Subject: Re: Content Checker

From: Jonathan Wilson <[email-masked]>
Date: Mon, 07 Aug 2000 05:11:21 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

At 09:44 AM 8/7/00 +0200, you wrote:
>[To be removed from this list send the message "unsubscribe fwtk-users" in the
>BODY of a mail message to [email-masked].]
>
>Hello,
>
>> I installed and worked with TIS FWTK. Now I need some utility for scanning
>> mails body and detect file type of attachments.
>> For example I want to give mail body, a word and an action to content
>> checker and it applies the action on mail body.
>> I will appreciate any suggestion

Under certain circumstances Procmail is useful for this. I'm using it
here to filter out certain kinds of, um, undesirable email. However,
the mail gets caught on the internal mail hub, not at the firewall.
Here's how:

        a) install procmail on mail hub
        b) create .forward file in each user's home directory, that
           forwards all incoming mail to procmail. See the procmail
           man page for the exact format of this file. However, it
           begins like:
             "|IFS=' '&&p=/usr/local/bin/procmail&&test -f $p&&exec $p ...
        c) create system-wide filtering procmail ruleset, or several
           different classes of filtering ruleset. For example,
           /etc/procmail_spam_filter (an example attached below)
        d) link desired procmail filter to .procmailrc in user's home
           directory:
                ln -s /etc/procmail_spam_filter /home/user/.procmailrc

I know that there are better ways of doing this (Mr. Yao's patches on
a current version of FWTK can do some of this), but this filled a
particular need at the time. The simple mechanism used is also easy
to spoof if you know what it's looking for, and you must work at it
to stay ahead of new MIME types and encodings, but it successfully
filters out an awful lot of gunk at our site. It is also admittedly
expensive, as each incoming message can get scanned several times;
there are probably more efficient ways to structure the .procmailrc
to avoid this.

Here is an example .procmailrc, /etc/procmail_spam_filter, which filters
out most executable MIME attachments and specifically looks for the "I
Love You" virus. Any infected or prohibited messages are dumped to
dot-files in the user's home directory for periodic examination by me.
This .procmailrc also completely filters out mail from certain less than
desirable users.

        # /etc/procmail_spam_filter
        # remember that procmail's regexp engine is case-insensitive
        # and generally follows rules for old 'egrep'.
        
        # filter out VBscript-based viruses by simply looking for
        # string "MSKernel32" in the body of the message. Move such
        # messages to file ~/.mail_infected.
        :0 B
        * MSKernel32
        .mail_infected
        
        # discourage known spamboys. Use loop detection.
        :0
        * !^FROM_DAEMON
        * !^X-Loop: $LOGNAME@$HOST
        [email-masked][email-masked]
        | (formail -r -A"X-Loop: $LOGNAME@$HOST" ; \
          echo "Die, spammer, die.") | $SENDMAIL -t
        
        # look for MIME attachments
        :0 B
        * ^Content-Type:
        {
          # catch strange Outlook-attached .exe files, move to ~/.mail_exe
          :0 B
          * ^Content-Type: application/x-msdownload
          .mail_exe
          # catch other binary stream attachments. We allow through .xls
          # files and CAD drawing files, along with .vcf card files.
          :0 B
          * ^Content-Type: application/octet-stream
          * !\.xls\"
          * !\.vcf\"
          * !\.dwg\"
          .mail_exe
          # catch mpeg attachments, save for our later viewing pleasure 8-)
          :0 B
          * ^Content-Type: video/mpeg
          .mail_mpg
          # ditto for wav files
          :0 B
          * ^Content-Type: audio/microsoft-wave
          .mail_wav
          # zip files. Note that there are lots of ways these can be
          # encoded ("application/Winzip", etc.), this is just the most
          # generic.
          :0 B
          * ^Content-Type: application/zip
          .mail_zip
        }
        # end procmailrc

Regards,
Jonathan Wilson
Western Reflections LLC