>I am currently blocking VBS and SCR extensions using rules.ima. > >Does anyone recommend any other extensions to block?
you can pick out the extensions we run in IMGate from these regex's (wrapped) /^(content.*[[:space:]]+|[[:space:]]*)(filename|name)=".*\.(exe|eml|dll|scr|pif|com|bat|shs|shb|vxd|rm|chm|vbs|ini|cmd|do|hta|reg|lnk|js|jse)"/ REJECT #double extensions, w and w/o double quotes: /^Content-Disposition: attachment; filename=".*\.(doc|zip|exe|xls|jpg|gif)\.(scr|pif|bat|com|exe|lnk)"$/ REJECT /^Content-Disposition: attachment; filename=.*\.(doc|zip|exe|xls|jpg|gif)\.(scr|pif|bat|com|exe|lnk)$/ REJECT A smarter policy would be "default block" all extensions, and then before that, make your "pass" extensions rule. >Also, I wrote a short little cold fusion script that copies the master .ima >file to all of my various domains. I would be happy to post that here if >anyone is interested. That's another advantage of IMGate policies, they are global by default for all domains, with exceptions per-domain or per-user. Len Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
