Re: urgend file type detection

You could perhaps use "file" as an extra custom command-line av-scanner 
using the multiple av-scanners method (av_scanners = $acl_m0; set 
acl_m0 ...).

Best Wishes,
Chris

On Tue, 19 Oct 2004 11:34:45 +0200 Tom Kistner <[email protected]> 
wrote:

> Steffen Heil wrote:
> 
> > I want to allow only mail through my sarge exim 4.34 heavy daemon server
> > with clamav that have
> > - NO attachments
> > - ONLY rtf, doc, pdf, txt, xls attachments Everything else should be
> > blocked.
> 
> Use the MIME ACL.
> 
> > However, I do not want to determine this by extension, but by content.
> > rfc, doc, pdf als xls should be detectable, as they have special file
> > structures. txt will propably more complicated.
> 
> Matching content-type headers is useless with MS software. You can apply 
> clever mime_regex checks to determine the real file content. With .txt, 
> check if the file does not contain binary zeroes. Not 100% secure but 
> should catch most of possible fakes.
> 
> /tom
> 
> 
> 

--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+--
Christopher Wakelin,                                [email protected]
IT Services Centre, The University of Reading,       Tel: +44 (0)118 378 6630
Whiteknights, Reading, RG6 2AF, UK                   Fax: +44 (0)118 975 3094