Blocking encrypted attachments with Amavis

Discussion in 'Server Operation' started by EvilFury, Jan 14, 2021.

  1. EvilFury

    EvilFury New Member

    I'm having a problem with amavis on my Centos 7 machine (amavisd-new 2.12.0, postfix 2.10.1, ISPConfig Version: 3.1dev).

    I'm trying to configure amavis so that it discards emails with encrypted .zip or .rar files attached. (sender gets a notification of undelivered email because of non-allowed content and a notification is also sent to as notification of what happened. The alias of virusalert is already configured, I receive those emails in my mailbox).

    At the moment, amavis detects the encrypted package attached to an email, but it forwards it to the recipient anyway and it sends to virusalert mailbox a notification of what has been done.

    Here's the message I receive from
    (I've sent an email from our internal mail server, that uses the one with amavis configured as relay, to my personal mailbox)

       No viruses were found.
        Content type: UncheckedEncrypted
        Internal reference code for the message is 21621-04/VDsYr4oLBKP5
        First upstream SMTP client IP address: [Sender IP]:7555
        Sender rDNS
        Received trace: ESMTPA://[Sender IP]:7555 <
          Microsoft_SMTP_Server://InternalServerIP < mapi://
        Return-Path: <>
        From: "My user"
        Message-ID: <>
        Subject: Test encrypted archive
        Not quarantined.
        The message WILL BE relayed to:
    Postfix's log shows the following:

        postfix/smtpd[21623]: connect from myhost[myIP]
        postfix/smtpd[21623]: NOQUEUE: filter: RCPT from myhost[myIP]: <>: Sender address triggers FILTER amavis:          []:10026; from=<> to=<> proto=ESMTP helo=<SMTP.local>
        postfix/smtpd[21623]: 53BFA7FB: myhost[myIP], sasl_method=LOGIN, sasl_username=myusername
        postfix/cleanup[21634]: 53BFA7FB: message-id=<>
        postfix/qmgr[20232]: 53BFA7FB: from=<>, size=28650, nrcpt=1 (queue active)
        postfix/smtpd[21623]: disconnect from myhost[myIP]
        postfix/smtpd[21639]: connect from localhost[]
        postfix/smtpd[21639]: C04406DC: client=localhost[]
        postfix/cleanup[21647]: C04406DC: message-id=<>
        postfix/qmgr[20232]: C04406DC: from=<>, size=3126, nrcpt=1 (queue active)
        postfix/smtpd[21639]: disconnect from localhost[]
        postfix/cleanup[21634]: CA805A93: message-id=<>
        postfix/qmgr[20232]: CA805A93: from=<>, size=3261, nrcpt=1 (queue active)
        postfix/local[21678]: C04406DC: to=<>, relay=local, delay=0.05, delays=0.02/0.03/0/0.01, dsn=2.0.0, status=sent (forwarded as CA805A93)
        postfix/qmgr[20232]: C04406DC: removed
        postfix/smtpd[21646]: connect from localhost[]
        postfix/smtpd[21646]: D5426A67: client=localhost[]
        postfix/cleanup[21647]: D5426A67: message-id=<>
        postfix/qmgr[20232]: D5426A67: from=<>, size=29603, nrcpt=1 (queue active)
        postfix/smtpd[21646]: disconnect from localhost[]
        amavis[21621]: (21621-04) Passed UNCHECKED-ENCRYPTED {RelayedOutbound}, ORIGINATING LOCAL [myIP]:7555 [myIP] <> -> <>, Queue-ID: 53BFA7FB, Message-ID: <>, mail_id: VDsYr4oLBKP5, Hits: -0.998, size: 28650, queued_as: D5426A67,, 2477 ms
        postfix/smtp[21635]: 53BFA7FB: to=<>, relay=[]:10026, delay=2.6, delays=0.08/0/0/2.5, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[]:10027): 250 2.0.0 Ok: queued as D5426A67)
        postfix/qmgr[20232]: 53BFA7FB: removed
        dovecot: lda( sieve: msgid=<>: stored mail into mailbox 'INBOX'
        postfix/pipe[21679]: CA805A93: to=<>, orig_to=<>, relay=dovecot, delay=0.08, delays=0.01/0.02/0/0.06, dsn=2.0.0, status=sent (delivered via dovecot service)
        postfix/qmgr[20232]: CA805A93: removed
    Why amavis detects the emails correctly but it just marks them as ***Passed UNCHECKED-ENCRYPTED*** and forwards them to the recipient anyway?

    I've researched online for the correct configuration to stop forwarding messages that attach encrypted archives (or gets marked as unchecked-encrypted by amavis), but so far nothing fully works.

    Can someone help me?

    Thanks a lot
    Last edited: Jan 14, 2021

Share This Page