Koozali.org: home of the SME Server

Obsolete Releases => SME Server 9.x => Topic started by: smeghead on October 15, 2017, 03:03:14 PM

Title: Rejecting JAR files
Post by: smeghead on October 15, 2017, 03:03:14 PM

Hi all

There has been a noticeable upswing of JAR file attachments in emails for my systems & I would like to know if there is a good way to reject them out of hand (none of my systems have any reason to receive JAR files as email attachments):

. via a rule in qpsmtpd
. using clamav scanning
. via attachments sigs (as is done for ZIP files)
. or something else I haven't thought of

If there's nothing I can use that's built in I'll have to put in an NFR.

TIA

Title: Re: Rejecting JAR files
Post by: Stefano on October 15, 2017, 04:59:33 PM

if it's workable, the third option sounds the better one to me


P.S: jar files are zip files.

Code: [Select]


stefano@stefano-HP ~ $ file ./Dropbox/private/TNX/Invoicex/Invoicex.jar
./Dropbox/private/TNX/Invoicex/Invoicex.jar: Java Jar file data (zip)


Title: Re: Rejecting JAR files
Post by: janet on October 16, 2017, 02:58:48 AM

smeghead

If they are zip files as Stefano suggests,  as determined by the file command, then configure the executable content filtering in server manager to reject them.
There is a whole tutorial in the Howto section that tells you how to determine & add non standard signatures, it all documented so start reading & doing.

https://wiki.contribs.org/Virus:Email_Attachment_Blocking