Subject: [fwtk-users] Email filtering at the firewall

From: "Ken Long" <[email-masked]>
Date: Tue, 4 Dec 2001 14:32:04 -0700

Ok, it has become painfully obvious that I can't depend on my users to 
scan attachments before running them. Can anyone recommend a product to 
scan email and block certain extensions that works with smap/sendmail on 
Linux?

TIA,
Ken Long
Lectrosonics, Inc.

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: "Michael St. Laurent" <[email-masked]>
Date: Tue, 4 Dec 2001 13:38:11 -0800

Sure.  I understand that Procmail does this.  Also, there's a project called
Amavis that will unpack the email, scan the attachments with your antivirus
software and if it comes back negative, forward the email.

--------------------
Michael St. Laurent
Hartwell Corporation

[root@earth] root# rm -rf /bin/laden

> -----Original Message-----
> From: Ken Long [mailto:[email-masked]] 
> Sent: Tuesday, December 04, 2001 1:32 PM
> To: fwtk-users
> Subject: [fwtk-users] Email filtering at the firewall
> 
> 
> You are currently subscribed to fwtk-users as: [email-masked]

---

---

From: Rick Murphy <[email-masked]>
Date: Tue, 04 Dec 2001 16:55:06 -0500

For procmail filtering, I use html-trap - it has a list of extensions that 
get "defanged" by adding a suffix - that keeps the luser from opening the 
virus. <ftp://ftp.rubyriver.com/pub/jhardin/antispam/procmail-security.html>
	-Rick

---

---

From: Berend De Schouwer <[email-masked]>
Date: 05 Dec 2001 10:24:24 +0200

> scan email and block certain extensions that works with smap/sendmail on 

Inflex http://www.pldaniels.com/inflex/ or procmail-sanitizer
http://www.impsec.org/email-tools/procmail-security.html work.
> 
> TIA,
> Ken Long
> Lectrosonics, Inc.
> 
> 
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
-- 
Berend De Schouwer

---

---

From: [email-masked] (James Seymour)
Date: Thu, 6 Dec 2001 10:41:10 -0500 (EST)

"Ken Long" <[email-masked]> wrote:
> scan attachments before running them. 

Now *there's* a surprise! :-)

>                                       Can anyone recommend a product to 

The problem with relying on virus-scanning incoming email, IMO, is that
you must constantly keep updating virus signature files.  And even if
you do: the anti-virus people will always be behind the curve.  This is
particularly problematical when a new fast-mover appears.

Starting some number of email-borne virus/worm/trojan attacks ago:  I
simply configured the email gateways to reject all known dangerous
attachment types.  Problem solved (for the most part).

I replaced smap/smapd/sendmail with Postfix long ago.  Postfix allowed
me to accomplish the MIME type filtering quite easily.  And Postfix
has been far more stable and predictable than the smap/smapd/sendmail
combo ever was.  (Note: maybe the recent smap/smapd/sendmail trios are
better than the old ones.  I don't bother to keep track anymore.)

HTH

Regards,
Jim
-- 
Jim Seymour                         | Welding Technology Corporation
[email-masked]           | 24775 Crestview Ct.
Systems, Network & TelCom Admin.    | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897

---

---

From: "Ken Long" <[email-masked]>
Date: Thu, 6 Dec 2001 10:17:45 -0700

> particularly problematical when a new fast-mover appears.

This is indeed a real problem. I wasn't really thinking of virus scanning 
though...

> attachment types.  Problem solved (for the most part).

This is what I had in mind as well. I thought I would propose blocking 
all .exe, .com, .pif, .scr, .bat and .cmd.

> better than the old ones.  I don't bother to keep track anymore.)

Ah, another possible solution to look into. A large local ISP recently 
moved to Postfix. They've been singing its praises ever since.

Thanks,
Ken Long
Lectrosonics, Inc.

---

---

From: Ted Keller <[email-masked]>
Date: Thu, 6 Dec 2001 20:48:40 -0500 (EST)

I have used in the past some code based on libmilter.  If you do a search
on libmilter using your favorite search engine, you should be able to find
a number of references that will provide the desired filtering through
sendmail.  These have in the past been quite effective.

ted keller

On Tue, 4 Dec 2001, Ken Long wrote:

> You are currently subscribed to fwtk-users as: [email-masked]

---

---

From: [email-masked]
Date: Fri, 7 Dec 2001 14:12:23 +0300

-----BEGIN PGP SIGNED MESSAGE-----

I am thinking on possibility to integrate milter into smap because i don't
use sendmail. Is there an API that will mimick sendmail for milter-based
av scanners?

Ted Keller <[email-masked]> said :

> You are currently subscribed to fwtk-users as: [email-masked]

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

---

From: [email-masked]
Date: Fri, 7 Dec 2001 14:13:36 +0300

-----BEGIN PGP SIGNED MESSAGE-----

Oops, i should mention that actually that's not smap either, it is
obtuse smtpd modified to read smap-style config from netperm-table ;)
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

---

From: [email-masked] (James Seymour)
Date: Fri, 7 Dec 2001 08:33:18 -0500 (EST)

> On 6 Dec 2001, at 10:41, James Seymour wrote:
[snip]
> all .exe, .com, .pif, .scr, .bat and .cmd.

Consulting with some local Windows-heads here, I started out with:
 
    .bat .chm .cmd .com .exe .hta .js .jse .pif .scr .shb .shs .vbe
    .vbs .vbx .wsf .wsh
 
On advice from someone posting a follow-up to that list somewhere,
I added:
 
    .ade .adp .bas .cpl .crt .hlp .inf .ins .isp .lnk .mdb .mde .msc
    .msi .msp .mst .pcd .reg .sct .shs .url .vb .wsc
    
I think that's all of 'em :-).

> 
> > I replaced smap/smapd/sendmail with Postfix long ago. ...
[snip]
> moved to Postfix. They've been singing its praises ever since.

It's worked well for me :-).

Regards,
Jim

---