summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat (limited to 'mail-filter/anomy-sanitizer/files/anomy.conf')
-rw-r--r--mail-filter/anomy-sanitizer/files/anomy.conf207
1 files changed, 207 insertions, 0 deletions
diff --git a/mail-filter/anomy-sanitizer/files/anomy.conf b/mail-filter/anomy-sanitizer/files/anomy.conf
new file mode 100644
index 000000000000..f7c45cd973d2
--- /dev/null
+++ b/mail-filter/anomy-sanitizer/files/anomy.conf
@@ -0,0 +1,207 @@
+# Example configuration file for Anomy Sanitizer
+#
+# Thiemo Kellner, thiemo@thiam.ch, 2003-05-29
+# Based on http://advosys.ca/papers/postfix-filtering.html,
+# Advosys Consulting Inc., Ottawa
+#
+# Works with Anomy Sanitizer revision 1.60
+
+
+ # Warn user about unscanned parts, etc.
+ feat_verbose = 1
+
+ # Inline logs: 0 = Off, 1 = Maybe, 2 = Force
+ feat_log_inline = 1
+
+ # Print log to standard error: 0 = Off, 1 = On
+ feat_log_stderr = 1
+
+ # Don't use XML format for logs.
+ feat_log_xml = 0
+
+ # Omit trace info from logs.
+ feat_log_trace = 0
+
+ # Don't add any scratch space to part headers.
+ feat_log_after = 0
+
+ # Enable filename-based policy decisions.
+ feat_files = 1
+
+ # Force all parts (except text/plain and
+ # text/html parts) to have file names: 0 = Off, 1 = On
+ feat_force_name = 1
+
+ # Replace all boundary strings with our own
+ # NOTE: Always breaks PGP/MIME messages!
+ feat_boundaries = 0
+
+ # Protect against buffer overflows and null values.
+ feat_lengths = 1
+
+ # Defang incoming shell scripts.
+ feat_scripts = 1
+
+ # Defang active HTML content.
+ feat_html = 1
+
+ # Web-bugs are allowed.
+ feat_webbugs = 0
+
+ # Don't scan PGP signed message parts: 0 = Don't scan (???)
+ feat_trust_pgp = 0
+ msg_pgp_warning = WARNING: Unsanitized content follows.\n
+
+ # Sanitize inline uuencoded files.
+ feat_uuencoded = 1
+
+ # Sanitize forwarded messages
+ feat_forwards = 1
+
+ # Set to 0 if going productive (This isn't a test-case configuration.)
+ feat_testing = 1
+
+ # Fix invalid MIME, if possible.
+ feat_fixmime = 1
+
+ # Don't be excessively paranoid about MIME headers etc.
+ feat_paranoid = 0
+
+ # Advertisement to insert in each mail header:
+ header_info = X-Sanitizer: Anomy Sanitizer mail filter
+ header_url = 0
+ header_rev = 0
+
+
+ #
+ # Scoring
+ #
+
+ # Any message requring this many modifications
+ # will cause the sanitizer to return a non-zero
+ # exit code after processing the entire message.
+ # To disable set to 0.
+ score_bad = 100
+ #score_panic = 0
+
+ msg_file_drop = \n*****\n
+ msg_file_drop += NOTE: An attachment named %FILENAME was deleted from
+ msg_file_drop += this message because it contained a (windows) executable
+ msg_file_drop += or other potentially dangerous file type.
+ msg_file_drop += If you really need this attachment, have it re-sent
+ msg_file_drop += encapsulated, e.g. in a zip or tgz archive or contact your
+ msg_file_drop += mail system administrator.
+
+ #
+ # You may need to increase the following if you have a very
+ # complex configuration split between multiple files.
+ #
+ # Thiemo Kellner, thiemo@thiam.ch, 2003-05-31
+ # max_conf_recursions does not work with 1.60
+ #max_conf_recursions = 5 # The default is 5.
+ #
+ # Create temporary or saved files using this template.
+ # An attachment named "dude.txt" might be saved as
+ #
+ # /var/quarantine/att-dude-txt.A9Y
+ #
+ # Note: The directory must exist and be writable by
+ # the user running the sanitizer.
+ # (supposedly: $F -> file name, $$$ -> three arbitrary characters)
+ file_name_tpl = /var/spool/sanitizer/att-$F.$$$
+
+ # We have three policies, in addition to the default which is
+ # to defang file names.
+ #
+ file_list_rules = 3
+ file_default_policy = defang
+ file_default_filename = unnamed.file
+
+ # Delete obviously executable attachments. This list is
+ # incomplete! This is a perl regular expression, see "man
+ # perlre" for info. The (?i) prefix makes the regexp case
+ # insensitive.
+ #
+ file_list_1 = (?i)(winmail.dat)|
+ file_list_1 += (\.(exe|com|vb[se]|dll|ocx|cmd|bat|pif|lnk|hlp|ms[ip]|reg|sct
+ file_list_1 += |inf|asd|cab|sh[sb]|scr|cpl|chm|ws[fhc]|hta|vcd|vcf|eml|nws))$
+ file_list_1_policy = drop
+ file_list_1_scanner = 0
+
+ # Scan WinWord and Excel attachments with built-in macro scanner.
+ # We consider anything exceeding the score of 25 to be dangerous,
+ # and save it in the quarantine.
+ #
+ file_list_2 = (?i)\.(doc|dot|xls|xlw)$
+ file_list_2_policy = accept:accept:save:save
+ file_list_2_scanner = 0:1:2:builtin/macro 25# Do not log to STDERR:
+
+ # Allow file types considered "safe" (DO NOT JUST TRUST THIS LIST!)
+ file_list_3 = (?i)\.(
+ # Plain ASCII formats:
+ file_list_3 += txt|rtf|csv|dxf|htm|[sp]?html?|xml|xslt?|dtd|css|sgml
+ # PostScript (like) formats:
+ file_list_3 += |pdf|e?ps
+ # Word processor and document formats:
+ file_list_3 += |doc|dot|kwd|stw
+ # Spreadsheets:
+ file_list_3 += |xls|xlw|xlt|wk[1-4]|stc|ksp|gnumeric
+ # Presentation applications:
+ file_list_3 += |ppt|pps|pot|kpr|chrt
+ # Type setting formats:
+ file_list_3 += |dvi|texi?|tfm|txi|texinfo
+ # Flow charting:
+ file_list_3 += |flw
+ # Bitmap graphic files (maybe some are actually vector graphic formats):
+ file_list_3 += |jpe?g|gif|png|tiff?|bmp|psd|pcx|xcf|pat|pix|pnm|sgi|snp|ras|tga
+ file_list_3 += |xwd|xpm|dib|rle|cal|cas|pat|bmf|cel|cex|cgm|ico|img|jfi|jif|raw
+ file_list_3 += |crw|sun
+ # Vector graphics and diagramming:
+ file_list_3 += |vsd|drw|cdr|swf|pct|pict|kpm|kon
+ # Multimedia:
+ file_list_3 += |mp[23]|avi|mpe?g|mov|ram?|midi?|ogg|aiff?|au|snd|wav
+ # Archives:
+ file_list_3 += |zip|g?z|rar|tgz|t?bz2|tar|sit|sea|arc
+ # Package formats:
+ file_list_3 += |rpm|deb
+ # Others:
+ file_list_3 += |kfo
+ # Source code:
+ file_list_3 += |[ch](pp|\+\+)?|s|inc|asm|patch|java|php\d?|jsp|bas|ebuild)
+ file_list_3_policy = accept
+ file_list_3_scanner = 0
+
+ # Any file type not listed above gets renamed to prevent
+ # the mail client from auto-executing it.
+
+ #
+ # More sample file lists
+ #
+ # Scan mp3 files for Evil Viruses, using the imaginary mp3virscan
+ # utility. Always define FOUR potential policies, which depend on the
+ # exit code returned by the scanner. Which code means what is
+ # defined in the scanner line, which must contain THREE entries.
+ # The fourth policy is used for "anything else".
+ #
+ # "accept" if the file is clean (exit status 0 or 1)
+ # "mangle" if the file was dirty, but is now clean (2 or 4)
+ # "drop" if the file is still dirty (66)
+ # "save" if the mp3virscan utility returns some other exit code
+ # or an error occurs.
+ #
+ #file_list_4 = (?i)\.(mp3|mp2|mpg)$
+ #file_list_4_policy = accept:mangle:drop:save
+ #file_list_4_scanner = 0,1:2,4:66:/path/to/mp3virscan -opt -f %FILENAME
+
+ # Archives and scriptable stuff - virus scan these.
+ # NOTE: There must be THREE groups of exit codes and FOUR policies,
+ # - the first three match the code groups, the fourth is default.
+ #
+ #file_list_5_scanner = 0:5:3,4:/usr/local/bin/avp.sh %FILENAME
+ #file_list_5_policy = accept:accept:save:save
+ #file_list_5 = (?i)\.(xls|d(at|oc)|p(pt|l)|rtf|[sp]?html?
+ #file_list_5 += |class|upd|wp\d?|m?db
+ #file_list_5 += |z(ip|oo)|ar[cj]|lha|[tr]ar|rpm|deb|slp|tgz
+ #file_list_5 += )(\.g?z|\.bz\d?)*$
+
+