Re: acl_check_mime vs _content

Matt Staroscik wrote:
> I recently upgraded to the latest Exim + exiscan v 22, and my 
> acl_check_mime scan is failing. If I run the ACL, I see this kind of 
> thing in my logs:
> 
>> [216.254.0.204]:54437 F=<[email protected]> temporarily rejected 
>> during MIME ACL checks: cannot test demime condition in MIME ACL
> 
> 
> acl_check_content works fine though and I am using it to kick back 
> .exe's and other suspicious file types, which is what I wanted to do 
> anyway.
> 
> I am including my MIME ACL below, but the real question is -- should I 
> be using MIME checks, content checks, or both? The content ACL checks 
> file type AND has the hooks for SpamAssassin, so it seems like I can bag 
> acl_check_mime but I want to make sure I am not missing anything...

Hi Matt,

You need to check over the spec file for Exiscan, the "demime" condition 
isn't used in the MIME ACL.

Here's a link to an example of extension blocking in the MIME ACL. 
You'll find other ACL constructions on this forum too.
http://exim.got-there.com/forums/viewtopic.php?t=476

You may want to include mail from your "own" hosts in the extension 
blocking. It's usually considered bad form to be sending out viruses 
when you could be stopping it. Also, given most viruses have their own 
MTA these days, if you get an infected host, it will send to your own 
email accounts via your MX hosts.

Cheers,
Matt.