How to configure MIMEDefang to block attachments by file extension

 

Description

MIMEDefang includes in the default configuration a filter that rejects email attachments by file extension. This article describes how to integrate Axigen with MIMEDefang with the purpose to block such email attachments.

Resolution

MIMEDefang includes in the default configuration a filter that rejects email attachments by file extension. This article describes how to integrate Axigen with MIMEDefang with the purpose to block such email attachments.

The configuration described in this article was tested on CentOS 6 and on Ubuntu 12.04.


1. Install MIMEDefang

On CentOS 6, the mimedefang package is not available in the default repositories. It can be installed by enabling the EPEL repository. Instructions about enabling the EPEL repositories are available at:

https://fedoraproject.org/wiki/EPEL

After enabling EPEL, install MIMEDefang with the command:

yum install mimedefang

On Ubuntu 12.04, the command to install the package is:

apt-get install mimedefang


2. Configure MIMEDefang to listen on a TCP port

Edit the folowing file:

- On CentOS 6: /etc/sysconfig/mimedefang

- On Ubuntu 12.04: /etc/default/mimedefang

and add the line:

SOCKET=inet:10084

The port used in this example is 10084 but a different available port can be chosen.


3. Inspect the MIMEDefang configuration file available at /etc/mail/mimedefang-filter. The filter that blocks email attachments by file extension is located in the section:
# This procedure returns true for entities with bad filenames.
sub filter_bad_filename  {
    my($entity) = @_;
    my($bad_exts, $re);

    # Bad extensions
    $bad_exts = '(ade|adp|app|asd|asf|asx|bas|bat|chm|cmd|com|cpl|crt|dll|exe|fxp|hlp|hta|hto|inf|ini|ins|isp|jse?|lib|lnk|mdb|mde|msc|msi|msp|mst|ocx|pcd|pif|prg|reg|scr|sct|sh|shb|shs|sys|url|vb|vbe|vbs|vcs|vxd|wmd|wms|wmz|wsc|wsf|wsh|{[^}]+})';

    # Do not allow:
    # - CLSIDs  {foobarbaz}
    # - bad extensions (possibly with trailing dots) at end
    $re = '.' . $bad_exts . '.*$';

    return 1 if (re_match($entity, $re));

    # Look inside ZIP files
    if (re_match($entity, '.zip$') and
        $Features{"Archive::Zip"}) {
        my $bh = $entity->bodyhandle();
        if (defined($bh)) {
            my $path = $bh->path();
            if (defined($path)) {
                return re_match_in_zip_directory($path, $re);
            }
        }
    }
    return 0;
}
4. Verify the syntax of the mimedefang-filter file:

# perl -c /etc/mail/mimedefang-filter
/etc/mail/mimedefang-filter syntax OK
5. Start MIMEDefang:

/etc/init.d/mimedefang restart

Check that the process runs and that it listens on the defined TCP port:

# netstat -tlpn | grep 10084
tcp        0      0 0.0.0.0:10084           0.0.0.0:*               LISTEN      7401/mimedefang
#