On one of my mail servers, it is able to peek into a zip and look for file types. So I set it to block exe, bat, etc. Otherwise, zip is fine.
Perhaps this would be an easy addition to ASSP. I'll see if I can write a small perl script to do this. Fritz, if i write it in bash, can that be called within the ASSP scanning process? I feel this approach, whether bash or perl is better than letting it get as far as hitting CLAM, which is my last line as it is too resource heavy. In 5+ years I had 2 false positives on my old server with this "look into a zip" method. Both times they were zipped zip files, and the developer patched them quickly. It's something worth looking into. -- Scott (Sent from a mobile device) On Feb 11, 2010, at 10:21 PM, <[email protected]> wrote: > Hello List, > > I am trying to block attached zip files. I ask senders to rename the > file .zap to get it through. > My users are still recieving .zip files. In frustration I have added > zip to ALL the levels, with no success. > > Can anyone help? > > Here is my config: > > assp version = 1.5.1.1(1.0.04) > > *********************** > * Attachment Blocking > *********************** > (DoBlockExes) = block > (BlockExes) = Level1 > (BlockWLExes) = Level1 > (BlockNPExes) = Level0 > > BadAttachL1) = > zip|ad[ep]|as[fx]|ba[st]|bin|chm|cmd|com|cpl|crt|dbx|dll|exe|hiv|hlp| > in[ > fs]|isp|js|jse|lnk|md[abez]|mht|ms[chipt]|nch|obj|ocx|oft|ovl|pcd| > pif|pl > |prf|ps1|reg|sc[frt]|sh|sh[bs]|sys|url|vb|vb[es]|vs[st]|vxd|wm[dsvz]| > ws[ > cfh] > > (BadAttachL2) = ht[abm]|html|zip > > (BadAttachL3) = zip|url > > (GoodAttach) = > ai|asc|bhx|dat|doc|eml|eps|gif|ics|jpg|jpeg|hqx|pdf|ppt|rar|rpt|rtf| > snp| > tif|tiff|txt|trx|wpd|xls|zap|igs|dxf|png > > *********************** > *ClamAVBytes > *********************** > (UseAvClamd) = checked > (DoFileScan) = disabled > > Regards - Chris > > --- > --- > --- > --------------------------------------------------------------------- > SOLARIS 10 is the OS for Data Centers - provides features such as > DTrace, > Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW > http://p.sf.net/sfu/solaris-dev2dev > _______________________________________________ > Assp-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/assp-user ------------------------------------------------------------------------------ SOLARIS 10 is the OS for Data Centers - provides features such as DTrace, Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW http://p.sf.net/sfu/solaris-dev2dev _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
