amavis-user March 2012 archive
Main Archive Page > Month Archives  > amavis-user archives
amavis-user: Re: Problem with @banned_files_lovers_maps.

Re: Problem with @banned_files_lovers_maps...

From: Mark Martinec <Mark.Martinec+amavis_at_nospam>
Date: Fri Mar 23 2012 - 19:24:24 GMT
To: amavis-users@amavis.org

Klaus,

> thank you for your information, but we do not use alterMIME or any
> similar programm to change something. From our yesterdays Test, this
> is the message source of the e-Mail, please can you see something,
> where the problem can occur?
>
> Received: from mx11.ourdomain.tld (mx11.ourdomain.tld [172.25.10.169]) by
> relay.ourdomain.tld (Postfix) with ESMTP id DF5A01F708D for
> <specialuser@ourdomain.tld>; Tue, 20 Mar 2012 14:55:52 +0100 (CET)
> Received: from viruswallvz.ourdomain.tld (amavisvz.ourdomain.tld
> [172.25.10.167]) by mx11.ourdomain.tld (Postfix) with ESMTP id CC4B83FC87 for
> <specialuser@ourdomain.tld>; Tue, 20 Mar 2012 14:55:52 +0100 (CET)
> X-Amavis-Modified: Mail body modified (defanged) - viruswallvz.ourdomain.tld
> X-Virus-Scanned: amavisd-new at ourdomain.tld
> X-Amavis-Alert: BANNED, message contains audio/mpeg,.dat,01 Test.mp3
> Received: from mx11.ourdomain.tld ([172.25.10.169]) by viruswallvz.ourdomain.tld
> (viruswallvz.ourdomain.tld [172.25.10.167]) (amavisd-new, port 10024)
> with ESMTP id 3GTahVLQfNnf for <specialuser@ourdomain.tld>;
> Tue, 20 Mar 2012 14:51:03 +0100 (CET)

Apparently you *do* have defanging enabled on a host 172.25.10.167:

> X-Amavis-Modified: Mail body modified (defanged) - viruswallvz.ourdomain.tld

Disable altermime if you have it installed but do not want to use it:

  $altermime = undef;

or disable defanging altogether, if you have it enabled:

  $defang_banned = undef;

or all of them:

  $defang_virus = undef;
  $defang_banned = undef;
  $defang_spam = undef;
  $defang_bad_header = undef;
  $defang_undecipherable = undef;
  $defang_all = undef; # mostly for testing

Btw, these are all off by default, so apparently somewhere in your
configuration you have it enabled for some or all contents categories.

  Mark