I've blocked a few filetypes in ASSP, specifically wmv because I have a
few users who were being sent ridiculous amounts of them.
I've recently added a second level of attachment filtering and AV to
Exchange, and it has shown me that some of these files are actually
getting through...
The following is a successful block by ASSP from today, and two files
that made it through. The filenames that passed ASSP were 'manettes
wii.wmv ' and '200712_casa-iluminada-musica-navidad3.WMV'
Are there limitations to what filenames ASSP will block?
The successful block
*****************************************************
Nov-28-08 09:40:16 Connected: xxx.xxx.xxx.xxx
Nov-28-08 09:40:17 83217-11520 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]>
message proxied without
antispam-processing - message size (4556748) is above
500000 (npSize).
Nov-28-08 09:40:18 83217-11520 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED]
info: 1 attachment found for Level-1
Nov-28-08 09:40:18 83217-11520 [Attachment] xxx.xxx.xxx.xxx
<[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] [spam found] (bad attachment
'cat.wmv')
Nov-28-08 09:40:18 83217-11520 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED]
[SMTP Error] 554 5.7.1 File type refused.
Nov-28-08 09:40:18 Disconnected: xxx.xxx.xxx.xxx
******************************************************
Two failed blocks:
******************************************************
Nov-27-08 15:57:23 Connected: xxx.xxx.xxx.xxx
Nov-27-08 15:57:23 19443-17364 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]>
message proxied without
antispam-processing - message size (4022353) is above
500000 (npSize).
Nov-27-08 15:57:25 19443-17364 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED]
ClamAV: scanned 100000 bytes in noprocessing message
- OK
Nov-27-08 15:57:25 19443-17364 [NoProcessing] xxx.xxx.xxx.xxx
<[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] message proxied without
processing (no bad attachments)
Nov-27-08 15:58:10 Disconnected: xxx.xxx.xxx.xxx
---------------------------------------------
Nov-27-08 20:05:55 Connected: xxx.xxx.xxx.xxx
Nov-27-08 20:05:55 34355-14535 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]>
message proxied without
antispam-processing - message size (5075968) is above
500000 (npSize).
Nov-27-08 20:05:57 34355-14535 xxx.xxx.xxx.xxx <[EMAIL PROTECTED]> to:
[EMAIL PROTECTED]
ClamAV: scanned 100000 bytes in noprocessing message - OK
Nov-27-08 20:05:57 34355-14535 [NoProcessing] xxx.xxx.xxx.xxx
<[EMAIL PROTECTED]> to:
[EMAIL PROTECTED] message proxied without
processing (no bad attachments)
Nov-27-08 20:06:32 Disconnected: xxx.xxx.xxx.xxx
****************************************************
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
