[Mimedefang] How to filter

[cc]

David Va sighed and wrote::

> Dear Experts,
>
> I have just installed MD 2.37 with sendmail-8.12.8 on
> RH 7.2.
>
> In the mimedefang-filter, I see the script filtering
> file ext. like pif. Now my mail users still receive
> NetSky worm with attachment *.pif.
>
> 1. How can I filter the e-mail with the attachment and
> drop it?

I would believe that in the mimedefang-filter, there's
a filter_bad_filename() routine.   Add the extension to
the list  in $bad_exts.

Also, 2.35 is a pretty old version(relatively speaking).
Considered upgrading to 2.39?    And sendmail 8.11.8 is
also an old version and between that version and
the newest, I believe there have been security patches
tagged along.


> 2. How can I know mimedefang does its job?

If you get a message stating the following:

WARNING: This e-mail has been altered by MIMEDefang.  Following this
paragraph are indications of the actual changes made.  For more
information about your site's MIMEDefang policy, contact
Defang <defang at mydomain.com>.  For more information about MIMEDefang, see:

            http://www.roaringpenguin.com/mimedefang/enduser.php3

An attachment named Patch752.exe was removed from this document as it
constituted a security hazard.  If you require this document, please contact
the sender and arrange an alternate means of receiving it.

> end of quote

Then the chances are that MIMEDefang is working.  Unless of course,
you've changed the format of the warning text.

Edmund



>
> Thanks in advance for your kind solution.
>
> David
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Search - Find what you’re looking for faster
> http://search.yahoo.com
> _______________________________________________
> Visit http://www.mimedefang.org and http://www.canit.ca
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
>
>