On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald <h.rei...@thelounge.net> wrote:
> > > Am 30.03.2016 um 21:23 schrieb Rodney Green: > > I'd like to assign a spamassassin score to received word documents > > (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the > > following which doesn't work. Can someone show me an example that should > > work? > > 12.5 points for ordinary attachments? > quarantine to make email a lottery? > > are you aware that the above list is missing the *really* dangerous ones > with macros? what is the point of quarantine docx/xlsx? > > https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions > > better reject dangerous ones than punish your users by quarantine > harmless files > Thanks. 12.5 is high. The server isn't dropping mail scored that high. It quarantines it. I'm just trying to help prevent any ransomware from hitting us. We have a small user base, so checking the quarantine and releasing mail isn't a big deal. I am unsure about your mention of macros. I've received doc files with macros that were trojan downloaders. docx has no way of running malicious code? Thank you much, Rod
