.s.r
-----------------------------------------------------------------------
 Today: Internal Corp 3.0.6 + Ascent LHF upgrade

Re: Rules to catch filetype extensions of attachments

[Loren Wilton <lw...@earthlink.net>]

I assume you want to catch the usual PC virus attachments.  Can't do it.
The information you want gets stripped out before the rules get run, so
there is nothing to look at.

In fact, all "binary" attachments are removed from the mail before it is
parsed.  This unfortunately includes the mime-part header also being
removed.

        Loren

----- Original Message ----- 
From: "Geoff Soper" <ge...@alphaworks.co.uk>
To: <sp...@incubator.apache.org>
Sent: Saturday, May 22, 2004 4:29 PM
Subject: Rules to catch filetype extensions of attachments


> Could someone point me in the direction of a rule that would let me catch
> certain filetype extensions in attachements to emails?
>
> Thanks,
> Geoff
>
>

Re: Rules to catch filetype extensions of attachments

[jdow <jd...@earthlink.net>]

From: "Geoff Soper" <ge...@alphaworks.co.uk>

> Could someone point me in the direction of a rule that would let me catch
> certain filetype extensions in attachements to emails?

This is for double extensions, Goeff. But you should be able to work out
a single extension version. (This is a second layer on the procmail rules
that should be filtering these exceptions here.)

full            LOC_DBLEXT
/name="?[^"]*\.(?:html?|txt|doc|jpe?g|gif|wpd|pdf|zip)\.(?:pif|exe|com|cmd|b
at|scr)/i
describe        LOC_DBLEXT      Message has VIRUS-style double extension
score           LOC_DBLEXT      2.5

Mind the wrap.
{^_^}