Move message with attached file .zip to Junk Folder

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
fauzi.salleh
Posts: 2
Joined: Wed Nov 09, 2016 3:11 am

Move message with attached file .zip to Junk Folder

Postby fauzi.salleh » Wed Nov 09, 2016 3:20 am

Hello there,

I'm Fauzi, newbie on Zimbra. 8-)
Currently our company use Zimbra version 8.6 as Mail system. ;)
Appreciate if you could help us how to set on Zimbra AntiSpam or AntiVirus to move all receive an email that comes with attached files format ".ZIP " to go to the "Junk folder" automatically. :roll:
From Zimbra Administration there no option to configure that. Kindly need your advice.

Best regards,

Fauzi Salleh
Zimbra newbie


fauzi.salleh
Posts: 2
Joined: Wed Nov 09, 2016 3:11 am

Re: Move message with attached file .zip to Junk Folder

Postby fauzi.salleh » Thu Nov 10, 2016 2:15 am

Hello there,

Anybody can help us how to set on Zimbra AntiSpam or AntiVirus to move all message with attachment zip file to Junk Folder? :?: :(

Best regards,

Fauzi
Zimbra newbie
User avatar
JDunphy
Outstanding Member
Outstanding Member
Posts: 518
Joined: Fri Sep 12, 2014 11:18 pm
Location: Victoria, BC
ZCS/ZD Version: 8.7.11_P14 RHEL6 Network Edition
Contact:

Re: Move message with attached file .zip to Junk Folder

Postby JDunphy » Thu Nov 10, 2016 5:32 pm

I think there are quite a few ways to do this. Zimbra itself has some code that appears to look for zip attachments in spamassassin... I have not tested this but I believe __ZIP_ATTACH_NOFN will be set for a zip attachment. That is because I see this:

Code: Select all

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __ZIP_ATTACH_NOFN   Content-Type =~ m,\bapplication/zip[;\s]*$,i
endif


That means you could create a custom rule in /opt/zimbra/data/spamassassin/localrules/sauser.cf like this:

Code: Select all

header ZIP_FILE_PRESENT
meta ZIP_FILE_PRESENT (__ZIP_ATTACH_NOFN)
score ZIP_FILE_PRESENT 10


Make the score high if you want it directly into junk or low if you want the ability to filter and put it in the junk folder with a user filter. You could also add more conditions to the meta line' so that only certain conditions trigger the rule. You can test your syntax by doing this:

Code: Select all

/opt/zimbra/common/bin/spamassassin --lint


and if it looks good... have zimbra pickup the changes by:

Code: Select all

zmamavisdctl restart


Here is what I do.... I score it low so it is present in X-Spam-Status but the users can create a filter that says if X-Spam-Status contains ATTACHMENT_PRESENT and the sender isn't in their contact list to move it to junk. Because pdf's can have js, we also can alert them to potential problems in addition to zip files.

I do that by modifying /opt/zimbra/data/spamassassin/localrules/sauser.cf and adding some additional code from cpan with the following snippet of code. I just copy Attachment.pm to /opt/zimbra/common/lib/perl5/Mail/SpamAssassin/Plugin/ or anyplace that perl -V tells me that zimbra's perl is searching. Note: you are on the hook in every upgrade to verify your code is still there. :-)

loadplugin Mail::SpamAssassin::Plugin::Attachments

#
body ATTACHMENT_PRESENT eval:check_attach()
score ATTACHMENT_PRESENT 0.1
describe ATTACHMENT_PRESENT Contains a pdf or zip attachment

So the filter would look like this

Image

Yet another method is using postifx to block it ... see /opt/zimbra/conf/postfix_header_checks

Probably a few more ways.

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 16 guests