[Mimedefang] Oblivion.rar
Paul Murphy
pjm at ousekjarr.org
Wed Apr 12 12:49:39 EDT 2006
>
> > Ah... you should call action_discard() (at least for the specific
> > Oblivion.rar case...)
>
> Understood but trying to solve the larger issue. If you
> rename the file to
> say bob.temp or zip the file (say you have a rar in a zip),
> the problem
> still occurs.
Two useful approaches:
Clamd.conf:
===========
ScanArchive
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxFileSize 10M
ArchiveMaxCompressionRatio 250
ArchiveBlockMax
This will limit the size of files when uncompressing, and will also prevent
massive files from being allowed through - the "ArchiveBlockMax" option
reports files as viruses if they fail any of the size, recursion or file
count checks.
Mimedefang-filter:
==================
Have two lists of bad file extensions - those which are not allowed anywhere,
and those which are not allowed in ZIP files. Add ZIP, RAR, BZ2, etc to this
list even if you allow them normally - recursive archives are to be strongly
discouraged.
Paul.
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.385 / Virus Database: 268.4.1/309 - Release Date: 11/04/2006
More information about the MIMEDefang
mailing list