MyDoom.o: Time to move to MIME ACL
Steven Dickenson <[email protected]>
| Newsgroups | gmane.mail.exim.exiscan.user |
|---|---|
| Message-ID | <[email protected]> |
I've seen two MyDoom.o viruses slip pass my Exim MX and get picked up by McAfee on my Exchange server. A quick check of the logs indicates errors such as these: demime acl condition: base64 line contains illegal character demime acl condition: base64 line length is not a multiple of 4 characters demime acl condition: base64 line length exceeds 76 characters It would seem the simple demime acl in the DATA section is no longer sufficient for catching some of the nastier Windows viruses. Therefore, I'd like to move over the the MIME ACL, however I'm not seeing any overview examples of implementations. I wish to reject based on a small list of file extensions and do virus scanning with ClamAV. I also want to avoid filename decoding problems due to base64 header encoding (which I assume what the above error is). Can someone give me an idea of the best way to accomplish this? Is there a resource for examples of ACL checks that can be done with the MIME acl? Thanks, Steven -- Steven Dickenson <[email protected]> http://www.mrchuckles.net