1

Topic: ZIP and RAR contents blocking

==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- Related log if you're reporting an issue:
======== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.0
- Linux/BSD distribution name and version: Centos 6.6
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): PGSQL
- Web server (Apache or Nginx):Apache
- Manage mail accounts with iRedAdmin-Pro? v1.5.2 (PostgreSQL)
- Related log if you're reporting an issue:
====

hi,

how do i block the following content files inside archived zip & rar files

Zipped - ZIP
1. with .js
2. with .chm

RAR - required to block
1. Rar with .exe
2. rar with .chm
3. rar with .js

below is my current setting of 'amavisd.conf'

$banned_filename_re = new_RE(

### BLOCKED ANYWHERE
# qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
  qr'^\.(exe-ms|dll)$',                   # banned file(1) types, rudimentary
  qr'^\.(exe|lha|cab|dll)$',              # banned file(1) types

### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
#  [ qr'^\.(gz|bz2)$'             => 0 ],  # allow any in gzip or bzip2
#  [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives

  qr'.\.(pif|scr)$'i,                     # banned extensions - rudimentary
# qr'^\.zip$',                            # block zip type

### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within these archives
# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 1 ],  # block any within these archives

  qr'^application/x-msdownload$'i,        # block these MIME types
  qr'^application/x-msdos-program$'i,
  qr'^application/hta$'i,

# qr'^message/partial$'i,         # rfc2046 MIME type
# qr'^message/external-body$'i,   # rfc2046 MIME type

# qr'^(application/x-msmetafile|image/x-wmf)$'i,  # Windows Metafile MIME type
# qr'^\.wmf$',                            # Windows Metafile file(1) type

  # block certain double extensions in filenames
  qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,

# qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Class ID CLSID, strict
# qr'\{[0-9a-z]{4,}(-[0-9a-z]{4,}){0,7}\}?'i, # Class ID extension CLSID, loose

  qr'.\.(exe|vbs|pif|scr|cpl)$'i,             # banned extension - basic
# qr'.\.(exe|vbs|pif|scr|cpl|bat|cmd|com)$'i, # banned extension - basic+cmd
  qr'.\.(ade|adp|app|bas|bat|cab|chm|cmd|com|cpl|crt|exe|fxp|grp|hlp|hta|
         inf|ini|ins|isp|js|jse|lib|lnk|mda|mdb|mde|mdt|mdw|mdz|msc|msi|
         msp|mst|ocx|ops|pcd|pif|prg|reg|scr|sct|shb|shs|sys|tar|vb|vbe|vbs|vxd|
         wsc|wsf|wsh)$'ix,                # banned extensions - long
  qr'.\.(asd|asf|asx|url|vcs|wmd|wmz)$'i,     # consider also
  qr'.\.(ani|cur|ico)$'i,                 # banned cursors and icons filename
  qr'^\.ani$',                            # banned animated cursor file(1) type
  qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.
);

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: ZIP and RAR contents blocking

Please check two items in our upgrade tutorial, do they help a little?

* Fixed: Amavisd cannot ban zipped .exe attachment file.
* Fixed: Amavisd cannot detect .exe file in rar compressed attachment.

http://www.iredmail.org/docs/upgrade.ir … 0.9.1.html

3

Re: ZIP and RAR contents blocking

it works  Zhang. Thank you. smile