Changelog 3.6.1:
Changelog 3.6:
I need some code review and help to make this milter better! If you find some bugs or the code is "creepy" -> feel free to contribute :) To contribute, please fork this repository and make pull requests to the master or testing branch.
This python based milter for the Sendmail and Postfix e-mail servers (mail-filter) checks an incoming mail for MS 20xx Office attachments. If a MS Office file is attached to the mail it will be scanned for suspicious VBA macro code. Documents with malicious macros are removed and replaced by harmless text files or will be rejected to the sender (see config.ini).
Paper (german only) -> download link
Video / Talk (german only) -> HdM-events
Chemnitzer Linux Tage 2018 - Talk -> CLT2018
The repo is optimized for Visual Studio
This milter use the functionality from the oletools (https://bitbucket.org/decalage/oletools) and pymilter (https://pythonhosted.org/milter/) projects.
Download the "install_ubuntu.sh" script from the repo - install_ubuntu.sh. It creates and downloads all required files and packages. Please use for Ubunut 14.10 and higher the "old" systemd script part! For 14.0x and older please use the upstart part!
dnf install macromilter
systemctl enable --now macromilter.service
postconf -e smtpd_milters=inet:127.0.0.1:3690 milter_default_action=accept
systemctl reload postfix.service
yum install epel-release # Only if EPEL is not already enabled
yum install macromilter
systemctl enable --now macromilter.service
postconf -e smtpd_milters=inet:127.0.0.1:3690 milter_default_action=accept
systemctl reload postfix.service
To allow a user or whole domain to send false-positive VAB-Macro-Mails, enter only the user mail address (xyz@domain.com) or the domain (@domain.com). See config.ini for more details.
To allow only a special and wellknown macro code, add the SHA256 hash to the Macrohash part in the configuration file.
You will find the raw macro hash in the macromilter log file INFO [ID] The macro hash is: <the sha256 value>
. Please use only this one! Keep in mind, that the file hash has also to be deleted form the "hashdatabse".
Stephan Traub - Sbidy -> https://github.com/sbidy
Robert Scheck - robert-scheck -> https://www.robert-scheck.de/
Philippe Lagadec https://github.com/decalage2 - oletools
Stuart D. Gathman https://github.com/sdgathman - pymilter
The MIT License (MIT)