[Mimedefang] I know, it's a Bad Idea(tm)

[Nels Lindquist]

On 26 Feb 2002 at 13:56, Young, Gil wrote:

> An exec where I work wants to be able to recieve mail with any extension no
> matter what.  Right now I have mimedefang globally drop with warning a grand
> list of extensions (35 in all), and I want to figure out how to allow any
> extension to him, but still block it for the masses.  I have tried inserting
> the following:
> 
> sub filter_begin {
> foreach $recip (@Recipients) {
> if ($recip eq 'ttt at aaa.com') {
> action_accept();
> last;
> }
> }
> }
> 
> But the emails with attachments are still being blocked as per my extension
> block rule which comes later in the filter script.
> 
> Any recommendations, or am I attacking this from the wrong angle altogether?

Well, it seems awfully hard to believe that someone would need file 
attachments completely regardless of file extension.  There's no good 
reason why *anyone* needs to receive .shs, .scr, .ini, .vxd files, 
for example.

One thing you could to to mitigate the problem somewhat is integrate 
a virus scanner of some sort.  I know David thinks virus scanners are 
a big scam, but the A/V integration with MIMEDefang actually works 
quite well in my experience. :-)

In any event, I'd recommend you get your exec's instructions in 
writing, just for the CYA factor.  Have him sign a document outlining 
his instructions, and include something to the effect of 
"I have been informed of the security implications of my request.  I 
am aware that my request directly contravenes security policies 
established by our I.T. department and will therefore take full and 
complete responsibility in the event of any security breach, virus 
infection, worm, etc. involving my workstation or e-mail account."
----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.