[Rspamd-Users] [ext] Re: Block File by type or extantion

Ralf Hildebrandt Ralf.Hildebrandt at charite.de
Tue Dec 11 09:00:50 UTC 2018

* Tim Harman via Users <users at lists.rspamd.com>:
> On 11/12/2018 8:51 am, Koby Peleg Hen wrote:
> > This is file name not file type. 
> > I am looking for block by file type like mailscanner.
> Please don't top-reply on this list. 
> You can block by extension, which is basically filetype.  Of course it's
> possible to rename a zip to pdf etc to bypass this. 

And that's what trojans and viruses do nowadays!

> Are you saying that mailscanner performs heuristics on the file to
> determine it's type, ignoring whatever extn it has? 

Like amavisd-new does.

> rspamd doesn't do this and while I can't actually speak for the author,
> I doubt it ever will.  I think it would slow down processing too much.

'file' reads the first 64 Bytes of the file to find it's type. How
lang could that take?

Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
https://www.charite.de             Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155

More information about the Users mailing list