Filtering attachments with procmail


I have been performing some basic statistical analysis on the spam and viruses I receive, and it seems like more and more Email comes littered with silly attachments. While I really appreciate people sending me executables, help files, compressed archives, VB script and screen savers, I should alert you now that these messages go directly to the bit bucket ( /dev/null ). This is accomplished with the following procmail filter:

:0 B
$"filename=.*(zip|pif|exe|scr|com|vbs|bat|hlp)" /dev/null

This checks the message body for a MIME header with the filename type, and attempts to match the value against a variety of extensions. If it finds a match, the file is written to /dev/null. This is one of my favorite procmail recipes!

This article was posted by Matty on 2005-05-09 22:08:00 -0400 -0400