Greg Helledy on 17 Jan 2018 14:49:16 -0800


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Weird handling of incoming attachments in dovecot--winmail.dat file


On 1/17/2018 3:00 PM, plug-request@lists.phillylinux.org wrote:
assuming your clients are using IMAP and not POP3 (without "leave on
server" enabled), check the raw message for one of those emails. the
path for this is going to change depending on configuration, but most
likely it's in one of:

/var/vmail/
/var/spool/mail/
/home/<user>/Maildir

etc.


/home/<user>/mail/



find a message that is reported as having a winmail.dat. open it in vi
or less or something that'll do plaintext. you should see a big ol'
block of base64 and*the actual filename above it*. this is the
attachment. if my theory is correct, this is going to be "winmail.dat".

Content-Disposition: attachment; filename="winmail.dat"
Content-Transfer-Encoding: base64
Content-Type: application/ms-tnef; name="winmail.dat"


if it IS, check your MTA setup - message filtering? does it do any
rewriting, quarantining, etc.?

Not that I can see. The thing is that this does not affect all my users...and I certainly don't know how something like this would get set on a per-user level without me knowing about it.


if you've gone over all this and are not finding anything that's
modifying content, then it's almost assuredly on the sender's end.[0]
whether in the MUA, MTA, or MDA, however, i'm not sure. i don't know if
you're at liberty to say, but are all these faulty attachments from a
specific department in the given agency? if so, it may be a certain
workstation policy being applied to all windows desktops/outlook configs
in a given AD domain (or whatever they're called now). but that's kind
of on the crazier end of theories. gut tells me it's something in their MDA.


Yes, I believe everyone generating these winmail.dat emails is in fact in the same "office" within the agency. Whether people in different parts of the same agency would produce the same result, I don't know.

I really wonder whether it's that address-book glitch. Anyway, I'm pretty sure you're right, it's not my software that's doing this, it's their Outlook or mail server.

Thanks for the ideas!

--
Greg Helledy
GRA, Incorporated
P:  +1 215-884-7500
F:  +1 215-884-1385
www.gra.aero

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug