Forum Debian Users Gang

lopezpb · 2008-08-26 12:36:47

Mam problem, postawiłem serwer pocztowy Postfix+Amavis+Spamassasin+CalmAV, wszystko działa bardzo dobrze, jednak mam mały problem. A mianowicie za każdym razem gdy próbuje wysłać spakowany plik exe dostaję zwrotkę

Kod:

BANNED message from you (multipart/mixed | application/zip,.zip,nazwapliku.zip | .exe,.exe-ms,nazwapliku.exe)

Próbowałem zmieniać konfiguracje pliku

Kod:

/etc/amavis/conf.d/20-debian_defaults

jednak cokolwiek nie zmienię (nawet jak usunę ten plik) to amavis dalej działa jak by nigdy nic i za każdym razem pisze dokładnie to samo i w logach i w mailu

Kod:

BANNED CONTENTS ALERT

Our content checker found
    banned name: multipart/mixed | application/zip,.zip,dvdshrink32setup.zip |
      .exe,.exe-ms,dvdshrink32setup.exe

A w logach:

Kod:

Aug 26 12:23:18 mail amavis[13161]: (13161-06) p.path mail@mail.com.pl: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=txt"
Aug 26 12:23:18 mail amavis[13161]: (13161-06) doing banned check for mail@mail.com.pl on multipart/mixed | application/zip,.zip,nazwapliku.zip | .exe,.exe-ms,nazwapliku.exe
Aug 26 12:23:18 mail amavis[13161]: (13161-06) lookup (check_bann:mail@mail.com.pl) => true,  ["multipart/mixed","application/zip",".zip","nazwapliku.zip",".exe",".exe-ms","nazwapliku.exe"] matches, result="1", matching_key="(?i-xsm:.\\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$)"
Aug 26 12:23:18 mail amavis[13161]: (13161-06) p.path BANNED:1 mail@mail.com.pl: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/zip,T=zip,N=nazwapliku.zip | P=p004,L=1/2/1,T=exe,T=exe-ms,N=nazwapliku.exe", matching_key="(?i-xsm:.\\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$)"

Czy Amavis trzyma gdzieś jeszcze pliki konfiguracyjne, oprócz katalogu /etc/amavis/conf.d?

Oczywiście po kożdej zmienie robie restart amavisa /etc/init.d/amavis restart
ale to nic nie zmienia :(

Mój konfig amavisa wygląda następująco:

Kod:

use strict;   

$QUARANTINEDIR = "$MYHOME/virusmails";                                          
                                                                                
$log_level = 5;                                                                 
                                                                                
$log_recip_templ = undef;    # disable by-recipient level-0 log entries         
$DO_SYSLOG = 1;              # log via syslogd (preferred)                      
$syslog_ident = 'amavis';    # syslog ident tag, prepended to all messages      
$syslog_facility = 'mail';                                                      
$syslog_priority = 'debug';  # switch to info to drop debug output, etc         
                                                                                
$enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)  
$enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1  
                                                                                
$inet_socket_port = 10024;   # default listenting socket                        
                                                                                
$sa_spam_subject_tag = '***SPAM*** ';                                           
$sa_tag_level_deflt  = 2.0;  # add spam info headers if at, or above that level 
$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level        
$sa_kill_level_deflt = 6.31; # triggers spam evasive actions                    
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent   

$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger 
$sa_local_tests_only = 0;    # only tests which do not require internet access? 
                                                                                
# Quota limits to avoid bombs (like 42.zip)                                     
                                                                                
$MAXLEVELS = 14;                                                                
$MAXFILES = 1500;                                                               
$MIN_EXPANSION_QUOTA =      100*1024;  # bytes                                  
$MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes   

$final_virus_destiny      = D_DISCARD;  # (data not lost, see virus quarantine) 
$final_banned_destiny     = D_BOUNCE;   # D_REJECT when front-end MTA           
$final_spam_destiny       = D_BOUNCE;                                           
$final_bad_header_destiny = D_PASS;     # False-positive prone (for spam)       
                                                                                
$virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default              
                                                                                
# Leave empty (undef) to add no header                                          
$X_HEADER_LINE = "Debian $myproduct_name at $mydomain";  

@viruses_that_fake_sender_maps = (new_RE(                                       
  [qr'\bEICAR\b'i => 0],            # av test pattern name                      
  [qr/.*/ => 1],  # true for everything else                                    
));                                                                             
                                                                                
@keep_decoded_original_maps = (new_RE(                                          
# qr'^MAIL$',   # retain full original message for virus checking (can be slow) 
  qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables 
  qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,                       
# qr'^Zip archive data',     # don't trust Archive::Zip                         
));                                                                             
                                                                                
                                                                                
# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample 
                                                                                
$banned_filename_re = new_RE(                                                   
# qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components 

  # block certain double extensions anywhere in the base name                   
  qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,                     
                                                                                
  qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Windows Class ID CLSID,
                                                                                
  qr'^application/x-msdownload$'i,                  # block these MIME types    
  qr'^application/x-msdos-program$'i,                                           
  qr'^application/hta$'i,                                                       
                                                                                
# qr'^application/x-msmetafile$'i,      # Windows Metafile MIME type            
# qr'^\.wmf$',                          # Windows Metafile file(1) type         
                                                                                
# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types    
                                                                                
# [ qr'^\.(Z|gz|bz2)$'           => 0 ],  # allow any in Unix-compressed        
# [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives  

# Tutaj powinien zezwolić na przechodzenie plików zip z exe :-/ 
 [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within such archives       
                                                                                
  qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic        
# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|       
#        inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|        
#        ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|              
#        wmf|wsc|wsf|wsh)$'ix,  # banned ext - long                             
                                                                                
# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab. 
                                                                                
# qr'^\.(exe-ms)$',                       # banned file(1) types                
# qr'^\.(exe|lha|tnef|cab|dll)$',         # banned file(1) types                
);                                                                              
# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631           
# and http://www.cknow.com/vtutor/vtextensions.htm                              
                                                                                
                                                                                
# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING                         
                                                                                
@score_sender_maps = ({ # a by-recipient hash lookup table,                     
                        # results from all matching recipient tables are summed 
                                                                                
# ## per-recipient personal tables  (NOTE: positive: black, negative: white)    
# 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],           
# 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],              
# 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,                
#                           '.cleargreen.com'           => -5.0}],              
                                                                          
  ## site-wide opinions about senders (the '.' matches any recipient)           
  '.' => [  # the _first_ matching sender determines the score boost            
                                                                                
   new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist   
    [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],   
    [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],   
    [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],   
    [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],   
    [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],   
    [qr'^(your_friend|greatoffers)@'i                                => 5.0],   
    [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],   
   ),                                                                           
                                                     
#  read_hash("/var/amavis/sender_scores_sitewide"),                             
                                                                                
   { # a hash-type lookup table (associative array)                             
     'nobody@cert.org'                        => -3.0,                          
     'cert-advisory@us-cert.gov'              => -3.0,                          
     'owner-alert@iss.net'                    => -3.0,                          
     'slashdot@slashdot.org'                  => -3.0,                          
     'securityfocus.com'                      => -3.0,                          
     'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,                          
     'security-alerts@linuxsecurity.com'      => -3.0,                          
     'mailman-announce-admin@python.org'      => -3.0,                          
     'amavis-user-admin@lists.sourceforge.net'=> -3.0,                          
     'amavis-user-bounces@lists.sourceforge.net' => -3.0,                       
     'spamassassin.apache.org'                => -3.0,                          
     'notification-return@lists.sophos.com'   => -3.0,                          
     'owner-postfix-users@postfix.org'        => -3.0,                          
     'owner-postfix-announce@postfix.org'     => -3.0,                          
     'owner-sendmail-announce@lists.sendmail.org'   => -3.0,                    
     'sendmail-announce-request@lists.sendmail.org' => -3.0,                    
     'donotreply@sendmail.org'                => -3.0,                          
     'ca+envelope@sendmail.org'               => -3.0,                          
     'noreply@freshmeat.net'                  => -3.0,             
     'owner-technews@postel.acm.org'          => -3.0,                          
     'ietf-123-owner@loki.ietf.org'           => -3.0,                          
     'cvs-commits-list-admin@gnome.org'       => -3.0,                          
     'rt-users-admin@lists.fsck.com'          => -3.0,                          
     'clp-request@comp.nus.edu.sg'            => -3.0,                          
     'surveys-errors@lists.nua.ie'            => -3.0,                          
     'emailnews@genomeweb.com'                => -5.0,                          
     'yahoo-dev-null@yahoo-inc.com'           => -3.0,                          
     'returns.groups.yahoo.com'               => -3.0,                          
     'clusternews@linuxnetworx.com'           => -3.0,                          
     lc('lvs-users-admin@LinuxVirtualServer.org')    => -3.0,                   
     lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,                   
                                                                                
     # soft-blacklisting (positive score)                                       
     'sender@example.net'                     =>  3.0,                          
     '.example.net'                           =>  1.0,                          
                                                                                
   },                                                                           
  ],  # end of site-wide tables                                                 
});                                                                             
                                                                                
1;  # insure a defined return

Może ktoś jest w stanie powiedzieć co źle mam skonfigurowane w tej konfiguracji?

redelek · 2008-08-26 12:59:58

Weź to pod uwagę że najpierw pozwalasz, a potem blokujesz exe?
Ja nie mam takiego problemu. Amavis rozpakowuje każde archiwum i zagląda do środka, jak instalowałeś to podawałeś czym co ma rozpakowywać prawda. Więc jeśli idzie plik zip to amavis go rozpakuje zobaczy że jest tam exe i go wytni.

Dla bezpieczeństwa polecam nie wysyłanie plików exe i wszędzie gdzie indziej go wyslesz to go wytnie jak nie tówj serwer to inny.
Albo zmieniaj rozszerzenie i wtedy pakuj, albo wystawiaj na FTP.

Pozdrawiam
Redelek

lopezpb · 2008-08-28 14:32:58

Zrobiłem tak:

Kod:

 [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within such archives       
                                                                                
  qr'.\.(vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic

reszta bez zmian, czyli w ogóle nie powinien blokować plików *exe

a jednak dalej mam:

Kod:

BANNED message from you (multipart/mixed | application/zip,.zip,plik.zip | .exe,.exe-ms,plik.exe)

a w logach:

Kod:

Aug 28 14:12:38 mail amavis[16448]: (16448-01) doing banned check formail@mail.com.pl on multipart/mixed | application/zip,.zip,pli.zip | .exe,.exe-ms,plik.exe
Aug 28 14:12:38 mail amavis[16448]: (16448-01) lookup (check_bann:mail@mail.com.pl) => true,  ["multipart/mixed","application/zip",".zip",pli.zip",".exe",".exe-ms","plik.exe"] matches, result="1", matching_key="(?i-xsm:.\\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$)"
Aug 28 14:12:38 mail amavis[16448]: (16448-01) p.path BANNED:1 mail@mail.com.pl: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/zip,T=zip,N=pli.zip | P=p004,L=1/2/1,T=exe,T=exe-ms,N=plik.exe", matching_key="(?i-xsm:.\\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$)"
Aug 28 14:12:39 mail amavis[16448]: (16448-01) lookup (banned_quarantine_to) => true,  "mail@mail" matches, result="banned-quarantine", matching_key="(constant:banned-quarantine)"

próbowałem również zrobić tak:

Kod:

 [ qr'^\.(zip|rar|arc|arj|zoo|exe)$'=> 0 ],  # allow any within such archives       
                                                                                
  qr'.\.(vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic

ale dalej mam takie same logi i wrotkę z listu.

maro · 2008-08-29 13:27:17

o ile używasz AMAVISA z repo debiana to w pliczku 20-debian-defaults odhashuj
[ qr'^\.(Z|gz|bz2)$' => 0 ], # allow any in Unix-compressed
[ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
[ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within such archives
restart i działa

lopezpb · 2008-08-30 10:08:41

[quote=maro]o ile używasz AMAVISA z repo debiana to w pliczku 20-debian-defaults odhashuj
[ qr'^\.(Z|gz|bz2)$' => 0 ], # allow any in Unix-compressed
[ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
[ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within such archives
restart i działa[/quote]
Dziewne wczseniej tak robiłem i nie działało. Dopiero gdy zrobiełem

Kod:

aptitude purge amavisd-new
aptitude install amavisd-new

i po odhaszowaniu tych lini wszystko działa.
Dziękuje za pomoc.

Time (s)	Query
0.00009	SET CHARSET latin2
0.00004	SET NAMES latin2
0.00135	SELECT u., g., o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='3.138.69.101' WHERE u.id=1
0.00073	REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '3.138.69.101', 1732311907)
0.00054	SELECT * FROM punbb_online WHERE logged<1732311607
0.00064	DELETE FROM punbb_online WHERE ident='3.144.101.75'
0.00026	SELECT topic_id FROM punbb_posts WHERE id=97893
0.00028	SELECT id FROM punbb_posts WHERE topic_id=12139 ORDER BY posted
0.00031	SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=12139 AND t.moved_to IS NULL
0.00026	SELECT search_for, replace_with FROM punbb_censoring
0.00139	SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=12139 ORDER BY p.id LIMIT 0,25
0.00071	UPDATE punbb_topics SET num_views=num_views+1 WHERE id=12139
Total query time: 0.0066 s

Forum Debian Users Gang

Ogłoszenie

#1 2008-08-26 12:36:47

lopezpb - Użytkownik

Amavis, blokowanie załączników zip z *.exe w środku

Kod:

Kod:

Kod:

Kod:

Kod:

#2 2008-08-26 12:59:58

redelek - Członek DUG

Re: Amavis, blokowanie załączników zip z *.exe w środku

#3 2008-08-28 14:32:58

lopezpb - Użytkownik

Re: Amavis, blokowanie załączników zip z *.exe w środku

Kod:

Kod:

Kod:

Kod:

#4 2008-08-29 13:27:17

maro - Użytkownik

Re: Amavis, blokowanie załączników zip z *.exe w środku

#5 2008-08-30 10:08:41

lopezpb - Użytkownik

Re: Amavis, blokowanie załączników zip z *.exe w środku

Kod:

Stopka forum

Informacje debugowania