[FW1] stripping MIME type 'application' from e-mail messages

[Security Announcements Mailbox]

Hello!

Once again I'm bothering you, hopeing that anyone can answer.

Accordin to fw-1 books (A&A) and to Solution "How to configure SMTP
Security Server" in http://support.checkpoint.com/
I tried get work MIME type stripping from e-mails.

+>>Solution: How to configure SMTP Security Server (36.0.1222473.2496248)
+>>  First, make sure that the conf/fwauthd.conf file contains the
+>>following
+>>entry:
+>>  25 in.asmtpd. wait 0 {means SMTP daemon is running}
+>>  Then, do the following: 
+>>  1. Create a workstation object to house the server.
+>>  2. Create a CVP server to accommodate the resource

What that acctualy means? Does CVP server stripes message???

As I understand and think then FW-1 internal SMTP SecServ does striping.

Useing CVP server just gives possibility to have additional
non-fw1-included functionality. But that I should not (neccesarily) need
if I want just do MIME type stripping.

Anyway currently there's only one CVP server, that is Norton Antivirus,
and that's not currently used for SMTP.

+>>  3. Create a Resource with the Mail Server IP address as the inbound
+>> SMTP server (General tab)
+>>  - If there is more than one SMTP server, enter them as {ip-address-1,
+>>ip-address-2,...} 
+>>  - On the match tab: recipient is *@<yourdomainname>.com.

+>>  NOTE: If you have multiple domains, it should read
+>>*@<yourdomainname>.com, *@<yourdomainname>.com,
+>>  *@<yourdomainname>.com

resource is like that:

   Name:   Ilove_not
        Comment: <empty>
        Mail Server: 10.1.13.1 (mailserver internal address)
        Error handling server: 10.1.13.1
        Exception Track Log
        Notify sender on Error
        Match, Sender thi
        Match, Recipient: *@kala.Xdomain.ee
        Action1 <empty>
        Action2, Strip MIME of Type: application/OCTET-STREAM

        Don't Accept Mail Larger Than 300 KB

        CVP none

        Allowed Chars 8-bit. 

createing rule as a next step:
 
        Any | SMTP Server | SMTP/resource | Accept

____________


So, now if I send message larger than 300KB then SecServ reacts, yelling 
"<[EMAIL PROTECTED]>: host kala.mfa.ee[195.80.107.91] said: 552 Too much mail"


But message containing MIME type "APPLICATION/octet-stream" or
"application/octet-stream" or "application" will not be stripped and goes
cleanly to mailserver.

__
Valmar Joandi
[EMAIL PROTECTED]




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================