How do I set a filter to discard attachments?

Issue

How do I set a filter to discard attachments?

Solution

You can create filters on attachments using the Administration Suite or the command-line interface (CLI), using the following attributes:

:attachmentfilename

:attachmenttype

:attachmentsize

NOTE: Do not filter based on attachments using the :body attribute, as it creates false positives.

This article provides CLI examples. For additional information about filters and creating them:

• For the CLI, use the Help About Filter and Help Filter Add commands, or see the Mirapoint Administration Protocol Reference.
• For the Administration Suite, see the online help or the Mirapoint Message Server Administrator's Guide.

In the CLI, to filter on the attachment name (:attachmentname) of the mail message for any *.vbs attachment:

Filter Add (domain=primary) Testfilter1 Redirect RFC822_email_address Allof Stop

:attachmentfilename Matches "*.vbs"

.

To filter on the attachment filename (:attachmentfilename) of the message for the substring name.jpg:

Filter Add (domain=primary) Testfilter2 Redirect RFC822_email_address Allof Stop

:attachmentfilename Contains "name.jpg"

.

In MOS 3.1 and earlier releases, the capacity to discard a message containing a virus was provided by the virus scanner. However, the Mirapoint filtering mechanism can prevent attachments from reaching user mailboxes by redirecting them to a safekeeping mailbox, where they can then be examined for contamination.

NOTE: The current maximum number of all filters for any given domain is 200, with a maximum of 20 filter conditions per filter.

 

To filter on the body (:body) of the mail message for any *.vbs attachment:

Filter Add (domain=primary) Testfilter1 Redirect RFC822_email_address Allof Stop

:body Matches "*.vbs"

.

To filter on the body (:body) of the message for the substring content-type:, and for name.jpg:

Filter Add (domain=primary) Testfilter2 Redirect RFC822_email_address Allof Stop

:body Contains "name.jpg"

:body Contains "content-type:"

.

NOTE: Applying the 'and' (Allof) logic to more than one filter criteria increases the precision of the filter. To determine the exact filter specification, examine the source of the mail message containing a questionable attachment, and filter on the unique substrings. In the second filter example, you can make the filter condition for Content-Type: more granular by specifying the exact content-type:

:body Matches "*Content-type: image/jpeg*"

You can also examine the body of a mail message for keywords indicating the attachment of a file. For example, if a JPG file "tech.jpg" has been attached, you could set a filter using the following keywords:

Content-type: image/jpeg; charset=us-ascii

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=tech.jpg

NOTE: When specifying a match-type string of a email header that contains the double quotes, the double quotes must be escaped. If matching on a string that contains double quotes, use the following syntax:

:body Matches "*Content-Disposition: Attachment; filename=\"tech.jpg\"*"

If matching a string that does not include double quotes, do not specify double quotes. For example:

:body Matches "*Content-Disposition: Attachement; filename=tech.jpg*"