procmail
[Top] [All Lists]

Re: procmail antivirus recipe trashing messages sent via photo suite

2001-08-03 16:16:00
Could someone tell me where in the recipe that the rule is matching?

This line from your log:

procmail: Match on ".*\.(vbs|wsf|shs|scr|pif|bat|com)"

tells you that this part of the recipe:

         :0B
         * .*\.(vbs|wsf|shs|scr|pif|bat|com|lnk)
         /dev/null

is matching.

So your Photo Suite attachment contains one of those 4-character strings
in it somewhere.

If an email contains the string 'Content-type:' at the start of a line
and one of those 4-char strings anywhere, the email gets thrown away.
Which is perhaps a little more gung-ho than you intended.  You need to
be clearer about what you want to throw away.

You might like to check the mailing list archives where there are plenty
of posts talking about dealing with this kind of thing.

How about a workaround?

As a first step, you might want to deliver the questionable mail to a
'quarantine' mailbox where you can inspect the contents at your leisure
rather than simply sending them to /dev/null.

A couple of other things that aren't so important.

Your conditions like:

  * .*something

are better written as

  * something

That leading .* doesn't gain you anything.

Also, what are you trying to do with the 'h' and 'w' flags here?

:0 hBHw

Procmail is just ignoring them as they don't do anything in this
context.  Which is why you're getting this log message:

procmail: Extraneous deliver-head flag ignored

Hope that helps,
Martin
-- 
Martin McCarthy                 /</                  PGP key available
    `Procmail Companion'        \>\  http://www.ancient-scotland.co.uk
     Addison Wesley             /</    http://www.ehabitat.demon.co.uk
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail