Hello,
On my current mail server, I manually configured amavis over the years. I block newer macro-enabled office documents (.docm, xlsm...) and I also block older office documents (.doc, .xls...) ONLY IF they contain macro.
With PMG, I can easily block mail if they contain newer macro-enabled documents, but I can't block mail if they contain older documents. Blocking every .doc or .xls document is not acceptable.
With my current Amavis configuration I added this:
The file detectvba.pl come from https://github.com/technion/maia_mailguard/blob/master/scripts/detectvba.pl. I personally modified it to replace "infected" by "banned" in order to avoid users to panic when they receive legitimate file that contain macros.
Is it a feature you consider to add?
Thank you!
On my current mail server, I manually configured amavis over the years. I block newer macro-enabled office documents (.docm, xlsm...) and I also block older office documents (.doc, .xls...) ONLY IF they contain macro.
With PMG, I can easily block mail if they contain newer macro-enabled documents, but I can't block mail if they contain older documents. Blocking every .doc or .xls document is not acceptable.
With my current Amavis configuration I added this:
Code:
push @av_scanners, ['Detect-VBA',
'/usr/local/bin/detectvba.pl', "{}",
[0], qr/BANNED/, qr/\bBANNED (.+)\b/m ];
The file detectvba.pl come from https://github.com/technion/maia_mailguard/blob/master/scripts/detectvba.pl. I personally modified it to replace "infected" by "banned" in order to avoid users to panic when they receive legitimate file that contain macros.
Is it a feature you consider to add?
Thank you!