Firetrust Support Forums

Hi,

is there any way to block attachments in MWES?

Eddie

If you want to filter attachments, you could use a regular expression like this in the Custom Filters (choose Regular expression instead of text)

.*\.(zip|exe|com|vbs)$

i am agree, but it does not work
I have:
Attachments1 .*\.(zip|exe|com|vbs)$ All fields Regular Expression

I sendt a mail from gmail with "testing.zip" and it passed right thru...

Eddie

Can you have a look in the 'All Emails' screen, find the email and hover the mouse over the status column, a tooltip will appear and tell you why it was delivered. Perhaps on the whitelist?

it show :250 2.0.0. OK qued as xxxxxxxx

yes, it could be whitlisted becaused of we have (at last) whitelisted allmost all gmail servers.

how can I see what is has been accepted on?

Eddie

Ok, if you look at the headers of the delivered email you'll see an item X-MWES-Reason

is there any log where i can read the check status?
(i dont get the same mail as my users and cannot see whats so special about the mails)

I testet:
.*\.(zip|exe|com|vbs)$

And this is also stoppig mail that has been forwardet, with a htm and msg attachment.

I testet this: (from postfix)
[^>]*\.(rar|zip)

and this is not so hard, but it also stopping mail that i have to check content of...

BTW: should we use "custom / Reg.ex / BODY check?" or "All fields" ?

Eddie

Can you try this, it's an AND filter because each expression is on a new line. Just copy this below and make the filter to match anything in the header.


Content-disposition: attachment;
^\s?filename='.+\.(pif|scr|hta|cmd|bat|vbs|com|cpl|hlp|exe|xls)'