iRedMail: Attachment Blocking with Amavis

Vyacheslav

6 months ago

It was necessary to block certain attachment formats, as they were often used to send malicious data.

For example, a docx.z file was distributed from compromised emails. I first searched for emails with this attachment to delete it:

grep -rE "filename=.*\.z(\"|'|$)" /var/vmail/vmail1/
grep -rEcl "filename=.*\.z(\"|'|$)" /var/vmail/vmail1/ | xargs grep -m 1 "^From: "

Then I opened the Amavis configuration:

nano /etc/amavis/conf.d/50-user

I made sure that D_DISCARD (silently delete) was specified, and not D_BOUNCE (return an error notification to the sender):

$final_banned_destiny = D_DISCARD;

Found the line:

$banned_filename_re = new_RE(

Below it, you can add a line to block a specific .z extension (convenient if you need to disable it, for example by commenting it out):

qr'.\.(z)$'i,

But it’s better to add it to the existing line, for example, I found:

  qr'.\.(exe|vbs|pif|scr|cpl)$'i,             # banned extension - basic

And added the extensions .z and .txz:

  qr'.\.(exe|vbs|pif|scr|cpl|z|txz)$'i,             # banned extension - basic

The i flag at the end means that the lock will work on both .Z and .z.

You can check the configuration with the amavisd-new showkeys command. If there are no errors, then everything is ok.

Let’s apply the changes:

systemctl restart amavis
systemctl status amavis

For the test, we’ll send an empty file, renaming it test.docx.z, and the logs /var/log/mail.log will contain a record of its blocking.