If attachments are showing up in your Microsoft Outlook inbox with a modified ending such as .doc being changed to .1324DEFANGED-doc then the issue is more than likely with your mail server instead of your email client. There is an application called MailScanner that modifies the file ending as a security measure to stop any files from being executed automatically. Below I briefly discuss modifying this setting on a Linux server using ISPConfig.

The easiest way to resolve this issue on a per user basis with an ISPConfig Linux server is to disable MailScanner for that user. MailScanner does provide numerous other security checks though so it is not recommended to disable it but if you must disable the file ending modification then modify the below files.

The template file for MailScanner that gets used each time a new user is added is located in the following location.

/root/ispconfig/isp/conf/html-trap.rc.master

On line 694 of the html-trap.rc.master file you will find the below code. You can see extensions are separated by pipes (|) so you can easily remove one or many.

MANGLE_EXTENSIONS='html?|exe|com|cmd|bat|pif|sc[rt]|lnk|dll|ocx|do[ct]|xl[swt]|p[po]t|rtf|vb[se]?|hta|p[lm]|sh[bs]|hlp|chm|eml|ws[cfh]|ad[ep]|jse?|md[abew]|ms[ip]|reg|as[dfx]|c[ip]l|pps|wm[avszdf]|vcf|nws|wsz|{[-0-9a-f]+}'

To remove MS Word documents from being “DEFANGED” then you would remove “do[ct]|” from the MANGLE_EXTENSIONS variable.

Modifying this file will resolve your issue for any new users however any users that have already configured will also need to be modified. If you have not modified the default directory structure then the file would be located in something similar to the below path example.

/var/www/web1/user/web1_joeuser/.html-trap.rc

Modifying the .html-trap.rc file for each user will allow you to customize what files you want to DEFANG on a per user basis.

DeliciousStumbleUponDiggTwitterFacebookRedditLinkedInEmail
Tags: , , , , , , , ,
Leave a Reply

*Type the letter/number combination in the abvoe field before clicking submit.

*