1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
# Example configuration file for Anomy Sanitizer
#
# Thiemo Kellner, thiemo@thiam.ch, 2003-05-29
# Based on http://advosys.ca/papers/postfix-filtering.html,
# Advosys Consulting Inc., Ottawa
#
# Works with Anomy Sanitizer revision 1.60
# Warn user about unscanned parts, etc.
feat_verbose = 1
# Inline logs: 0 = Off, 1 = Maybe, 2 = Force
feat_log_inline = 1
# Print log to standard error: 0 = Off, 1 = On
feat_log_stderr = 1
# Don't use XML format for logs.
feat_log_xml = 0
# Omit trace info from logs.
feat_log_trace = 0
# Don't add any scratch space to part headers.
feat_log_after = 0
# Enable filename-based policy decisions.
feat_files = 1
# Force all parts (except text/plain and
# text/html parts) to have file names: 0 = Off, 1 = On
feat_force_name = 1
# Replace all boundary strings with our own
# NOTE: Always breaks PGP/MIME messages!
feat_boundaries = 0
# Protect against buffer overflows and null values.
feat_lengths = 1
# Defang incoming shell scripts.
feat_scripts = 1
# Defang active HTML content.
feat_html = 1
# Web-bugs are allowed.
feat_webbugs = 0
# Don't scan PGP signed message parts: 0 = Don't scan (???)
feat_trust_pgp = 0
msg_pgp_warning = WARNING: Unsanitized content follows.\n
# Sanitize inline uuencoded files.
feat_uuencoded = 1
# Sanitize forwarded messages
feat_forwards = 1
# Set to 0 if going productive (This isn't a test-case configuration.)
feat_testing = 1
# Fix invalid MIME, if possible.
feat_fixmime = 1
# Don't be excessively paranoid about MIME headers etc.
feat_paranoid = 0
# Advertisement to insert in each mail header:
header_info = X-Sanitizer: Anomy Sanitizer mail filter
header_url = 0
header_rev = 0
#
# Scoring
#
# Any message requring this many modifications
# will cause the sanitizer to return a non-zero
# exit code after processing the entire message.
# To disable set to 0.
score_bad = 100
#score_panic = 0
msg_file_drop = \n*****\n
msg_file_drop += NOTE: An attachment named %FILENAME was deleted from
msg_file_drop += this message because it contained a (windows) executable
msg_file_drop += or other potentially dangerous file type.
msg_file_drop += If you really need this attachment, have it re-sent
msg_file_drop += encapsulated, e.g. in a zip or tgz archive or contact your
msg_file_drop += mail system administrator.
#
# You may need to increase the following if you have a very
# complex configuration split between multiple files.
#
# Thiemo Kellner, thiemo@thiam.ch, 2003-05-31
# max_conf_recursions does not work with 1.60
#max_conf_recursions = 5 # The default is 5.
#
# Create temporary or saved files using this template.
# An attachment named "dude.txt" might be saved as
#
# /var/quarantine/att-dude-txt.A9Y
#
# Note: The directory must exist and be writable by
# the user running the sanitizer.
# (supposedly: $F -> file name, $$$ -> three arbitrary characters)
file_name_tpl = /var/spool/sanitizer/att-$F.$$$
# We have three policies, in addition to the default which is
# to defang file names.
#
file_list_rules = 3
file_default_policy = defang
file_default_filename = unnamed.file
# Delete obviously executable attachments. This list is
# incomplete! This is a perl regular expression, see "man
# perlre" for info. The (?i) prefix makes the regexp case
# insensitive.
#
file_list_1 = (?i)(winmail.dat)|
file_list_1 += (\.(exe|com|vb[se]|dll|ocx|cmd|bat|pif|lnk|hlp|ms[ip]|reg|sct
file_list_1 += |inf|asd|cab|sh[sb]|scr|cpl|chm|ws[fhc]|hta|vcd|vcf|eml|nws))$
file_list_1_policy = drop
file_list_1_scanner = 0
# Scan WinWord and Excel attachments with built-in macro scanner.
# We consider anything exceeding the score of 25 to be dangerous,
# and save it in the quarantine.
#
file_list_2 = (?i)\.(doc|dot|xls|xlw)$
file_list_2_policy = accept:accept:save:save
file_list_2_scanner = 0:1:2:builtin/macro 25# Do not log to STDERR:
# Allow file types considered "safe" (DO NOT JUST TRUST THIS LIST!)
file_list_3 = (?i)\.(
# Plain ASCII formats:
file_list_3 += txt|rtf|csv|dxf|htm|[sp]?html?|xml|xslt?|dtd|css|sgml
# PostScript (like) formats:
file_list_3 += |pdf|e?ps
# Word processor and document formats:
file_list_3 += |doc|dot|kwd|stw
# Spreadsheets:
file_list_3 += |xls|xlw|xlt|wk[1-4]|stc|ksp|gnumeric
# Presentation applications:
file_list_3 += |ppt|pps|pot|kpr|chrt
# Type setting formats:
file_list_3 += |dvi|texi?|tfm|txi|texinfo
# Flow charting:
file_list_3 += |flw
# Bitmap graphic files (maybe some are actually vector graphic formats):
file_list_3 += |jpe?g|gif|png|tiff?|bmp|psd|pcx|xcf|pat|pix|pnm|sgi|snp|ras|tga
file_list_3 += |xwd|xpm|dib|rle|cal|cas|pat|bmf|cel|cex|cgm|ico|img|jfi|jif|raw
file_list_3 += |crw|sun
# Vector graphics and diagramming:
file_list_3 += |vsd|drw|cdr|swf|pct|pict|kpm|kon
# Multimedia:
file_list_3 += |mp[23]|avi|mpe?g|mov|ram?|midi?|ogg|aiff?|au|snd|wav
# Archives:
file_list_3 += |zip|g?z|rar|tgz|t?bz2|tar|sit|sea|arc
# Package formats:
file_list_3 += |rpm|deb
# Others:
file_list_3 += |kfo
# Source code:
file_list_3 += |[ch](pp|\+\+)?|s|inc|asm|patch|java|php\d?|jsp|bas|ebuild)
file_list_3_policy = accept
file_list_3_scanner = 0
# Any file type not listed above gets renamed to prevent
# the mail client from auto-executing it.
#
# More sample file lists
#
# Scan mp3 files for Evil Viruses, using the imaginary mp3virscan
# utility. Always define FOUR potential policies, which depend on the
# exit code returned by the scanner. Which code means what is
# defined in the scanner line, which must contain THREE entries.
# The fourth policy is used for "anything else".
#
# "accept" if the file is clean (exit status 0 or 1)
# "mangle" if the file was dirty, but is now clean (2 or 4)
# "drop" if the file is still dirty (66)
# "save" if the mp3virscan utility returns some other exit code
# or an error occurs.
#
#file_list_4 = (?i)\.(mp3|mp2|mpg)$
#file_list_4_policy = accept:mangle:drop:save
#file_list_4_scanner = 0,1:2,4:66:/path/to/mp3virscan -opt -f %FILENAME
# Archives and scriptable stuff - virus scan these.
# NOTE: There must be THREE groups of exit codes and FOUR policies,
# - the first three match the code groups, the fourth is default.
#
#file_list_5_scanner = 0:5:3,4:/usr/local/bin/avp.sh %FILENAME
#file_list_5_policy = accept:accept:save:save
#file_list_5 = (?i)\.(xls|d(at|oc)|p(pt|l)|rtf|[sp]?html?
#file_list_5 += |class|upd|wp\d?|m?db
#file_list_5 += |z(ip|oo)|ar[cj]|lha|[tr]ar|rpm|deb|slp|tgz
#file_list_5 += )(\.g?z|\.bz\d?)*$
|
GitWeb