for people using Postfix Mail Server - GoFuckYourself.com

Gateway69 · 09-04-2003, 12:35 AM

I found this little article the other day while looking for ways to block all that fucking virus shit thats being sent around..

blocking mime types seems pretty easy.. here is an insert from the web page on how do to it. not this is for postfix 2.x

Generic solution: mime_header_checks (Postfix-2.x only!)
The generic solution is to disallow certain known to be dangerous attachment types. Basically, this is everything Microsoft invented. In main.cf you must use:
mime_header_checks = regexp:/etc/postfix/mime_header_checks.regexp

And /etc/postfix/mime_header_checks.regexp (download it here) contains:
/filename=\"?(.*)\.(bat|chm|cmd|com|do|exe|hta|jse| rm|scr|pif|vbe|vbs|vxd|xl)\"?$/
REJECT For security reasons we reject attachments of this type

Georg Gell recommends that you could also use:
mime_header_checks = regexp:/etc/postfix/mime_header_checks.regexp

and /etc/postfix/mime_header_checks.regexp (download it here) contains:
/^\s*Content-(Disposition|Type).*name\s*=\s*"?(.+\.(lnk|asd|hlp |ocx|reg|bat|c[ho]m|cmd|exe|dll|vxd|pif|scr|hta|jse?|sh[mbs]|vb[esx]|ws[fh]|wav|mov|wmf|xl))"?\s*$/
REJECT Attachment type not allowed. File "$2" has the unacceptable extension "$3"

The leading spaces before REJECT are important in both cases!
Don't forget "postfix reload"!

this really helped alot..

more from the site here:

http://sbserv.stahl.bau.tu-bs.de/~hi...x_sobigf.shtml

Why · 09-04-2003, 12:46 AM

i thought everyone already did that, but apparently all "admins" of the world are too fucking stupid to complete such a simple task.

09-04-2003, 12:35 AM	#1
Gateway69 Confirmed User Join Date: Jul 2002 Posts: 1,510	for people using Postfix Mail Server I found this little article the other day while looking for ways to block all that fucking virus shit thats being sent around.. blocking mime types seems pretty easy.. here is an insert from the web page on how do to it. not this is for postfix 2.x Generic solution: mime_header_checks (Postfix-2.x only!) The generic solution is to disallow certain known to be dangerous attachment types. Basically, this is everything Microsoft invented. In main.cf you must use: mime_header_checks = regexp:/etc/postfix/mime_header_checks.regexp And /etc/postfix/mime_header_checks.regexp (download it here) contains: /filename=\"?(.)\.(bat\|chm\|cmd\|com\|do\|exe\|hta\|jse\| rm\|scr\|pif\|vbe\|vbs\|vxd\|xl)\"?$/ REJECT For security reasons we reject attachments of this type Georg Gell recommends that you could also use: mime_header_checks = regexp:/etc/postfix/mime_header_checks.regexp and /etc/postfix/mime_header_checks.regexp (download it here) contains: /^\sContent-(Disposition\|Type).name\s=\s"?(.+\.(lnk\|asd\|hlp \|ocx\|reg\|bat\|c[ho]m\|cmd\|exe\|dll\|vxd\|pif\|scr\|hta\|jse?\|sh[mbs]\|vb[esx]\|ws[fh]\|wav\|mov\|wmf\|xl))"?\s$/ REJECT Attachment type not allowed. File "$2" has the unacceptable extension "$3" The leading spaces before REJECT are important in both cases! Don't forget "postfix reload"! this really helped alot.. more from the site here: http://sbserv.stahl.bau.tu-bs.de/~hi...x_sobigf.shtml __________________ Gateway - Tech Guru Dreaming Computers IG

09-04-2003, 12:46 AM	#2
Why MFBA Industry Role: Join Date: Mar 2003 Location: PNW Posts: 7,230	i thought everyone already did that, but apparently all "admins" of the world are too fucking stupid to complete such a simple task.