Microsoft Excel files and Exim !

[xploit]

some users can't seem to send Excel files as attachements,and others the exim returns an error messages asking the user to Zip the excel files and send them again.

any ideas !

[chirpy]

It's probably the system_filter in /etc/antivirus.exim, you'll have to modify that or get rid of it (I hate the thing myself).

[xploit]

been looking through the file with nothing refering to the xls file types.any idea !

[chirpy]

Just had a look and cannot see why an xls file would be trapped either, but that's where the error message is, unless of course you have any other filtering enabled (i.e. exiscan or MailScanner,etc).

[xploit]

yes i believe i have exiscan enabled !
so !

[chirpy]

Then you should check through any additional ACL's that you may have added in the ACL section of the exim configuration editor.

[spiff06]

I have the same problem with Excel files being rejected: neither the sender nor the recipient are notified that there is a problem. The mail message is simply lost.

Currently trying to investigate the problem... Did xploit find the solution?

[spiff06]

Nothing in the ACL section.
Just tried sending a couple of .xls files to myself, no problem.

Nothing in /var/log/maillog mentions anything with an .xls file that was rejected.

Yet I'm seeing incoming SMTP connections from the user who tried to send the .xls file that do not complete: there's only one line showing the connection, and it stops there.

2005-07-04 15:13:24 1DpWKP-0002ut-O2 <= some.user@domain.com H=line-122-5.gprs.westel900.net (NotebookET) [212.51.122.5] P=esmtpa A=fixed_login:some.user@domain.com S=245829

2005-07-04 15:14:03 1DpWNj-0002ut-Je <= some.user@domain.com H=line-122-5.gprs.westel900.net (NotebookET) [212.51.122.5] P=esmtpa A=fixed_login:some.user@domain.com S=2239

2005-07-04 15:14:19 1DpWOM-0002ut-Dw <= some.user@domain.com H=line-122-5.gprs.westel900.net (NotebookET) [212.51.122.5] P=esmtpa A=fixed_login:some.user@domain.com S=15438
2005-07-04 15:14:33 1DpWOM-0002ut-Dw => some.recipient@domain.net R=lookuphost T=remote_smtp H=mail.informmedia.ro [80.75.232.140]
2005-07-04 15:14:33 1DpWOM-0002ut-Dw Completed

2005-07-04 15:14:29 1DpWOd-0002ut-Hc <= some.user@domain.com H=line-122-5.gprs.westel900.net (NotebookET) [212.51.122.5] P=esmtpa A=fixed_login:some.user@domain.com S=4982

2005-07-05 05:44:45 1Dpjyp-0007xA-5G <= some.user@domain.com H=bicomix.bicomix.hu (NotebookET) [82.150.35.61] P=esmtpa A=fixed_login:some.user@domain.com S=247681

2005-07-05 05:44:50 1Dpjyw-0007xA-0J <= some.user@domain.com H=bicomix.bicomix.hu (NotebookET) [82.150.35.61] P=esmtpa A=fixed_login:some.user@domain.com S=254801
2005-07-05 05:45:09 1Dpjyw-0007xA-0J => some.recipient@web.com R=lookuphost T=remote_smtp H=mx.axelero.hu [195.228.240.9]
2005-07-05 05:45:09 1Dpjyw-0007xA-0J Completed

2005-07-05 05:46:35 1Dpk0g-0007zQ-LM <= some.user@domain.com H=bicomix.bicomix.hu (NotebookET) [82.150.35.61] P=esmtpa A=fixed_login:some.user@domain.com S=18034
2005-07-05 05:46:47 1Dpk0g-0007zQ-LM => some.recipient@net.net R=lookuphost T=remote_smtp H=mail.informmedia.ro [80.75.232.140]
2005-07-05 05:46:47 1Dpk0g-0007zQ-LM Completed

2005-07-05 05:46:49 1Dpk0v-0007zm-00 <= some.user@domain.com H=bicomix.bicomix.hu (NotebookET) [82.150.35.61] P=esmtpa A=fixed_login:some.user@domain.com S=2480
2005-07-05 05:47:00 1Dpk0v-0007zm-00 => other.recipient@web.net R=lookuphost T=remote_smtp H=mx.axelero.hu [195.228.240.9]
2005-07-05 05:47:00 1Dpk0v-0007zm-00 Completed

No explanation was found in Exim's reject log. The SMTP makes the initial connection, then nothing.

I'm starting to doubt this is related to the .xls attachment (should start a different thread). Where do I look now for an explanation?

[spiff06]

bump.

I don't understand. I think I've looked everywhere I could but wasn't able to find a reason for the failure of these 4 tasks to complete.

[spiff06]

Ah well, think I found it at last:

2005-07-04 15:13:24 1DpWKP-0002ut-O2 <= some.user@domain.com H=line-122-5.gprs.westel900.net (NotebookET) [212.51.122.5] P=esmtpa A=fixed_login:some.user@domain.com S=245829
Jul  4 15:13:26 server01 MailScanner[3414]: New Batch: Scanning 1 messages, 246567 bytes
Jul  4 15:13:26 server01 MailScanner[3414]: Spam Checks: Found 1 spam messages

2005-07-05 05:44:45 1Dpjyp-0007xA-5G <= some.user@domain.com H=bicomix.bicomix.hu (NotebookET) [82.150.35.61] P=esmtpa A=fixed_login:some.user@domain.com S=247681
Jul  5 05:44:46 server01 MailScanner[27243]: New Batch: Scanning 1 messages, 248382 bytes
Jul  5 05:44:47 server01 MailScanner[27243]: Spam Checks: Found 1 spam messages

The rejected message had an .xls file attachment. I allowed the .xls extension in the filename ruleset and domain.com to spamassassin's whitelist.

Anything else you can think of?

[chirpy]

Erm, it would have helped if you'd said that you had installed MailScanner - I did ask and you said that you were using exsican. I could have pointed you directly to the MailScanner configuration files then.

[spiff06]

Erm, wasn't me ;-)
I jumped in late on the discussion. Not sure whether xploit has found the solution...

[chirpy]

Right you are, my apologies wrong target

[Stephanie_R]

Just a thought on this:

vi /etc/exim.conf

locate:

system_filter = /etc/antivirus.exim

comment it out

#system_filter = /etc/antivirus.exim

save, exit and restart exim then give it another go.

[xploit]

it does accept some exim files and rejects others
any ideas !