Hello!
On Wed, 21 Dec 2016 at 16:11:21 (+0200), Victor Cheburkin wrote:
> > Было правило и вроде работало (когда добавлял).
> > deny message = This message contains dangerous file(s) in
> > ${uc:${extract{-1}{.}{$mime_filename}}} attachment.
> > condition = ${if <{$message_size}{2500K}{1}{0}}
> > condition = ${if
> > match{$mime_filename}{\N(?i)\.(7z|arj|bz2|gz|rar|uue|z|zip|xz)$\N}}
> > decode = default
> > condition = ${if match{${run{/usr/local/bin/7z l
> > $mime_decoded_filename}}}
> > {\N(?i)\.(com|pif|scr|lnk|exe|js|zip|jar|bat|cmd)\n\N} }
> > log_message = REJECTED: dangerous file in
> > ${uc:${extract{-1}{.}{$mime_filename}}} attachment
> > Но сегодня пришел "злобный" вирус в письме с вложением "Новый.scr.uue"
> > ------=_NextPart_000_0A96_01D25B89.ECC77EF0
> > Content-Type: application/octet-stream;
> > name="=?windows-1251?B?ze7i++kuc2NyLnV1ZQ==?="
> > Content-Transfer-Encoding: base64
> > Content-Disposition: attachment;
> > filename="=?windows-1251?B?ze7i++kuc2NyLnV1ZQ==?="
> > И правило не сработало :(
> А если
> ${if match {${rfc2047d:$mime_filename}}
> ?
Или decode отдельным acl'ем (через warn) и match имени аттача по
$mime_decoded_filename
--
George L. Yermulnik
[YZ-RIPE]
_______________________________________________
Exim-users mailing list
[email protected]
http://mailground.net/mailman/listinfo/exim-users
