A New MTA Filter

winhost · Post by **winhost** » Mon Jan 12, 2004 9:08 pm

MeFilter works right up at the start. but the big problem is it consumes too much of CPU usage. I don't want to degrade the server performance just to filter mail.

choppy · Post by **choppy** » Mon Jan 12, 2004 10:27 pm

Hey, thanks for this great program. It seems to be running smoothly and catching everything so far. I have one issue and its that while my attachments are being blocked (deleted) correctly, but the email message is completely lost. Only the line in the AttachFilterMessage is shown, and the macro keywords TEXTBODY and HTMLBODY don't seem to work.

Anybody have this problem?

MartynK · Post by **MartynK** » Tue Jan 13, 2004 1:59 am

"Winhost", sorry if the program is using to much CPU, but the only other thing I can do is slow the program down so it yields more time to other processes. I will have a look into this, but at the end of the day it will not stop other things from running.

"Choppy" I trust you have setup the "AttachFilterDeleteExt" option. This "Will" delete the whole email. If you just want to remove the attachment and allow the rest of the email to be delivered, you need to use the "AttachFilterRemoveExt" instead. As for the TEXTBODY and HTMLBODY keywords not working, can you send me a copy of your template file so I can have a look.

Thanks

Martyn

json · Post by **json** » Tue Jan 13, 2004 9:20 am

winhost: it's either heavy CPU usage or a low priority thread, which means that the mail will be delivered slower.

It could be made an option, low or high priority thread ..!?

regards,
J.

EricConley · Post by **EricConley** » Tue Jan 13, 2004 10:42 am

Martyn
Sorry for the delay in reply to your post of 8.17 Monday.

I think I have the latest copies of everything.

The MEFilter.exe seems to be looking for EMAILSTATSPATH whilst the base config file has EmailStatsUserPath, that is with "User" in the label.

When I took user out of the config it worked.

I think my analysis is correct, I have been too busy with other things to confirm. AND I could have it wrong.

I'll let you know if I find anything more conclusive.

Eric

choppy · Post by **choppy** » Tue Jan 13, 2004 1:11 pm

Thanks for the reply, Martyn. I was using AttachFilterRemoveExt and not the Delete option. But I didn't use a template file, I had just added the Macro keyword to the AttachFilterMessage. Here is the code I have for that section. I'll try the template file now.

Code: Select all

#
# Attachment Filtering
#
AttachFilterEnabled=Yes
AttachFilterHoldPath=AttFilter
AttachFilterMessage=%TEXTBODY% The Attachment %FILENAME% Has Been Removed.  

# What Direction Do We Filter: In, Out, Both
AttachFilterDirection=Both

# Attachment Extensions That Will Cause The Message To Be Deleted
AttachFilterDeleteExt=

# Attachment Extensions That Will Be Removed From Messages
AttachFilterRemoveExt=.bat,.chm,.cmd,.com,.cpl,.crt,.dat,.dll,.exe,.etc

# Attachment Messages That Will Be Put Into Holding Area
AttachFilterHoldExt=

# Attachment Mail Notification
AttachFilterNotifyDelete=No
AttachFilterNotifyDeleteSubject=Your Email has been Deleted due to a blocked attachment
AttachFilterNotifyDeleteFile=AttDelEMail.Cfg
AttachFilterNotifyDeleteHtmlFile=
AttachFilterNotifyHold=No
AttachFilterNotifyHoldSubject=Your Email has been Held due to a blocked attachment
AttachFilterNotifyHoldFile=AttHoldEMail.Cfg
AttachFilterNotifyHoldHtmlFile=

Is there a limit of only one macro per line unless a template is used?

choppy · Post by **choppy** » Tue Jan 13, 2004 1:35 pm

Well, I had no luck with trying to force a template message when removing attachments.

Also, I can duplicate what EricConley mentioned. Removing 'user' places the EmailStats in the right directory.

MartynK · Post by **MartynK** » Wed Jan 14, 2004 3:03 am

Choppy,

Oops, my fault I thought I had correctly fixed the Stats path problem, but I had not. It should be OK in the next version I release.

As for the AttachFilterMessage setting, only the %FILENAME% option can be used as I did not see why anyone would want to put much more than the filename, hence it is only a single line of config and not a template file. All of the other macros are available when you are using template files for messages that have been placed into a holding area.

webfeat · Post by **webfeat** » Wed Jan 14, 2004 9:10 am

when looking for Spam words does MEfilter check the subject and body or just the body?

MartynK · Post by **MartynK** » Wed Jan 14, 2004 9:35 am

It checks (or can be configured to check) the following:

Message To/From Address (as in the mail file)
Actual To/From Addresses (as used by SMTP)
CC from the mail file
Subject line
Text body (normalised)
HTML body (normalised)
Raw HTML body

Hope thats enough for now ?

I may add message headers later.

choppy · Post by **choppy** » Wed Jan 14, 2004 1:12 pm

Here is the situation I envision (a normal situation for us):
A customer sends us a detailed email with multiple attachments and a long text message. One of the attachments happens to be an .EXE, which I would like removed for security reasons, but the rest of the message should be ok for the user.

So I have one of two choices, AttachFilterRemoveExt or AttachFilterDeleteExt. If I use AttachFilterRemoveExt, I will receive all of the good attachments, but not the message. If I use AttachFilterDeleteExt, I can show the message using the macros, but not the other attachments.

Do you think you would be willing to add the ability to pass the original text message when using AttachFilterRemoveExt?

Or...the other feature I would request, would be the ability to modify messages and/or remove attachments from MEConsole. That way I could hold the message, manually delete the "bad" attachment, and release the message to the user, if necessary.

Thanks again MartynK, I am having a lot of fun working with your program!

MartynK · Post by **MartynK** » Wed Jan 14, 2004 1:19 pm

I have added the last of the versions that I will class as a beta for this first release (unless any major problems are found over the next few days). This version adds a lot of new functionality including domain specific overrides and more console controls including some configuration file editors.

There are also some new configuration settings, of which I have tried to detail them all on the web site http://www.publicplanet.com/mefilter , but the most important thing is that to use the majority of the new functionality, Message Splitting MUST be enabled.

Any problems let me know.

Martyn

MartynK · Post by **MartynK** » Wed Jan 14, 2004 1:49 pm

"Choppy" I don't understand what is happening on your system. What you have asked for is what is coded to happen. If the extension is in the "AttachFilterDeleteExt" the whole email will get deleted. If the extension is in the "AttachFilterRemoveExt" then the attachment will get removed and the text from "AttachFilterMessage" will be added to the start of both the Text Body and the HTML body of the original message.

I have just tested this on my system and it is working fine. The following is my config file entries for the attachment filtering.

Code: Select all

#
# Attachment Filtering
#
AttachFilterEnabled=Yes
AttachFilterHoldPath=AttFilter
AttachFilterMessage=The Attachment %FILENAME% Has Been Removed

# What Direction Do We Filter: In, Out, Both
AttachFilterDirection=In

# Attachment Extensions That Will Cause The Message To Be Deleted
AttachFilterDeleteExt=

# Attachment Extensions That Will Be Removed From Messages
AttachFilterRemoveExt=.cmd,.hta,.bat,.vbs,.java,.pl,.pif,.{,.scr,.exe

# Attachment Messages That Will Be Put Into Holding Area
AttachFilterHoldExt=.dll,.ocx

# Attachment Mail Notification
AttachFilterNotifyDelete=Yes
AttachFilterNotifyDeleteSubject=Your Email has been Deleted due to a blocked attachment
AttachFilterNotifyDeleteFile=AttDelEMail.Cfg
AttachFilterNotifyDeleteHtmlFile=
AttachFilterNotifyHold=Yes
AttachFilterNotifyHoldSubject=Your Email has been Held due to a blocked attachment
AttachFilterNotifyHoldFile=AttHoldEMail.Cfg
AttachFilterNotifyHoldHtmlFile=

There must be something we are missng here. Can you email to me a copy of all your config files and a copy of the log entry when a email with an attachment is being processed to mefilter@publicplanet.com and I will have a look. Make sure the LogLevel is set to Debug.

Laters

Martyn

webfeat · Post by **webfeat** » Thu Jan 15, 2004 12:22 pm

MartynK wrote:It checks (or can be configured to check) the following:

Message To/From Address (as in the mail file)
Actual To/From Addresses (as used by SMTP)
CC from the mail file
Subject line
Text body (normalised)
HTML body (normalised)
Raw HTML body

Hope thats enough for now ?

I may add message headers later.

Where is the setting for scanning the subject line? (or does it do it by default?)

MartynK · Post by **MartynK** » Fri Jan 16, 2004 1:31 am

All things are scanned by default with the exception of the From Address and the Raw HTML. These are settings.

A New MTA Filter

AttachFilterMessage

no dice