Jump to content

E-mail filtering


Rich

Recommended Posts

Hi all,

 

Executable attachments are being filtered from my e-mail. I assume it's being filtered by the "system_filter.exim" file being used. Is there any way to bypass the filter? I really don't want anything removed from my e-mail.

 

If you are interested, I can supply you with an updated filter that would allow users to decide whether or not the system filter is applied to their e-mail.

 

Thanks.

Link to comment
Share on other sites

I don't have any specific need to send or receive executables. It's just annoying when somebody sends me a file and the server rejects it due to its content. Exim's default filter rejects several different types of file extensions that really don't apply to me - I use Linux.

Link to comment
Share on other sites

Glad I took a look at this thread. I didn't know there were server side filters on email attachments. Just out of curiousity, what all extentions are filtered out?

Link to comment
Share on other sites

I hadn't realized this either. I do some development work on the side of my regular 9-5 job, and often send & receive executables as attachments. What other extensions are filtered? Can I get around this by zipping them up? I suppose I could always rename the files, and have them renamed at the other end... but that really isn't an acceptable solution.

Link to comment
Share on other sites

Thanks Bill. I don't mind having to zip things up. I just wanted to be prepared instead of trying to send or receive a file and it get blocked for some reason.

Link to comment
Share on other sites

  • 3 months later...

Recently, I did something that I do all the time. I used IE 6.0's default "Send a Link" feature to send an interesting web site to my wife (who shares an alias my TCH mail server). When I do that, IE 6.0 automatically makes the site into an attachement with a ".URL' extention -- in this case (horrors!) -- SARS.URL. It's a hot topic here in Taiwan at the moment.) Seconds later my e-mail bounced back at me!

 

TCH's Exim server had rejected the e-mail because it had an attachment with a ".URL" extention!? (I freqeuntly forward interesting or informative sites to our children in the USA using the same method, and this has never happened before.

 

I knew it wasn't Spam Cop, becuase, though I have enabled it (my choice) I keep an eye on what it does. So I wrote a help ticket (only level "2"!) to TCH asking what was going on. I expressed the opinion that, if this was done by your Exim server, this kind of unseen (and un-advertised) control over users' e-mail extensions seemed a bit "too much." The "head guru's" reply was that this was TCH's "reasonable" means of protecting it's users against bad stuff.

 

Hmmm... Reasonable? Maybe. However, I have been completely virus and "bug' free for well over three years on this computer (using, first, Win 98 and, now, Xp Pro). I use ZoneAlarm Plus, AVG antivirus (upgraded weekly), PestPatrol, SpyBoy S&D and, for the time being, Spam Cop. I am online 24/7 via ADSL, and I share my connection on a local network, so I check my Internet "footprint" frequently with GRC's "Shields Up!". I am always "stealthed."

 

I pay for ZoneAlarm Plus, just like I pay for TCH's hosting service and mail servers. ZoneAlarm let's me choose which extensions to "glag." Why am I not allowed to choose what incoming extensions I can receive or, apparently, send to others on my mail server? My e-mail is checked for viruses by AVG when it comes in and when it leaves my computer.

 

In reply to one of the postings on this Forum, the "admin" guy replied, "is there any particular reason you need to send executables via email?" My answer to that is, "Why SHOULDN'T I?" I used to share useful freeware and shareware with my son and sons-in-law using e-mail via broadband -- in the days before I had a hosted domain. NOw I use FTP. Back then, I sometimes ZIP-ed them, but not always. Maybe that's a good idea -- but it should be MY CHOICE!

 

In effect, because TCH refuses to give end users administrative access to these lists (as far as they impact their own personal mail service), they are saying: "You can't use your browser's built in features. You must cut and paste the URL's into the text of your messge every time you forward a site." (Or ZIP the URL? I think NOT!)

 

Guess I'll just have to "bit the bullet," though. Obvioulsy TCH feels that it must protect us from oursevles -- like big governent? If TCH weren't SO much better in SO many ways that my previous hosting service, I might "jump ship" to prove a point. But, the truth is, TCH has a quality business model and great service and customer service -- even when you disagree with me! ;-)

 

So...please...at least CONSIDER allowing us to decide how much protection we want, OK?

 

Chuck in Taiwan

Link to comment
Share on other sites

Hi,

 

If you had used a non microsoft emailer, or sent your email in just normal format rather then Outlooks spruced up html version, the link you provide, like www.mydomainname.com will still appear in the email and not be blocked out.

 

Unfortuantley, not everyone is clued up and on the ball as you are Chuck, also new viruses come out every day that virus checkers may miss temporarly (I remember a nimda all too well).

 

By protecting the users, we protect everyone, including thoose who are not as well protected as yourself.

 

You could provide instead a link to a page where they can download the exe extenstion. I know I dont like getting files with exe at the end of them!

 

Jim

Link to comment
Share on other sites

Chuck,

 

We filter attachments NOT content.

 

The anti-virus protection is a added benefit to the services we provide. It is in no way a "big brother" attidude.

 

Jumping ship to proove a point only hurts you, not TCH.

 

As the owner of this company, I have to look at the good of the unit not the good of one person. I feel this policy is good for the unit. If I loose one customer and help the majority than thats the way it will have to be.

 

I could post the hundreds of thank you emails I have gotten for choosing to implement virus protection on the email server. However, that would not proove anything.

 

While I understand you point, I do not agree with it. Lets agree to disagree.

 

For now the policy is in place.

Link to comment
Share on other sites

Hey! :P

 

I'm one of your FANS! :P I just like the option to choose, that's all!

 

(Oh...and I LOVE my big brother! :D Wouldn't have survived childhood without him!)

 

Anyway, I thought end user configuarable flitering was an option -- guess not. That's OK! I'll work with in the system. Believe it or not, that's what I taught my son to do: "If you don't like the system, stay inside it, contribute to it, and earn the right to change it."

 

So...no, I really wouldn't "jump ship." TCH is too well put-together, too responsive to my problems, too quick to deal with them and (seemingly) endlessly patient with my nit-picking. What's not to LIKE!

 

Keep it up!

 

Chuck in Taiwaw

 

PS/ Good point about "content" and "attachemnts." I got sloppy there! Mia culpa!

Link to comment
Share on other sites

If we were to get enough users asking for a change to this I would more than consider a change.

 

And I think you gave your son the right advice! I have a five year old, its really hard being a good dad istnt it?

 

Thanks for the reply.

 

Bill

Link to comment
Share on other sites

... that's what I taught my son to do: "If you don't like the system, stay inside it, contribute to it, and earn the right to change it."

I love this quote! I hope you don't mind my taking your advice into my own life and family. My mother always put it a little differently, but to the same end, "If you don't vote, you can't complain."

 

:P

Link to comment
Share on other sites

  • 2 weeks later...
If we were to get enough users asking for a change to this I would more than consider a change.

Add me to the list, Biil.

 

I often send myself or my wife a .exe file and it's an annoyance to have to ZIP them.

It would be nice if your users had the option of turning this filter on or off. My guess is that it's not possible??

Link to comment
Share on other sites

Please add me to the list of "pro-choice" advocates.

 

I think having filters on by default, to protect the clueless masses, is fine.

 

But please give me the total choice to turn them *off*!

Link to comment
Share on other sites

Please Head Guru do not change this, I love the fact the .exe gets filtered.

 

Please remember that we are not asking that the filtering be removed; merely, that those who wish to do so may turn it off. We are not anti-filter; we are pro-choice!

Link to comment
Share on other sites

  • 4 weeks later...

I pay TCH for web/mail hosting not for protection from viruses/male pattern baldness.

I'd prefer not to have the abilities of what I pay for diminished in order to provide a service that I didn't ask for.

 

At least, make it an option. Heck, a beancounter would call that a value-added service. Make some extra $$$; charge for it.

 

Dave

Link to comment
Share on other sites

I'm a new reseller here, and am moving more than 30 domains over from a dedicated server because I'm so impressed with TCH. As a (soon to be former) server administrator myself, I understand and apreciate the need to filter attachements, and to have that filtering turned on by default.

 

However, as a webmaster I also have a VERY STRONG need to be able to configure what attachements are filtered on a site by site basis. So, please count my vote in favor of giving us the OPTION to configure our own filters.

 

Thanks!

Link to comment
Share on other sites

Geez Bill..I hate to even be in here, but I just got off the phone with my 80 yr old mother trying to explain to her how to send me a file that's in your "blocked" filter. I love my mother, but I like my hair too, and after spending 30 mins. on the phone trying to explain something to her, I begin to pull it out.......so I've gotta go with the "give us a choice" crowd.

 

ImaD

Link to comment
Share on other sites

  • 1 month later...

I thought of this thread tonight and looked it up. I also tend toward the No Filter camp. As nice as having the option to use it or not use it sounds, that is not possible at this time. We have to make a decision on enabling filtering for all or disabling filtering for all.

 

A couple of weeks ago Bill and I discussed whether we should remove it. Other things came up and we never really got the chance to discuss it again.

 

I just got through looking through the main mail log on several servers and ran a filtered search for .pif to see just how many messages were being rejected with the .pif extensions. There were pages and pages of entries just from the last three days.

 

The sobig virus has been on the news and thousands of computers have been infected. We've had a lot of Help Desk tickets from folks concerned about bounced messages they have received. I can't imagine how much worse it would have been if these messages had been delivered.

Link to comment
Share on other sites

:) Back on the "pro-configure" band wagon!

 

Thanks for re-visiting the MANY postings in this area and re-considering the modification of filtering, Rick! Nice to know that it not a subject that's been "closed" by ROCKIN'! TCH! ;)

 

I DO still wonder, however (as, apparently, do many other posters), just "why" you say...

 

As nice as having the option to use it or not use it sounds, that is not possible at this time. We have to make a decision on enabling filtering for all or disabling filtering for all.

 

Is there NO way to allow us endusers to configure flitering? Why is it "filering for all" or "disabling...for all?" NO way even for a FEE? All I (and many others) really want to do is to be able to use the built-in "Send a Link" (button) feature in MSIE to forward URL's to my family & church members — without a lot of hassle! (Like having to select, cut & paste the URL from the address bar, for example, which MSIE's Send a Link feature is designed to avoid.) Using "Send a Page" instead of "Send a Link" just increases the size of the e-mail by forcing it to be HTML instead of plain text.

 

PLEASE put on your thinking caps again and find a way to help out a sizeable numbers of your customers!

 

Chuck in Taiwan

Link to comment
Share on other sites

When I switched over to TotalChoice, I was not made aware of this in my Terms of Service and would not have switched if I had been. My expectation of a hosting provider is to allow the subscriber to have control over the enviroment, not some of the environment. I would have to agree with the other users that this feature should be at least configurable or optional.

 

If you insist on having it, I believe that a better option than pure filtering of certain attachment types would be the use of virus protection. This would allow in non-virii and provide a notification if an e-mail was received that contained one and was destroyed. I personally run virus protection locally and do not expect my Hosting provider to do so.

 

I discovered this issue only because I was trying to transport some files related to some of the work I do. The filter did not merely remove the attachment, but the entire e-mail was lost, so I would have had no idea the e-mail had been sent if someone else had sent it.

Link to comment
Share on other sites

Hi,

 

Actually sending a URL is still viable, just type it into the email and make sure your email is not sent in Outlook lovey-dovey format but in simple text format.

 

I also stand on the "no" camp. Not because I am an employee of TCH, not because I own hosting accounts here, but because I know what a virus can do.

 

The sobig.F virus shows what havoc it can wreck. I am up to just under 1000 emails being delivered to my various email boxes, each with this attachement on it. Thankfully I have a full windows patched machine and upto date Virus checkers, but I know countless people who do not have such protection, and even worse, people still click on the attachment even if they been told not to. Stupid I head you cry? Yes but it still occurs.

 

When the Nimda virus hit, it didnt matter if u had a firewall or virus checkers, it by-passed the lot and I know several large companies (you see them advertising on TV and magazines) shut down there entire IT systems because of it.

 

Now if your a single man/woman business with the website and your computer being your only source of income, loosing it all to a virus is not a good way to go.

 

Hence, I stick in the No camp.

 

Jim

Link to comment
Share on other sites

As Rick said...

 

I thought of this thread tonight and looked it up. I also tend toward the No Filter camp. As nice as having the option to use it or not use it sounds, that is not possible at this time. We have to make a decision on enabling filtering for all or disabling filtering for all.

 

It's better to be safe, than sorry. Speaking as a client, I'm thrilled TotalChoice Hosting does this. The best advice I give to anybody concerning email is do not open attachements, period. For myself, I use Outlook Express but I have all HTML emails turned off, I don't accept attachments, and I have turned the preview pane off. As far as virus and email filtering software, as it's been said these companies don't update their definitions till something comes out, hence there's still a bigger chance of you getting hit by it if you don't have the protection TotalChoice Hosting offers. Also there are alternative ways for you to get these files across other than email. So I also stay in the "keep the filter on" camp. Thumbs Up

Edited by cerealkeeler
Link to comment
Share on other sites

One issue that seems to be misunderstood, ;) or missed entirely, is that TCH (may it reign forever!) is NOT filtering our INcoming mail (unless you choose to use SpamAssasin, which I do), but our OUTgoing mail.

 

Thus, any unprotected person out there could still send me an infected file (if I weren't protected with a FW, AV, pest crusher, etc.), but I cannot forward a perfectly safe attachment (I use outgoing AV e-mail checking.) to my kids or my church.

 

So, because some folks (most of whom have nothing to do with hosting at TCH...or hosting of any kind) refuse or fail to protect themselves from BAD stuff (which is both FREE and EASY to do), TCH subverts the feature in MSIE that makes it easy and doesn't allow me to send GOOD stuff to my friends without copy, paste, copy, paste or sending the whole page! (Why is THAT "safe" ?!?!) Yuck!

 

My BIG question still is, though, why do you really cool (I MEAN it! :( ) gurus at TCH repeadedly tell me (and others)...

 

We have to make a decision on enabling filtering for all or disabling filtering for all.

 

Nobody has told us whether the reason for this is that the techonology for configurable outbound filtering is not available, or whether ir is "pricey." If the former -- find a way! If the latter -- CHARGE us for the service! I'd pay!

 

Chuck in Taiwan

Link to comment
Share on other sites

Chuck,

 

I can not answer the all or nothing question but I can say that the outgoing protection would be useless for me. My cable modem provider will not allow me to use any other outgoing server but theirs. Thus I would get nothing from it and could infect all my friends in the process.

 

Unfortunately as in most things (IMHO) you have to give up some small things as a single individual for the good of the whole. Kind of like a family, no? :(

Link to comment
Share on other sites

Could it be as simple as this?

"If you send emails with attachments that are blocked then your email will be blocked - otherwise it will go through?"

 

:D (it's just a funny, don't hurt me!) :D

 

I understand everone's desire for options, but I'd prefer the blocks to stay - the inbound protects me and the outbound protects everyone in my address book if I do get infected.

 

TCH is like a family! The members discuss things and based on that Daddy decides! ;) (hi Head Guru!)

Link to comment
Share on other sites

OK. Looks like I mis-guessed the "climate" among TCH customers. The poll I started concerning "Exim filtering" shows that most folks prefer the status quo -- though there are many who would like to make configurable filtering an option. I'll keep checking and see how the vote goes -- not that TCH is a democarcy, or anything! :lol:

 

I STILL have TWO questions about Exim filtering, though:

 

The top gurus around TCH have all indicated that the filtering is BOTH OUT-bound and IN-bound. To see what this really meant in the "real world," I sent out two test e-mails containing a very SMALL and BENIGN .exe file. I sent one through my ISP's SMTP server (msa.hinet.net) to myself at johnstonz.net. I sent the other through my johnstonz.net SMTP server to myself at msa.hinet.net.

 

Low and behold! the one I sent to myself at Hinet via johnstonz.net (TCH) came through with flying colors! The only change in the file was that old faithful ZoneAlarm caught the .EXE file and zipped it up for me to make a "call" on (to open, or not to open? THAT is the question!).

 

So, I checked my Hinet account for the test e-mail I sent through my TCH SMTP server -- Hey, presto! It came through in exactly the same way -- zipped up by ZoneAlarm for my discretionery use or disposal.

 

My next test of inbound and outbound filtering involved the sending of a URL (the link to this forum) using the same methods. VERY interesting results!

 

The INbound e-mail (Hinet >> TCH server) with attached URL resulted in a note sent to my Hinet address telling me to zip it up and re-send it -- in very courteous terms!

 

The OUTbound e-mail (with attached URL) disappeard into "La-la land!" No response, no warning (courteous or otherwise) that I was trying to send a proscribed attachment, and no instructions to zip it up and resend it.

 

OK...the TWO questions:

 

2) WHY did my "nasty" .EXE attachments pass thorugh BOTH ways with flying colors??? (I see "|EXE right there in the list of proscribed attachments.) Why allow an .exe file through while "axing" a benign .url?

 

2) If this filtering thing is for the purpose of "protecting TCH customers," and is for OUR convenience, why don't WE receive notification when we do a "bad" thing? It would be nice to know that our e-mail was blasted into nothingness and never reached its destination -- with or without the attachment. (I was thinking that TCH simply stripped the attachment and notified the recipient of the action. Apparenlty not.)

 

So, IMHO, there are some serious snags and bugs to be gotten out of this process of Exim filtering before it really accomplishes TCH's stated goals -- security and good customer service.

 

How about it?

 

Chuck in Taiwan

 

PS/ Hey, look! I was a victim of the FeaturePrice (Hosting-Company, inc.) debacle -- I lost my domain and lost a wad of $$$ getting extricated from the FP morass! I LOVE TCH! REAL customer service REAL quick with a smile and much-appreciated patience with wannabe "techies" like me! What's not to like?

 

I just would have like to have known up front that filtering was being done, I would like to see it become TRULY effective, and I STILL would like a CHOICE! :P

Link to comment
Share on other sites

You can always route your email thru your ISP. :lol:

 

I have watched this debate for several months now, and nothing has convinced me that we should change any setting on our servers.

 

The antivirus.exim filter works well. It will remain on the servers.

 

Bill

Link to comment
Share on other sites

Feel free to move this post if need be but I haven't been able to find the subject anywhere.

 

Are forwarders subject to the same scrutiny and actions as regular email? In other words, if someone sends email to main_account@my.com that has an .exe attached is it stripped of the offending file before being forwarded as well?

 

Thanks!

Link to comment
Share on other sites

OK, Bill! I'm ready to stop harping on this topic...really! :D

 

But...I still am curious about the answer to the two questions I posed in my last posting... :P

 

1) WHY did my "nasty" .EXE attachments pass thorugh BOTH ways with flying colors??? (I see "|EXE right there in the list of proscribed attachments.) Why allow an .exe file through while "axing" a benign .url?

 

2) If this filtering thing is for the purpose of "protecting TCH customers," and is for OUR convenience, why don't WE receive notification when we do a "bad" thing? It would be nice to know that our e-mail was blasted into nothingness and never reached its destination -- with or without the attachment. (I was thinking that TCH simply stripped the attachment and notified the [sender and/or]recipient of the action. Apparenlty not.)

 

Can you satisfy my curiosity? Then I'll go quietly! :)

 

Chuck in Taiwan

 

PS/ Yeah...using my ISP was an obvious workaround. Guess I'm just a trouble maker!

Link to comment
Share on other sites

are you now filterng out emails from groups.msn.com ? recently I stopped recieving my groups.msn.com messages. msn insists it isn't them (not that i believe everything msn tells me LOL) anyways i just wondered if it was possible they were correct in telling me my ip or email isp was filtering out emails on their end. the group that seems to be filtered out is http://groups.msn.com/WisconsinParents of which i am very active and miss my emails!!

Magenta

Link to comment
Share on other sites

Magenta -

 

We dont filter emails based on the "from" address field.

 

Our exim filter only looks for attachments and then only looks at the extensions of those attachments.

 

Matters not where the email is from.

 

It is possible that for some reason MSN is no longer sending emails to your domain, IP or server. Not sure why, but its possible.

 

We can take a look at this for you if your submit a help desk ticket.

Link to comment
Share on other sites

  • 4 weeks later...
OK, Bill! I'm ready to stop harping on this topic...really! :D

 

But...I still am curious about the answer to the two questions I posed in my last posting... :unsure:

 

1) WHY did my "nasty" .EXE attachments pass thorugh BOTH ways with flying colors??? (I see "|EXE right there in the list of proscribed attachments.) Why allow an .exe file through while "axing" a benign .url?

 

2) If this filtering thing is for the purpose of "protecting TCH customers," and is for OUR convenience, why don't WE receive notification when we do a "bad" thing? It would be nice to know that our e-mail was blasted into nothingness and never reached its destination -- with or without the attachment. (I was thinking that TCH simply stripped the attachment and notified the [sender and/or] recipient of the action. Apparenlty not.)

 

Can you satisfy my curiosity? Then I'll go quietly! :(

 

Chuck in Taiwan

 

PS/ Yeah...using my ISP was an obvious workaround. Guess I'm just a trouble maker!

Sounds like Zone Alarm is intercepting the .EXE attachment before your machine actually connects to the SMTP server. Zone Alarme is converting the EXE to a ZIP for you on the fly. That way, the TCH servers never see the EXE, and let the ZIP pass through.

 

DAve

Link to comment
Share on other sites

  • 9 months later...

Hammerz,

 

I saw your poll and voted to keep things as they are. It would have been nice if you at least included a link to this thread to avoid having to go searching for it.

 

I am sure many have said already but it wont matter if TCH allowed all attachments to go through because most of the people receiving your email will have it stopped or filtered by their ISP. This is very common, especially if your receipient is on one of the big 5 ISPs or at work.

 

To send URLs just copy the address into the body of the email like this

Google

 

Much easier than attaching it, and it won't get blocked.

 

Dennis

Link to comment
Share on other sites

Actually sending a URL is still viable, just type it into the email and make sure your email is not sent in Outlook lovey-dovey format but in simple text format.

It wont matter if you send in lovey dovey, HTML or packaged in shinning foil, all emails with HTTP in the message body will go through just fine.

 

It is only attachments that are being filtered.

 

Dennis

Link to comment
Share on other sites

  • 1 month later...

Correct me if I'm wrong, but can't you disable a malicious file by simply renaming it?

 

If so, then here's my suggestion to find a middle ground. Although, this may not be doable from a technical standpoint.

 

How about when the server sees an unacceptable extension, instead of blocking it, it tacks on ".safe" to the end of the attachment filename and includes a short message to the body of the E-mail saying something like:

---------

This notice was created automatically by mail delivery software.

Your E-mail was found to contain a possibly dangerous attachment. It has been renamed for your protection.

If you feel this attachment is safe, simply save the attachment to your computer and rename it to remove the ".safe" from the end of the filename.

You will then be able to access it normally.

---------

 

Those who can't handle zipping/unzipping will have some relief.

And TCH will still have avoided any liability issues.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...