On Sun, Jun 1, 2014 at 1:11 PM, Inteq Solution - Dep. Tehnic <[email protected]> wrote: > Hello > > > > Tonight, while checking Postfix config, I have stumbled upon something > weird. > > > > I am blocking executables and potentially dangerous extensions with > header_checks = pcre:/etc/postfix/header_checks.pcre > > Inside header_checks.pcre I have: > > /^Content-(Disposition|Type).*name\s*=\s*"?(.*(\.|=2E)(ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|ht[at]|inf|ins|isp|jse?|lnk|md[betw]|ms[cipt]|nws|\{[[:xdigit:]]{8}(?:-[[:xdigit:]]{4}){3}-[[:xdigit:]]{12}\}|ops|pcd|pif|prf|reg|sc[frt]|sh[bsm]|swf|vb[esx]?|vxd|ws[cfh]))(\?=)?"?\s*(;|$)/x > REJECT Attachment name "$2" not allowed > > > > > > Sending an email with a *.bat extension gives the expected result. The email > is blocked with the message: > > '[email protected]' on 01.06.2014 07:41 > > 550 5.7.1 Attachment name "test.bat" not allowed > > > > I also have a mime_header_checks = regexp:/etc/postfix/mime_header_checks > with the content: > > /name=[^>]*\.(ade|adp|asp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|ht|inf|ins|isp|jse?|lnk|md|ms|nws|ops|pcd|pif|prf|reg|sc|sh|swf|vb|vxd|ws|pl|py)/ > REJECT Attachment not allowed > > > > Nevertheless, using http://www.emailsecuritycheck.net/ and sending a test > email to my address, a file with .bat extension slips through without being > blocked. > > > > I must be doing something wrong, but no matter how I look at it, I do not > see it. > > > > Any hints please? > >
I'm not really familiar with the usage of pcre with postfix, but something you might want to check: are your regexes case-sensitive? http://www.postfix.org/pcre_table.5.html has some weird description which I dont get, and which perhaps somebody could explain to me: ============== By default, matching is case-insensitive, and newlines are not treated as special characters. The behavior is controlled by flags, which are toggled by appending one or more of the following characters after the pattern: i (default: on) Toggles the case sensitivity flag. By default, matching is case insensitive. ==================== So if something is on by default (which means that even if you *dont* specify it, it is on already), how do you turn it off? Or is it by default off instead, and the doc is wrong? -jf -- He who settles on the idea of the intelligent man as a static entity only shows himself to be a fool. Mensan / Full-Stack Technical Polymath / System Administrator 12 years over the entire web stack: Performance, Sysadmin, Ruby and Frontend
