Topic: Solution to delete attached exe, bat...

[luis]

Checkhab on SME

One of the biggest issues that i found on SME was the lack of antivirus software. I think if you dont allow the vbs, bat, exe ... attachments you will have 90% of the work done. For that purpose Noel G. Mistula made a very good script called checkhab and is able to:
- Check if an email is HTML formatted
- Check if an attachment has an extension contained in a list
- Check if the email has a binary or is UUENCODED
- Subject filter
This script takes the email and sends it to a mailbox named junkmail. It also sends an email to both the sender and the recipient explainig the situation.
The script is so easy to modify. I´m only using UUENCODED and attach filter and took me 15 min to finish.

The unique problem is that you have to modify the .qmail file of all the users you want to prevent from those emails and add the path of the executable script. If anyone please can make this job easyer... For example a checkbox on the user interface that injects one line in the .qmail  
On the other hand, are there any way to include one line on the .qmail file for all new user? could it be done with templates?

Thanks in advance.

--------------------------------------------------------------------------------------------------------------------------
Download:
http://ngm.id.au/checkhab
http://ngm.id.au/banfiles.txt
http://ngm.id.au/banphrase.txt

Steps:
1. Download and edit the script: Edit the variables. I didn´t need to change anything else
2. Move the script (i.e. SCP) to /usr/local/bin  
3. chmod 755 /usr/local/bin/checkhab
4. chown root:qmail /usr/local/bin/checkhab
5. Move the banfiles.txt and the banphrase.txt to /etc
6. chmod 644 /etc/banfiles.txt
7. chmod 644 /etc/banphrase.txt
8. create an account named junkmail or whatever you assigned to MYJ
9. add  | /usr/local/bin/checkhab to every .qmail file except for junkmail account.
10. send some vbs or exe and take a look!.

Luismor

[Brian]

I setup checkhab to filter my mail and it does what it says.  If I send an attachment that is on the list, both sender and recipient are notified with an email and a copy of the email is sent to my "junkmail" user.  One problem though the bad email still gets delivered to the intended recipient with the attachment included.  Basically they receive 2 emails, the original and the warning.  Can I get checkhab to strip the attachment or redirect the original message only to the junkmail account?  Or is this the intended behavior of the script?

[Luismor]

Hi Brian.
This is not the correct behavior. As far as i can understard (sorry 4 my bad english) you are recibing 4 mails:

   1 Advice for sender
   1 Original with the attachment for the recipient
   1 Advice for the recipient
   1 Original with attachment for Junkmail user

If your configuration is correct you have to find:
   1 Advice for sender
   1 Advice for the recipient
   1 Original with attachment for Junkmail user

Thats all.
Check your installation, also check that you inserted "|" (pipe) character on step 9, and check how you edited the script.
If this doesn´t solve your problem, send me the script to luismor - at - telefonica -dot - net.
Hope will work, cause this script saved my corporation form viruses.
Luismor

[Brian]

After reading your response I took another look at my checkhab and found the instruction: "This must be _before_ the ./Maildir/".  Sure enough I placed the line: "
| /usr/local/bin/checkhab" after a procmail entry.  I moved it to the beginning and the script is working correctly.

Thanks for the help.

[Curly]

The problem with the templates is, that they're used for every user, your special 'junkmail' included. Perhaps you could include a user-name check in the script, a 'whoami' followed by a check to see if this is the 'junkmail' user and then gracefully exit

I've installed this, and changed it a little. I use all kinds of email-addresses on my own server that just all point to one (/var/qmail/alias/.qmail-localdelivery-default). I've made two versions of checkhab, one for normal checking (the original) and one for checking in the qmail-localdelivery-default. The last one forwards the mail to one account if the mail is clear. Is there a way to do this with one script ?

I've also had to add a PATH= statement in the script, as it couldn't find commands as cat, egrep and wc. (sme-server 5.1.2 here)

[Curly]

I've added the following part (somewhere after the BANPHRASE= line):

##
## check which user this is
##

user=whoami

if [ "${user}" = "${MYJ}" ] ; then
        exit 0
fi

so it's usable in every .qmail file, and thus in the templates.

I just use the banphrase part, and I see that some mime-encoded mail is still getting through. I've added demime (http://scifi.squawk.com/demime.html) in the creation of the temp-file (around line 407):

tmpfile=/tmp/tmpmail$$
cat - | demime - > $tmpfile

I'm still looking into base64 encoded messages.

[Ian Plain]

Hi I am having a problem with this script, therror Im getting is
"uid=400, ddelay=0.795735, xdelay=0.742994, stat=Deferred (/usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:__:_command_not_found//usr/local/bin/checkhab:_line_132:_syntax_error_near_unexpected_token_{_'//usr/local/bin/checkhab:_line_132:_recimsg_()_{_'/)"

I have checked the script and the .qmail and they both look correct. the server is 5,5 if thats any help. I hope you can give me an idea as to waht s going on.

Cheers Ian
 
www.bathford-broadband.co.uk
luis wrote:
>
> Checkhab on SME
>
> One of the biggest issues that i found on SME was the lack of
> antivirus software. I think if you dont allow the vbs, bat,
> exe ... attachments you will have 90% of the work done. For
> that purpose Noel G. Mistula made a very good script called
> checkhab and is able to:
> - Check if an email is HTML formatted
> - Check if an attachment has an extension contained in a list
> - Check if the email has a binary or is UUENCODED
> - Subject filter
> This script takes the email and sends it to a mailbox named
> junkmail. It also sends an email to both the sender and the
> recipient explainig the situation.
> The script is so easy to modify. I´m only using UUENCODED and
> attach filter and took me 15 min to finish.
>
> The unique problem is that you have to modify the .qmail file
> of all the users you want to prevent from those emails and
> add the path of the executable script. If anyone please can
> make this job easyer... For example a checkbox on the user
> interface that injects one line in the .qmail
> On the other hand, are there any way to include one line on
> the .qmail file for all new user? could it be done with
> templates?
>
> Thanks in advance.
>
> --------------------------------------------------------------------------------------------------------------------------
> Download:
> http://ngm.id.au/checkhab
> http://ngm.id.au/banfiles.txt
> http://ngm.id.au/banphrase.txt
>
> Steps:
> 1. Download and edit the script: Edit the variables. I didn´t
> need to change anything else
> 2. Move the script (i.e. SCP) to /usr/local/bin  
> 3. chmod 755 /usr/local/bin/checkhab
> 4. chown root:qmail /usr/local/bin/checkhab
> 5. Move the banfiles.txt and the banphrase.txt to /etc
> 6. chmod 644 /etc/banfiles.txt
> 7. chmod 644 /etc/banphrase.txt
> 8. create an account named junkmail or whatever you assigned
> to MYJ
> 9. add  | /usr/local/bin/checkhab to every .qmail file except
> for junkmail account.
> 10. send some vbs or exe and take a look!.
>
> Luismor

[Ian Plain]

Hi made somw changes now im getting this

 28    47.92  /bin/sh: /usr/local/bin/checkhab: bad interpreter: No such file or directory/


any ideas, one thing I found seemed to point to being in dos format when i openit in vi  it does say dos at the bottom. i transfered the file over in ascii that should cure that i think.

any help much aprreciated

[Ian Plain]

Hi
Its Ok now and working great keeping that Swen worm away from me.
Perhaps this is a lesson I downloaded and editited on my Solaris box and the script worked first time. Perhaps I will speed up my migration to Solaris.

[Dave Owen]

Thanks for this script -- I'm going to install it this evening.

One thing, though...I have no desire to quarantine my emails -- frankly, I'd rather just send them off to /dev/null.

My assumption is this: since this function:
...
### Checking for SPAM, Ads ...and other crap    ###
JUNKSUBJ=0
JUNKSUBJ=egrep -i -f $BANPHRASE $tmpfile | wc -l
if [ $JUNKSUBJ -ne 0 ]; then
# send it to oblivion ...
> /dev/null
...
is being used to drop mail directly to /dev/null, I can replace this part of fwdjunk:
...
/var/qmail/bin/qmail-inject -f"$MYMD@$MYDOM" "$MYJ@$MYDOM" < $tmpfile
...

with > /dev/null to have the mail sent to /dev/null instead of forwarding it.

Before I do this on my server and upset the users, can someone validate this?Sorry about this newbie question.

-Dave Owen

[Cyrus Bharda]

Wow,

This is GREAT, but like Dave I too would just rather /dev/null messages instead of forwarding them to junkmail, dave did that work for you what you did?

Also how do I turn off the HTML filtering part?

Thanks,

Cyrus Bharda

[Cyrus Bharda]

Everyone,

You all might want to check out Darrell May's forum thread here:

http://myezserver.com/phpBB2/viewtopic.php?t=461&start=0&postdays=0&postorder=asc&highlight=

He has done some very, very nice work but remember that it is still beta, although I am using it right now on my production server and it works great.

Also in that thread, how to turn HTML checking off and how to /dev/null messages instead of sending them to a junkmail user.

Thanks Darrell!

Cyrus Bharda