2

These days I have problems with trojans in attachments like:

  1. //EZuS.zip//invoice_scan_xcFSuO.xls.js contains a potentially infected object HEUR:Trojan-Downloader.Script.Generic.
  2. //TuxX.zip//invoice_YAFFOg.doc.js contains a potentially infected object HEUR:Trojan-Downloader.Script.Generic.

I have a relay to my in-house server. Relay with postfix + amavis + spam assassin + clamav.

We need to send and receive .js files. So i only want to block the .doc*.js and .xls*.js

Which is the most efficient way to block this kind of spam?

1
  • Please let me know if my answer helped you with your question.
    – Aaron
    Feb 8, 2016 at 14:55

1 Answer 1

4

Postfix Header Checks

Blocking double extensions can be done with regex. Here is an example of how to block any extension.

Create /etc/postfix/header_checks and maybe block some of these extensions

Modify as required: Here are 2 ways to do the same thing you asked for.

# do something with JS files
#
# method 1, much like what you asked for
/^(.*)name=\"(.*)\.[0-z]{3,}\.js\"$/ REJECT BAD_ATTACHMENT_3CHAR

# method 2, specific on extensions before the .js, customize as desired
/^(.*)name=\"(.*)\.(exe|lnk|dll|shs|vbe|hta|mht|com|vbs|vbe|js|jse|bat|cmd|vxd|scr|shm|pif|chm|pdf|zip|dmg)\.js\"$/ REJECT BAD_ATTACHMENT_PLUSJS

# log attachments
/^Content-(Type|Disposition):.*(file)?name=/    WARN ATTACHMENT
/^(.*)name=\"(.*)\./                            WARN ATTACHMENT

Configure postfix to use this:

postconf -e "header_checks = regexp:/etc/postfix/header_checks"
postfix reload

Do this on a test system first and keep an eye on syslog.

4
  • Hi, both works for attachments like *.js and blocks the double extension like defined. If the files is within a zip or tar it won't work.
    – Max
    Feb 8, 2016 at 18:02
  • You can customize that line to exclude any extensions you wish to allow through. That was just an example.
    – Aaron
    Feb 8, 2016 at 22:48
  • I have a "SPAM.zip" within this zip file is a file spam.doc.js. The Postfix header_checks test the name of the zip file and not the file within the zip. Only the extensions of the attachment get blocked not the files within, or I'm wrong?
    – Max
    Feb 9, 2016 at 14:20
  • Correct, this method only looks at filenames. The answer was based on your original question. To look inside the file will require something external to Postfix, such as the method you are already using with amavis+clamav.
    – Aaron
    Feb 12, 2016 at 1:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .