Postfix mail server block .bat, .exe .com .vbs mime attachments – common virus spreading files

by on June 20, 2007 · 8 comments· LAST UPDATED December 18, 2007

in , ,

Postfix provides Mime header check for all incoming messages. You can put restrictions on .exe / .bat / .vbs files and block all attachments.

mime_header_checks directive allows you to define file, you will place a restriction for any file extensions that you do not want to have passing through your mail sever system.

On most mail server the first thing that needs to be done is to enable header checks and block dangerous files.

Define mine header checks

Open main.cf file:
# vi /etc/postfix/main.cf
Append / set mime_header_checks directive as follows:
mime_header_checks = regexp:/etc/postfix/mime_header_checks

Save and close the file.

Block attachments

Now open /etc/postfix/mime_header_checks file:
# vi /etc/postfix/mime_header_checks
Append following line:
/name=[^>]*\.(bat|com|exe|dll|vbs)/ REJECT
Save and close the file.

Restart postfix

First create postfix lookup table for mime_header_checks file:
# /etc/init.d/postfix restart

Watch log file

You should see rejected mail log in /var/log/maillog file:
# tail -f /var/log/maillog
Output:

Jun 20 14:28:06 server postfix/smtpd[5442]: connect from web31601.mail.mud.yahoo.com[68.142.198.147]
Jun 20 14:28:07 server postfix/smtpd[5442]: 245F913906EE: client=web31601.mail.mud.yahoo.com[68.142.198.147]
Jun 20 14:28:07 server postfix/cleanup[5492]: 245F913906EE: message-id=<274995.40473.qm@web31601.mail.mud.yahoo.com>
Jun 20 14:28:07 server postfix/cleanup[5492]: 245F913906EE: reject: header Content-Type: application/x-msdos-program; name="updatebankdetails.bat" from web31601.mail.mud.yahoo.com[68.142.198.147]; from= to= proto=SMTP helo=: Message content rejected

For more information please read postfix and header_checks man page.

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 8 comments… read them below or add one }

1 Yannick June 26, 2007 at 10:19 pm

Do not postmap regexp (or pcre) files ;)

Reply

2 Sreedhar January 17, 2008 at 6:51 am

If i wanted to allow send these extensions for few members. How to configure ?

Reply

3 movzx February 5, 2009 at 2:10 pm

After a LONG afternoon spent on removing Bagle from users’ PCs, no more exe attachments in mail ;)

Reply

4 Özkan ŞENOVA April 17, 2009 at 10:20 am

If you use this rule, you may have problems with the emails, which has attachments containing a website adress in file name. For example: “yahoo.com statistics.xls”

I use /name=[^>]*\.(bat|com|exe|dll|vbs)$/ REJECT to fix this issue :)

Reply

5 sin July 27, 2010 at 2:29 pm

with only $ at the end this rule will not work at all, because filename is placed between “”, so all line looks like follows:
/name=[^>]*\.(bat|com|exe|dll|vbs)\”$/ REJECT

Reply

6 ya August 10, 2009 at 6:18 am

Can I do this only for a user list or a group? This is a global setting which is applied to all users. If its possible, please send some guidelines.

Reply

7 indhran September 3, 2009 at 9:15 am

Need to perform postmap /etc/postfix/mime_header_checks to create the db.

Reply

8 nick December 5, 2014 at 12:10 pm

HI,
How to block uploading of .exe and virus flies

Reply

Leave a Comment

Tagged as: , , , , , , , ,

Previous post:

Next post: