Emails that are retained for containing .dat files

Bugs in eFa 4
Post Reply
uzisuicida
Posts: 10
Joined: 24 Jan 2019 06:24

Emails that are retained for containing .dat files

Post by uzisuicida »

Hello everyone,
I have a problem that I cannot solve, some emails are kept in quarantine because they contain .dat files, I even have the domain whitelisted:
Untitled.png
Untitled.png (8.9 KiB) Viewed 575 times
I don't know how I can solve this problem.

Thanks,
User avatar
pdwalker
Posts: 1489
Joined: 18 Mar 2015 09:16

Re: Emails that are retained for containing .dat files

Post by pdwalker »

log into your efa box and run the following command from the shell and post the results here.

Code: Select all

grep -r "No programs allowed" /etc/MailScanner/
uzisuicida
Posts: 10
Joined: 24 Jan 2019 06:24

Re: Emails that are retained for containing .dat files

Post by uzisuicida »

Hello pdwalker, here the result of executing that command.
Thanks!
Attachments
Untitled.png
Untitled.png (16.91 KiB) Viewed 552 times
User avatar
pdwalker
Posts: 1489
Joined: 18 Mar 2015 09:16

Re: Emails that are retained for containing .dat files

Post by pdwalker »

Ok, so that is weird.

I cannot reproduce the problem.

Is it possible for you to forward me an email as an attachment that is triggered by your efa system? I would like to inspect the email in question to see if I can work out why it is trigguring the "No executables" rule.

Maybe there is an executable contained inside the .dat file and that is why efa is objecting.

I'll send you a private message with my address if you are willing for me to have a look.
User avatar
pdwalker
Posts: 1489
Joined: 18 Mar 2015 09:16

Re: Emails that are retained for containing .dat files

Post by pdwalker »

Oh, hey, look! I found this in the EFA slack channel
Ben
2:58 PM
Hey, is there any to fix the MailScanner: No programs allowed (220000.dat) and allow .dat files?

Shawn Iverson
6:53 PM
In /etc/MailScanner/MailScanner.conf:
Archives: Ignore DAT File Executable = yes
What are your settings?

This is my /etc/MailScanner/MailScanner.conf file (including line numbers)

Code: Select all

1386 # Some dat files appear as DOS executables (such as in Corel or
1387 # Office files). This setting allows such dat files through without
1388 # having to disable the DOS executable deny rule.
1389 Archives: Ignore DAT File Executable = no
uzisuicida
Posts: 10
Joined: 24 Jan 2019 06:24

Re: Emails that are retained for containing .dat files

Post by uzisuicida »

Hello,

My config is like this:
Attachments
Untitled.png
Untitled.png (10.28 KiB) Viewed 474 times
User avatar
pdwalker
Posts: 1489
Joined: 18 Mar 2015 09:16

Re: Emails that are retained for containing .dat files

Post by pdwalker »

Without the original message to examine, I don't have a solution other than to disable the "No executables" rule inside of MailScanner in the filetype rules configuration files.
uzisuicida
Posts: 10
Joined: 24 Jan 2019 06:24

Re: Emails that are retained for containing .dat files

Post by uzisuicida »

Hello, sorry for the delay in responding. I am sending you the original emails, which are blocked because they contain .dat files and even ignoring that validation:

Files: Ignore DAT File Executable = yes

Mailscanner it keeps blocking them.

How can I disable executable blocking? It is the only thing that occurs to me that I can do, for the moment, since this problem is creating communication problems with our suppliers.
Post Reply