[Mimedefang] Oblivion.rar

Paul Murphy pjm at ousekjarr.org
Wed Apr 12 12:49:39 EDT 2006


> 
> > Ah... you should call action_discard() (at least for the specific
> > Oblivion.rar case...)
> 
> Understood but trying to solve the larger issue.  If you 
> rename the file to
> say bob.temp or zip the file (say you have a rar in a zip), 
> the problem
> still occurs.

Two useful approaches:

Clamd.conf:	
===========
ScanArchive
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxFileSize 10M
ArchiveMaxCompressionRatio 250
ArchiveBlockMax

This will limit the size of files when uncompressing, and will also prevent
massive files from being allowed through - the "ArchiveBlockMax" option
reports files as viruses if they fail any of the size, recursion or file
count checks.

Mimedefang-filter:
==================

Have two lists of bad file extensions - those which are not allowed anywhere,
and those which are not allowed in ZIP files.  Add ZIP, RAR, BZ2, etc to this
list even if you allow them normally - recursive archives are to be strongly
discouraged.

Paul.

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.385 / Virus Database: 268.4.1/309 - Release Date: 11/04/2006
 




More information about the MIMEDefang mailing list