OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Denying mail based on attachment file extensions?
From: Scheidel, Greg (Greg_ScheidelED.GOV)
Date: Fri Sep 08 2000 - 10:33:07 CDT

I would have to advise staying away from Trend's virus scanning products for
Exchange and firewalls. Both of them are buggy & unreliable, and tend to
drop e-mails (as in the e-mails completely disappear with no notification).
On the CP FW-1 side, it is difficult to get the Viruswall product to
maintain its communications link with the firewall, even when the viruswall
software is installed on the same box as the firewall. On the Exchange
side, it bogs down the mail server to the point of unusability.

YMMV.

We have had good luck with NAV products, although in fairness older versions
of their product have seen the same types of problems as described above for
Trend.

Greg S.

                -----Original Message-----
                From: Anders Hansen-Øvre [mailto:andersBINARY.NO]
                Sent: Friday, September 08, 2000 2:59 AM
                To: FOCUS-LINUXSECURITYFOCUS.COM
                Subject: Re: Denying mail based on attachment file
extensions?

                On Exchange Trend have a very good product to virusscan and
                filter mail. (http://www.trend.com)

                Trend Micro Viruswall -
http://www.antivirus.com/products/isvw/
                Trend Micro eManager -
http://www.antivirus.com/products/isem/

                You can download a 30 day trail version on both products!
                I've used them both and they work very good. Viruswall can
easily
                be set up with CheckPoint FW-1 or other FW software!

                But are you talking about the client or the server ?!

                Mvh.
                Anders Hansen-Øvre
                Binary AS
                http://www.binary.no

> -----Original Message-----
> From: Focus on Linux Mailing List
> [mailto:FOCUS-LINUXSECURITYFOCUS.COM]On Behalf Of Michael
Bellears
> Sent: 8. september 2000 02:38
> To: FOCUS-LINUXSECURITYFOCUS.COM
> Subject: Re: Denying mail based on attachment file
extensions?
>
>
> Thanks for the info - unfortunately the client is running
exchange.
> Just for interest sake, Is the e-mail containing the
attachment actually
> downloaded first?..or can it be denied prior to this?
>
> > -----Original Message-----
> > From: Travis Ogdon [mailto:togdonEASYSTREET.COM]
> > Sent: Friday, 8 September 2000 1:29 AM
> > To: FOCUS-LINUXSECURITYFOCUS.COM
> > Subject: Re: Denying mail based on attachment file
extensions?
> >
> >
> > With Procmail something like this should work:
> >
> >
> > # /dev/null all avi MIME attachments
> > :0BH:
> > * .*filename=".*\.avi"
> > /dev/null
> >
> > # /dev/null all mpg MIME attachments
> > :0BH:
> > * .*filename=".*\.mpg"
> > /dev/null
> >
> >
> > -- Travis
> >
> >
> > Michael Bellears wrote:
> > >
> > > I have a client who wants to deny any mail with .avi
or
> > .mpg attachments.
> > > Is this possible with some type of proxy box being
setup,
> > or is there third
> > > party software available?
> > >
> > > Regards,
> > > MB
> >