Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: Franco on August 14, 2007, 04:18:53 AM

Title: Blocking powerpoint email attachments
Post by: Franco on August 14, 2007, 04:18:53 AM

I'm trying to block powerpoint presentations, but not the excel and others.
Unfortunatelly the signatures are almost identical and differ very little from file to file:

Quote

PPT powerpoint presentation -Microsoft Office Document
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAADEAwAAIRgBAAAAAAAA
          0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAJAAAAZgQAAAAAAAAA
Signature: 0M8R4KGxGuEA
Excel - Microsoft Office Document
 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAGQAAAAAAAAAA
          0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAALAAAAAwUAAAAAAAAA
Signature: 0M8R4KGxGuEA

Does anyone have an idea on how can I acomplish this?

Thanks,

Title: Re: Blocking powerpoint email attachments
Post by: raem on August 20, 2007, 11:18:57 AM

stuntshell

You have to use a longer pattern, ie so it is unique for ppt files.

Title: Re: Blocking powerpoint email attachments
Post by: Franco on August 20, 2007, 05:28:23 PM

Sorry Ray but this would only work if use the entire pattern, which change from file to file. All the patterns from Microsoft office come out almost exactly the same, checkout these examples:
.pps file:

Code: [Select]

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAJAAAAZgQAAAAAAAAA
.xls file:

Code: [Select]

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAGQAAAAAAAAAA
.ppt file:

Code: [Select]

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA

Title: Re: Blocking powerpoint email attachments
Post by: cactus on August 20, 2007, 07:08:06 PM

Quote from: stuntshell on August 20, 2007, 05:28:23 PM

Sorry Ray but this would only work if use the entire pattern, which change from file to file. All the patterns from Microsoft office come out almost exactly the same, checkout these examples:
.pps file:

Code: [Select]

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAJAAAAZgQAAAAAAAAA
.xls file:

Code: [Select]

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAGQAAAAAAAAAA
.ppt file:

Code: [Select]

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA

If I am not mistaken there is a difference... what is the problem? Are you not allowed to enter longer patterns? Otherwise I see no harm in entering them.

Title: Re: Blocking powerpoint email attachments
Post by: Franco on August 20, 2007, 11:17:12 PM

Quote

If I am not mistaken there is a difference... what is the problem? Are you not allowed to enter longer patterns? Otherwise I see no harm in entering them.

maybe?
If I enter de whole pattern, it no longer blocks them:

Code: [Select]

db mailpatterns show EXEFILES
EXEFILES=pattern
    Body=0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA
    Description=PowerPoint
    Glob=yes
    LineStart=yes
    Status=enabled


Title: Re: Blocking powerpoint email attachments
Post by: raem on August 21, 2007, 02:50:10 AM

stuntshell

First of all what powerpoint file types are you actually trying to block, pps or ppt or both or something else as well ??
Looking at the signatures you posted there are differences, but there is no common denominator between pps & ppt files (which I understand are powerpoint files).

To determine the common signature that you can use in the patterns database, you have to test quite a few pps and ppt files, preferably including some created by other users on other systems as well as your own, in order to truly find the common signature.
It appears looking at the examples you quoted that pps and ppt files have a different signature.

.pps file:
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAJAAAAZg
.ppt file:
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQ
.xls file:
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAGQ

The pattern you entered in the db was this:
0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAA

which should block the specific ppt file example you tested, but will not block the pps example you tested (or the xls example).

When you say "If I enter de whole pattern, it no longer blocks them:",
this will happen if other ppt file attachments have a different signature.
Did you mistakenly read that this would block pps as it won't.

How many files did you test to determine the pattern ? One is not sufficient as that may not reliably indicate a pattern that will be applicable to all pps files.

As I see it based on the examples you quoted, you will need to have a different pattern for ppt & pps at least.