renattach - rename/delete dangerous email attachments

renattach [OPTIONS]

renattach is a fast and efficient UNIX stream filter that can rename or delete potentially dangerous e-mail attachments. It's a highly effective way of protecting end-users from harmful mail content (worms/viruses) by disabling or removing attachments that may be accidentally executed by users. The filter is invoked as a simple pipe for use in a wide variety of systems. The 'kill' feature (which eliminates entire messages) can also help sites deal with resource strains caused by modern virus floods.

renattach is written in pure C and can quickly process mail with little overhead. Unlike a conventional virus scanner, there are no specific virus or worm definitions. Instead, renattach identifies potentially dangerous attachments based on file extension and executable encoded body content. The software is even capable of reading filenames from inside ZIP archives on the fly, without requiring any external software. The self-contained MIME code parses, fully interprets, then rewrites the header of every attached file. During this process it checks the file's extension against a list, and further checks to make sure the filename is not on a banned list. Only after passing through these steps is the MIME header written fresh using a predetermined, known format.

The program's operation is simple: a single mail message is read from stdin, filtered, then written to stdout (or piped to an external command).

renattach looks for its configuration file (renattach.conf) in the path specified at compile time. Alternatively, you can specify the location of renattach.conf by using the -c command-line options. For example: renattach -c renattach.conf

Note that the filter's default behaviour is to rename dangerous attachments that match the badlist {mode=badlist, action=rename}. If searching inside ZIP archives for filenames (see the search_zip configuration option), the only actions that modify the ZIP files are delete and kill but NOT rename. Therefore the default rename action has no effect on ZIP files; instead, use the --delete or --kill options. Alternatively, append the /d and /k switches to badlist extensions in the .conf file to selectively delete or kill some file types while just renaming the rest.

Filter mode: Match all attachments. -b, --badlist

Filter mode: Only match filenames that have extensions listed on the bad-list. This will match only attachments with known dangerous file extensions (default). -c, --config filename

Use the specified configuration file. Run renattach with --settings to verify the current settings. -d, --delete

Filter action: Delete attachment body after renaming headers. -e, --excode

Extend exitcodes with a new code, 77=filtering occurred. See below for standard exit codes. -g, --goodlist

Filter mode: Match all attachments except those that have extensions listed on the goodlist. -h, --help

Show help, explain options. -k, --kill

Filter action: Kill (absorb) entire email. -p, --pipe command [args]

Instead of writing output to stdout, open pipe to command (with args) and send output there. This program must return with exit code 0. This must be the last option on the command line. -r, --rename

Filter action: Rename matching attachments (default). The MIME type is also renamed to new_mime_type from the .conf file. -s, --settings

Show current settings/configuration and terminate. -v, --verbose

Write verbose output (including settings) to stderr. -V, --version

Display software version and terminate.

0 - Success (filtered mail and wrote output)

75 - Temporary failure (resource shortage; failed to write to pipe if using --pipe )

255 - Critical failure (improper parameters; bad .conf file)

The temporary failure code allows MTAs to re-queue mail for later delivery. These exit codes are compatible with BSD-style mailers, and --excode should not be used without good reason because it returns a non-success code when the filter "catches" something.

The .conf file should be a plaintext file with one configuration directive per line. Comments preceded by # will be ignored. Some directives may only appear once, while others (lists) are additive. The conf file and all directives are optional, as defaults are compiled into the software.

NOTE: please run renattach --settings to verify your configuration!

Description of all options:

# renattach 1.2.2 recognizes the following configuration directives.

# Delete executable binary attachments by signature. renattach looks # for encoded bytes that identify DOS/Windows executables ('MZ'). # If an executable is found, the encoded attachment will be removed # while the MIME header remains unchanged. This is a feature that # works independently of filename-based filtering, designed as a # backup. The net effect is that encoded executables are deleted. # Specify yes or no, or alternatively 1 or 0 # # delete_exe = yes

# Kill executable binary attachments by signature, as in the previous # directive. Note that delete_exe and kill_exe are mutually exclusive. # # kill_exe = no

# Search for filenames within ZIP archives using the internal ZIP # parsing engine (no external software required). Any filenames found # are subject to the same checks, for instance badlist or goodlist, # with the notable difference that the RENAME ACTION HAS NO EFFECT on # ZIP files. Only the delete or kill actions will modify ZIP files. # # search_zip = no

# Normally, MIME Content-ID fields are dropped during filtering due # to their application-specific use and security risk (recently used # by worms to link malicious code to embedded images). If you are sure # you want to pass Content-ID fields unfiltered, enable this option. # # pass_contentid = no

# Normally, all periods in filenames are replaced with underscores # during renaming. Although this is the recommended mode, you can # also disable full renaming if you only want the last period to be # changed to an underscore. # # full_rename = yes

# If enabled, all filtering actions will be logged via syslog. # renattach logs with priority 'warning' to facility 'mail' # # use_syslog = no

# A generic filename to use when parsing fails. Since renattach # rewrites all attachment headers, it's possible that corruption, # lack of buffer space, or some other problem will prevent filenames # from being recreated. In such a case, this generic name is used. # # generic_name = filename

# A replacement file extension to use when changing dangerous # attachment filenames. This extension is appended to the previous # one. For instance virus.pif becomes virus_pif.bad # # new_extension = bad

# When attachments are renamed, the MIME type is also changed to # this new_mime_type for safety. # # new_mime_type = application/unknown

# The following directives control how the message Subject is # modified to inform the user that filtering has occurred. They # have the following ORDER OF PRIORITY (starting with highest): # subj_banned, subj_exec, subj_deleted, subj_renamed, add_subject # By default, only add_subject is defined so any condition (whether # it's a ban, executable match, delete, or rename) results in the # same Subject addition. If you also define subj_exec then there # could be a different Subject if an executable was caught (since # it has higher priority than add_subject). Another alternative for # these options is to specify the single character # to suppress # Subject modification for that condition. You could use this to be # quiet in case a banned attachment is caught. You can also use # to # turn off add_subject, hence NEVER modify the message Subject.

# Add text to Subject if an attachment is caught by banned_files, # shown here in suppression mode to NOT inform user on file ban. # # subj_banned = #

# Add text to Subject if an attachment is caught by delete_exe # # subj_exec = [removed executable]

# Add text to Subject if an attachment is deleted for any reason # # subj_deleted = [deleted attachment]

# Add text to Subject if an attachment is renamed for any reason # # subj_renamed = [renamed attachment]

# Add text to Subject if an attachment is filtered in any way. This # has lowest priority, and is only used if previous are undefined. # Use single character # to suppress addition to Subject. # # add_subject = [filtered]

# When inserting a warning into HTML parts of messages (warning_html), # this tag defines the preferred position to insert the new HTML. If # the first tag in the list is found, the warning position is placed # just after this tag. As subsequent tags are found, the position # advances after each. # # htmlwarn_pos = html, body

# If an attachment is filtered, this lets you specify some warning # text that will be inserted into any plain text portion(s) of the # email. This is effective for informing users of filtered files, # but the act of inserting arbitrary text into an email can cause # new problems. Use with caution. # # warning_text = ******************* # warning_text = MAIL SYSTEM WARNING # warning_text = Attachments removed # warning_text = *******************

# Inserts a warning message into HTML portions of the email when # filtering occurs. The HTML is inserted at a position determined by # htmlwarn_pos (see above) which provides a good hope for adding a # visible warning. Unfortunately, inserting arbitrary HTML is tricky # due to the complexity of markup interactions. Inserting warnings in # HTML may thoroughly disrupt the original message, so use with caution. # # warning_html = <h1>Mail system warning<h1> # warning_html = <h2>Attachments removed</h2>

# When enabled, these new headers will be added to the message to # inform the user about filtering that occurred. # # add_header = X-Filtered-0: *** PLEASE NOTE *** # add_header = X-Filtered-1: Potentially dangerous attachments have been # add_header = X-Filtered-2: found in this e-mail, and have either been # add_header = X-Filtered-3: renamed or deleted for your safety.

# Catch specifically named, banned attachment filenames and # optionally take an action (r=rename, d=delete, k=kill). This is # an additive option so there is no limit to how many names can be # specified. If the name begins with a forward slash ('/'), this # substring has to be found; '/foo' matches 'foobar' and 'eatfoo' # Otherwise, the whole name has to match. Specify case-insensitive # filenames separated by commas. To specify an action on matching # filename, append /r (rename), /d (delete), or /k (kill) to the # filename as illustrated in the example. # # banned_files = your_details.zip/r, your_details.pif/k # banned_files = movie.pif/d, movie.zip, /winmail/d

# A list of good (known-safe) attachment file extensions to use # in goodlist filtering mode. This is an additive option, so there # is no limit to how many filenames can be specified. Specify case- # insensitive extensions separated by commas. # # goodlist = DOC, PDF, RTF, SXC, SXW, TXT, ZIP

# A list of bad (known-dangerous) attachment file extensions to use # in badlist filtering mode. This is an additive option, so there # is no limit to how many filenames can be specified. Specify case- # insensitive extensions separated by commas. To specify an action # for an extension, append /r (rename), /d (delete), or /k (kill) # to the filename. This overrides the default action for the filter # and can be used to provide special handling for some extensions. # An additional switch can be used to specify an action only for # files found within ZIP archives. For instance, EXE/k/d tells the # filter to kill emails containing EXE attachments, but if the EXE # was found inside a ZIP then the attachment is deleted, not killed. # # badlist = ADE, ADP, BAS, BAT, CHM, CMD, COM, CPL, CRT, EML, EXE # badlist = HLP, HTA, HTM, HTML, INF, INS, ISP, JS, JSE, LNK, MDB # badlist = MDE, MSC, MSH, MSI, MSP, MST, NWS, OCX, PCD, PIF, REG # badlist = SCR, SCT, SHB, SHS, URL, VB, VBE, VBS, WSC, WSF, WSH

renattach.conf

procmail(1)

As per the GNU GPL, there is no warranty for this software. The author makes no guarantees as to software performance or effectiveness. renattach is NOT a virus scanner. Filtering is based on MIME headers; as such, the software tries to handle all correct and many possible INCORRECT uses of MIME. Given the near- infinite cases, it's impossible to achieve 100% accuracy.

Copyright (C) 2003, 2004  Jem E. Berkes <jberkes@pc-tools.net>

http://www.pc-tools.net/unix/renattach/ http://www.sysdesign.ca/