forum.lissyara.su

Код: Выделить всё

acl_smtp_mime = acl_check_mime

acl_check_mime:

deny    message                 = We do not accept attachments like: $mime_filename
        condition               = ${if match{$mime_filename}{\N\.(bat|js|pif|cd|com|exe|lnk|reg|vbs|jse|msi|ocx|dll|sys|cab)$\N}}

deny    message                 = Probably this message contains dangerous file in ZIP-attachment ($mime_filename).
        condition               = ${if match{$mime_filename}{\N(?i)\.zip$\N}}
        decode                  = /var/exim/scan/zip/$mime_filename
        condition               = ${if match{${run{/usr/bin/unzip -l $mime_decoded_filename}}}{\N(?i)\.(bat|js|pif|cd|com|exe|lnk|reg|vbs|jse|msi|ocx|dll|sys|cab)\n\N}}

deny    message                 = Probably this message contains dangerous file in RAR-attachment ($mime_filename).
        condition               = ${if match{$mime_filename}{\N(?i)\.rar$\N}}
        decode                  = /var/exim/scan/rar/$mime_filename
        condition               = ${if match{${run{/usr/bin/unrar l $mime_decoded_filename}}}{\N(?i)\.(bat|js|pif|cd|com|exe|lnk|reg|vbs|jse|msi|ocx|dll|sys|cab)$\N}}

accept

Код: Выделить всё

whereis unzip
unzip: /usr/bin/unzip /usr/share/man/man1/unzip.1.gz
whereis unrar
unrar: /usr/bin/unrar /usr/share/man/man1/unrar.1.gz
exim -bV
Exim version 4.72 #7 built 21-Nov-2014 18:27:12

Код: Выделить всё

#free_arqexec contain emails of permited sender. Example: *@gmail.com
drop
    !senders     = 
    demime         = zip:rar:arj:tar:tgz:gz:bz2:7z
    set acl_m9     = ${run{/var/spool/exim/logs/checkarc.sh ${lc:$found_extension} $message_exim_id}}
    message        = This message contains dangerous file(s) in .${uc:$found_extension} file.
    condition      = ${if eq {$runrc}{0}{false}{true}}

Код: Выделить всё

#!/bin/sh
# See http://wiki.exim.org/ExiscanFilenameBlocking

zipinfo=/usr/local/bin/zipinfo
unzip=/usr/local/bin/unzip
rar=/usr/local/bin/unrar
7z=/usr/local/bin/7z

# Проверяем наличие приложений
for application in ${zipinfo} ${unzip} ${rar} ${7z}
do
    if [ ! -s ${application} ]; then
        echo "Приложение \`\`${application}'' не найдено!"
        exit
    fi
done

# Блокируемые файлы в архивах
EXTENS='(\.cmd$|\.com$|\.exe$|\.bat$|\.btm$|\.cpl$|\.dll$|\.exe$|\.lnk$|\.msi$|\.pif$|\.prf$|\.reg$|\.scr$|\.vb$|\.vbs$|\.url$|\.pl$|\.bas$|\.js$|\.java$|\.s
hs$|\.chm$|\.hlp$|\.zip$|\.rar$|\.arj$|\.7z$)'

# Архивы
COMPAC='(zip|rar|7z)'

# переход в рабочую директорию.
if [ ! -z "$2" ]; then
    if [ -d /var/spool/exim/scan/$2 ]; then
        cd /var/spool/exim/scan/$2
    else
        exit 1
    fi
fi


# Проверка архивов.
for i in `ls | egrep -i ".${COMPAC}$"`; do
   EXTFILE="`basename $i | sed -e 's/.*\.//' | tr [A-Z] [a-z]`"
   case "${EXTFILE}" in
     zip)
        CMD_TST="${unzip} -t $i"
        CMD_VRF="${zipinfo} -1 $i"
        ;;
     rar)
        CMD_TST="${rar} t -p- $i"
        CMD_VRF="${rar} vb -p- $i"
        ;;
     7z)
        CMD_TST="${7z} t $i"
        CMD_VRF="${7z} l $i"
        ;;
     *)
        echo -n '* Extension of File <'$i'> is unknown archive compact!\n'
   esac

    ARQS="`${CMD_VRF} 2> /dev/null | gawk '{ print $1 }' | egrep -i "${EXTENS}$"`"
    if [ ! -z "$ARQS" ]; then
        echo -n '* File(s) in <'$i'>: '$ARQS'\n'
        FOUND=1
    fi
done

if [ ! -z "${FOUND}" ]; then
    exit 1
else
    exit 0
fi

Код: Выделить всё

deny     message           = Probably this message contains dangerous file in attachment
         condition         = ${if match{$mime_filename}{\N(?i)\.(zip|rar|7z)$\N}}
         decode            = default
         condition         = ${if match{${run{/usr/bin/7z l $mime_decoded_filename}}}{\N(?i)\.(exe|com|vbs|bat|pif|scr|hta|js|cmd|chm|cpl|jsp|reg|vbe|lnk|dll|sys)\n\N}}
         log_message       = forbidden attachment: filename=$mime_filename, content-type=$mime_content_type, recipients=$recipients

Код: Выделить всё

    deepfind=/usr/bin/deepfind

Код: Выделить всё

       case "${EXTFILE}" in
         zip)
            CMD_VRF="${deepfind}"
            ;;