It was necessary to block certain attachment formats, as they were often used to send malicious data.
For example, a docx.z file was distributed from compromised emails. I first searched for emails with this attachment to delete it:
grep -rE "filename=.*\.z(\"|'|$)" /var/vmail/vmail1/
grep -rEcl "filename=.*\.z(\"|'|$)" /var/vmail/vmail1/ | xargs grep -m 1 "^From: "
Then I opened the Amavis configuration:
nano /etc/amavis/conf.d/50-user
I made sure that D_DISCARD (silently delete) was specified, and not D_BOUNCE (return an error notification to the sender):
$final_banned_destiny = D_DISCARD;
Found the line:
$banned_filename_re = new_RE(
Below it, you can add a line to block a specific .z extension (convenient if you need to disable it, for example by commenting it out):
qr'.\.(z)$'i,
But it’s better to add it to the existing line, for example, I found:
qr'.\.(exe|vbs|pif|scr|cpl)$'i, # banned extension - basic
And added the extensions .z and .txz:
qr'.\.(exe|vbs|pif|scr|cpl|z|txz)$'i, # banned extension - basic
The i flag at the end means that the lock will work on both .Z and .z.
You can check the configuration with the amavisd-new showkeys command. If there are no errors, then everything is ok.
Let’s apply the changes:
systemctl restart amavis
systemctl status amavis
For the test, we’ll send an empty file, renaming it test.docx.z, and the logs /var/log/mail.log will contain a record of its blocking.
See also my article:
Dovecot. Autoclean email in Trash