| commit | author | age | ||
| 0711af | 1 | use strict; |
| T | 2 | |
| 3 | # a minimalistic configuration file for amavisd-new with all necessary settings | |
| 4 | # | |
| 5 | # see amavisd.conf-default for a list of all variables with their defaults; | |
| 6 | # see amavisd.conf-sample for a traditional-style commented file; | |
| 7 | # for more details see documentation in INSTALL, README_FILES/* | |
| 8 | # and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html | |
| 9 | ||
| 10 | ||
| 11 | # COMMONLY ADJUSTED SETTINGS: | |
| 12 | ||
| 13 | # @bypass_virus_checks_maps = (1); # controls running of anti-virus code | |
| 14 | # @bypass_spam_checks_maps = (1); # controls running of anti-spam code | |
| 15 | # $bypass_decode_parts = 1; # controls running of decoders&dearchivers | |
| 16 | ||
| 17 | $max_servers = 2; # num of pre-forked children (2..15 is common), -m | |
| 18 | $daemon_user = 'amavis'; # (no default; customary: vscan or amavis), -u | |
| 19 | $daemon_group = 'amavis'; # (no default; customary: vscan or amavis), -g | |
| 20 | ||
| 21 | $mydomain = '{hostname}'; # a convenient default for other settings | |
| 22 | ||
| 23 | $MYHOME = '/var/spool/amavisd'; # a convenient default for other settings, -H | |
| 24 | $TEMPBASE = "$MYHOME/tmp"; # working directory, needs to exist, -T | |
| 25 | $ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR, used by SA, etc. | |
| 26 | $QUARANTINEDIR = undef; # -Q | |
| 27 | # $quarantine_subdir_levels = 1; # add level of subdirs to disperse quarantine | |
| 28 | ||
| 29 | # $daemon_chroot_dir = $MYHOME; # chroot directory or undef, -R | |
| 30 | ||
| 31 | # $db_home = "$MYHOME/db"; # dir for bdb nanny/cache/snmp databases, -D | |
| 32 | # $helpers_home = "$MYHOME/var"; # working directory for SpamAssassin, -S | |
| 33 | $lock_file = "/var/run/amavisd/amavisd.lock"; # -L | |
| 34 | $pid_file = "/var/run/amavisd/amavisd.pid"; # -P | |
| 35 | #NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually | |
| 36 | ||
| 37 | $log_level = 0; # verbosity 0..5, -d | |
| 38 | $log_recip_templ = undef; # disable by-recipient level-0 log entries | |
| 39 | $DO_SYSLOG = 1; # log via syslogd (preferred) | |
| 40 | $syslog_facility = 'mail'; # Syslog facility as a string | |
| 41 | # e.g.: mail, daemon, user, local0, ... local7 | |
| 42 | $syslog_priority = 'debug'; # Syslog base (minimal) priority as a string, | |
| 43 | # choose from: emerg, alert, crit, err, warning, notice, info, debug | |
| 44 | ||
| 45 | $enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny) | |
| 46 | $enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1 | |
| 47 | $nanny_details_level = 2; # nanny verbosity: 1: traditional, 2: detailed | |
| 48 | ||
| 49 | @local_domains_maps = ( [".$mydomain"] ); # list of all local domains | |
| 50 | ||
| bedf79 | 51 | @mynetworks = qw( 0.0.0.0/8 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10 |
| 0711af | 52 | 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ); |
| T | 53 | |
| 54 | $unix_socketname = "$MYHOME/amavisd.sock"; # amavisd-release or amavis-milter | |
| 55 | # option(s) -p overrides $inet_socket_port and $unix_socketname | |
| 56 | ||
| b1ae8f | 57 | # $inet_socket_port = 10024; # listen on this local TCP port(s) |
| FS | 58 | $inet_socket_port = [10024,10026]; # listen on multiple TCP ports |
| 0711af | 59 | |
| T | 60 | $policy_bank{'MYNETS'} = { # mail originating from @mynetworks |
| 61 | originating => 1, # is true in MYNETS by default, but let's make it explicit | |
| 62 | os_fingerprint_method => undef, # don't query p0f for internal clients | |
| 63 | }; | |
| 64 | ||
| 65 | # it is up to MTA to re-route mail from authenticated roaming users or | |
| 66 | # from internal hosts to a dedicated TCP port (such as 10026) for filtering | |
| 67 | $interface_policy{'10026'} = 'ORIGINATING'; | |
| 68 | ||
| 69 | $policy_bank{'ORIGINATING'} = { # mail supposedly originating from our users | |
| 70 | originating => 1, # declare that mail was submitted by our smtp client | |
| 71 | allow_disclaimers => 1, # enables disclaimer insertion if available | |
| 72 | # notify administrator of locally originating malware | |
| 73 | virus_admin_maps => ["virusalert\@$mydomain"], | |
| 74 | spam_admin_maps => ["virusalert\@$mydomain"], | |
| 75 | warnbadhsender => 1, | |
| 76 | # forward to a smtpd service providing DKIM signing service | |
| 77 | forward_method => 'smtp:[127.0.0.1]:10027', | |
| 78 | # force MTA conversion to 7-bit (e.g. before DKIM signing) | |
| 79 | smtpd_discard_ehlo_keywords => ['8BITMIME'], | |
| 80 | bypass_banned_checks_maps => [1], # allow sending any file names and types | |
| 81 | terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option | |
| 82 | }; | |
| 83 | ||
| 84 | $interface_policy{'SOCK'} = 'AM.PDP-SOCK'; # only applies with $unix_socketname | |
| 85 | ||
| 86 | # Use with amavis-release over a socket or with Petr Rehor's amavis-milter.c | |
| 87 | # (with amavis-milter.c from this package or old amavis.c client use 'AM.CL'): | |
| 88 | $policy_bank{'AM.PDP-SOCK'} = { | |
| 89 | protocol => 'AM.PDP', | |
| 90 | auth_required_release => 0, # do not require secret_id for amavisd-release | |
| 91 | }; | |
| 92 | ||
| 93 | $sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level | |
| 0f2bb1 | 94 | $sa_tag2_level_deflt = 20; # add 'spam detected' headers at that level |
| T | 95 | $sa_kill_level_deflt = 100; # triggers spam evasive actions (e.g. blocks mail) |
| 96 | $sa_dsn_cutoff_level = 100; # spam level beyond which a DSN is not sent | |
| 0711af | 97 | # $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off |
| T | 98 | $penpals_bonus_score = 8; # (no effect without a @storage_sql_dsn database) |
| 99 | $penpals_threshold_high = $sa_kill_level_deflt; # don't waste time on hi spam | |
| 100 | ||
| 101 | $sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail is larger | |
| 102 | $sa_local_tests_only = 0; # only tests which do not require internet access? | |
| 103 | ||
| 104 | # @lookup_sql_dsn = | |
| 105 | # ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'], | |
| 106 | # ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'], | |
| 107 | # ["DBI:SQLite:dbname=$MYHOME/sql/mail_prefs.sqlite", '', ''] ); | |
| 108 | # @storage_sql_dsn = @lookup_sql_dsn; # none, same, or separate database | |
| 109 | ||
| 110 | # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP; | |
| 111 | # defaults to 0, which is good for non-MySQL or if msgs.time_iso is CHAR(16) | |
| 112 | ||
| 113 | $virus_admin = undef; # notifications recip. | |
| 114 | ||
| 115 | $mailfrom_notify_admin = undef; # notifications sender | |
| 116 | $mailfrom_notify_recip = undef; # notifications sender | |
| 117 | $mailfrom_notify_spamadmin = undef; # notifications sender | |
| 118 | $mailfrom_to_quarantine = ''; # null return path; uses original sender if undef | |
| 119 | ||
| 120 | @addr_extension_virus_maps = ('virus'); | |
| 121 | @addr_extension_banned_maps = ('banned'); | |
| 122 | @addr_extension_spam_maps = ('spam'); | |
| 123 | @addr_extension_bad_header_maps = ('badh'); | |
| 124 | # $recipient_delimiter = '+'; # undef disables address extensions altogether | |
| 125 | $recipient_delimiter = undef; | |
| 126 | # when enabling addr extensions do also Postfix/main.cf: recipient_delimiter=+ | |
| 127 | ||
| 128 | $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin'; | |
| 129 | # $dspam = 'dspam'; | |
| 130 | ||
| 131 | $MAXLEVELS = 14; | |
| 132 | $MAXFILES = 1500; | |
| 133 | $MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced) | |
| 134 | $MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced) | |
| 135 | ||
| 136 | $sa_spam_subject_tag = '***SPAM*** '; | |
| 137 | $defang_virus = 1; # MIME-wrap passed infected mail | |
| 138 | $defang_banned = 1; # MIME-wrap passed mail containing banned name | |
| 139 | # for defanging bad headers only turn on certain minor contents categories: | |
| 140 | $defang_by_ccat{+CC_BADH.",3"} = 1; # NUL or CR character in header | |
| 141 | $defang_by_ccat{+CC_BADH.",5"} = 1; # header line longer than 998 characters | |
| 142 | $defang_by_ccat{+CC_BADH.",6"} = 1; # header field syntax error | |
| 143 | ||
| 144 | ||
| 145 | # OTHER MORE COMMON SETTINGS (defaults may suffice): | |
| 146 | ||
| a5d733 | 147 | $myhostname = '{hostname}'; |
| 0711af | 148 | |
| dda641 | 149 | $notify_method = 'smtp:*:*'; |
| FS | 150 | $forward_method = 'smtp:*:*'; # set to undef with milter! |
| 0711af | 151 | |
| T | 152 | # $os_fingerprint_method = 'p0f:127.0.0.1:2345'; # to query p0f-analyzer.pl |
| 153 | ||
| 154 | ## hierarchy by which a final setting is chosen: | |
| 155 | ## policy bank (based on port or IP address) -> *_by_ccat | |
| 156 | ## *_by_ccat (based on mail contents) -> *_maps | |
| 157 | ## *_maps (based on recipient address) -> final configuration value | |
| 158 | ||
| 159 | ||
| 160 | # SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all) | |
| 161 | ||
| 162 | # $warnbadhsender, | |
| 163 | # $warnvirusrecip, $warnbannedrecip, $warnbadhrecip, (or @warn*recip_maps) | |
| 164 | # | |
| 165 | # @bypass_virus_checks_maps, @bypass_spam_checks_maps, | |
| 166 | # @bypass_banned_checks_maps, @bypass_header_checks_maps, | |
| 167 | # | |
| 168 | # @virus_lovers_maps, @spam_lovers_maps, | |
| 169 | # @banned_files_lovers_maps, @bad_header_lovers_maps, | |
| 170 | # | |
| 171 | # @blacklist_sender_maps, @score_sender_maps, | |
| 172 | # | |
| 173 | # $clean_quarantine_method, $virus_quarantine_to, $banned_quarantine_to, | |
| 174 | # $bad_header_quarantine_to, $spam_quarantine_to, | |
| 175 | # | |
| 176 | # $defang_bad_header, $defang_undecipherable, $defang_spam | |
| 177 | ||
| 178 | ||
| 179 | # REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS | |
| 180 | ||
| 181 | @keep_decoded_original_maps = (new_RE( | |
| 182 | # qr'^MAIL$', # retain full original message for virus checking (can be slow) | |
| 183 | qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables | |
| 184 | qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i, | |
| 185 | # qr'^Zip archive data', # don't trust Archive::Zip | |
| 186 | )); | |
| 187 | ||
| 188 | ||
| 189 | # for $banned_namepath_re (a new-style of banned table) see amavisd.conf-sample | |
| 190 | ||
| 191 | $banned_filename_re = new_RE( | |
| 192 | ||
| 193 | ### BLOCKED ANYWHERE | |
| 194 | # qr'^UNDECIPHERABLE$', # is or contains any undecipherable components | |
| 195 | qr'^\.(exe-ms|dll)$', # banned file(1) types, rudimentary | |
| 196 | # qr'^\.(exe|lha|tnef|cab|dll)$', # banned file(1) types | |
| 197 | ||
| 198 | ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES: | |
| 199 | # [ qr'^\.(gz|bz2)$' => 0 ], # allow any in gzip or bzip2 | |
| 200 | [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives | |
| 201 | ||
| 202 | qr'.\.(pif|scr)$'i, # banned extensions - rudimentary | |
| 203 | # qr'^\.zip$', # block zip type | |
| 204 | ||
| 205 | ### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES: | |
| 206 | # [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within these archives | |
| 207 | ||
| 208 | qr'^application/x-msdownload$'i, # block these MIME types | |
| 209 | qr'^application/x-msdos-program$'i, | |
| 210 | qr'^application/hta$'i, | |
| 211 | ||
| 212 | # qr'^message/partial$'i, # rfc2046 MIME type | |
| 213 | # qr'^message/external-body$'i, # rfc2046 MIME type | |
| 214 | ||
| 215 | # qr'^(application/x-msmetafile|image/x-wmf)$'i, # Windows Metafile MIME type | |
| 216 | # qr'^\.wmf$', # Windows Metafile file(1) type | |
| 217 | ||
| 218 | # block certain double extensions in filenames | |
| 219 | qr'\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i, | |
| 220 | ||
| 221 | # qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Class ID CLSID, strict | |
| 222 | # qr'\{[0-9a-z]{4,}(-[0-9a-z]{4,}){0,7}\}?'i, # Class ID extension CLSID, loose | |
| 223 | ||
| 224 | qr'.\.(exe|vbs|pif|scr|cpl)$'i, # banned extension - basic | |
| 225 | # qr'.\.(exe|vbs|pif|scr|cpl|bat|cmd|com)$'i, # banned extension - basic+cmd | |
| 226 | # qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta| | |
| 227 | # inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst| | |
| 228 | # ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs| | |
| 229 | # wmf|wsc|wsf|wsh)$'ix, # banned ext - long | |
| 230 | # qr'.\.(ani|cur|ico)$'i, # banned cursors and icons filename | |
| 231 | # qr'^\.ani$', # banned animated cursor file(1) type | |
| 232 | ||
| 233 | # qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab. | |
| 234 | ); | |
| 235 | # See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631 | |
| 236 | # and http://www.cknow.com/vtutor/vtextensions.htm | |
| 237 | ||
| 238 | ||
| 239 | # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING | |
| 240 | ||
| 241 | @score_sender_maps = ({ # a by-recipient hash lookup table, | |
| 242 | # results from all matching recipient tables are summed | |
| 243 | ||
| 244 | # ## per-recipient personal tables (NOTE: positive: black, negative: white) | |
| 245 | # 'user1@example.com' => [{'bla-mobile.press@example.com' => 10.0}], | |
| 246 | # 'user3@example.com' => [{'.ebay.com' => -3.0}], | |
| 247 | # 'user4@example.com' => [{'cleargreen@cleargreen.com' => -7.0, | |
| 248 | # '.cleargreen.com' => -5.0}], | |
| 249 | ||
| 250 | ## site-wide opinions about senders (the '.' matches any recipient) | |
| 251 | '.' => [ # the _first_ matching sender determines the score boost | |
| 252 | ||
| 253 | new_RE( # regexp-type lookup table, just happens to be all soft-blacklist | |
| 254 | [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i => 5.0], | |
| 255 | [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0], | |
| 256 | [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0], | |
| 257 | [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i => 5.0], | |
| 258 | [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i => 5.0], | |
| 259 | [qr'^(your_friend|greatoffers)@'i => 5.0], | |
| 260 | [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i => 5.0], | |
| 261 | ), | |
| 262 | ||
| 263 | # read_hash("/var/amavis/sender_scores_sitewide"), | |
| 264 | ||
| 265 | { # a hash-type lookup table (associative array) | |
| 266 | 'nobody@cert.org' => -3.0, | |
| 267 | 'cert-advisory@us-cert.gov' => -3.0, | |
| 268 | 'owner-alert@iss.net' => -3.0, | |
| 269 | 'slashdot@slashdot.org' => -3.0, | |
| 270 | 'securityfocus.com' => -3.0, | |
| 271 | 'ntbugtraq@listserv.ntbugtraq.com' => -3.0, | |
| 272 | 'security-alerts@linuxsecurity.com' => -3.0, | |
| 273 | 'mailman-announce-admin@python.org' => -3.0, | |
| 274 | 'amavis-user-admin@lists.sourceforge.net'=> -3.0, | |
| 275 | 'amavis-user-bounces@lists.sourceforge.net' => -3.0, | |
| 276 | 'spamassassin.apache.org' => -3.0, | |
| 277 | 'notification-return@lists.sophos.com' => -3.0, | |
| 278 | 'owner-postfix-users@postfix.org' => -3.0, | |
| 279 | 'owner-postfix-announce@postfix.org' => -3.0, | |
| 280 | 'owner-sendmail-announce@lists.sendmail.org' => -3.0, | |
| 281 | 'sendmail-announce-request@lists.sendmail.org' => -3.0, | |
| 282 | 'donotreply@sendmail.org' => -3.0, | |
| 283 | 'ca+envelope@sendmail.org' => -3.0, | |
| 284 | 'noreply@freshmeat.net' => -3.0, | |
| 285 | 'owner-technews@postel.acm.org' => -3.0, | |
| 286 | 'ietf-123-owner@loki.ietf.org' => -3.0, | |
| 287 | 'cvs-commits-list-admin@gnome.org' => -3.0, | |
| 288 | 'rt-users-admin@lists.fsck.com' => -3.0, | |
| 289 | 'clp-request@comp.nus.edu.sg' => -3.0, | |
| 290 | 'surveys-errors@lists.nua.ie' => -3.0, | |
| 291 | 'emailnews@genomeweb.com' => -5.0, | |
| 292 | 'yahoo-dev-null@yahoo-inc.com' => -3.0, | |
| 293 | 'returns.groups.yahoo.com' => -3.0, | |
| 294 | 'clusternews@linuxnetworx.com' => -3.0, | |
| 295 | lc('lvs-users-admin@LinuxVirtualServer.org') => -3.0, | |
| 296 | lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0, | |
| 297 | ||
| 298 | # soft-blacklisting (positive score) | |
| 299 | 'sender@example.net' => 3.0, | |
| 300 | '.example.net' => 1.0, | |
| 301 | ||
| 302 | }, | |
| 303 | ], # end of site-wide tables | |
| 304 | }); | |
| 305 | ||
| 306 | ||
| 307 | @decoders = ( | |
| 308 | ['mail', \&do_mime_decode], | |
| 309 | ['asc', \&do_ascii], | |
| 310 | ['uue', \&do_ascii], | |
| 311 | ['hqx', \&do_ascii], | |
| 312 | ['ync', \&do_ascii], | |
| 313 | ['F', \&do_uncompress, ['unfreeze','freeze -d','melt','fcat'] ], | |
| 314 | ['Z', \&do_uncompress, ['uncompress','gzip -d','zcat'] ], | |
| 315 | ['gz', \&do_uncompress, 'gzip -d'], | |
| 316 | ['gz', \&do_gunzip], | |
| 317 | ['bz2', \&do_uncompress, 'bzip2 -d'], | |
| 318 | ['lzo', \&do_uncompress, 'lzop -d'], | |
| 319 | ['rpm', \&do_uncompress, ['rpm2cpio.pl','rpm2cpio'] ], | |
| 320 | ['cpio', \&do_pax_cpio, ['pax','gcpio','cpio'] ], | |
| 321 | ['tar', \&do_pax_cpio, ['pax','gcpio','cpio'] ], | |
| 322 | ['deb', \&do_ar, 'ar'], | |
| 323 | # ['a', \&do_ar, 'ar'], # unpacking .a seems an overkill | |
| 324 | ['zip', \&do_unzip], | |
| 325 | ['7z', \&do_7zip, ['7zr','7za','7z'] ], | |
| 326 | ['rar', \&do_unrar, ['rar','unrar'] ], | |
| 327 | ['arj', \&do_unarj, ['arj','unarj'] ], | |
| 328 | ['arc', \&do_arc, ['nomarch','arc'] ], | |
| 329 | ['zoo', \&do_zoo, ['zoo','unzoo'] ], | |
| 330 | ['lha', \&do_lha, 'lha'], | |
| 331 | # ['doc', \&do_ole, 'ripole'], | |
| 332 | ['cab', \&do_cabextract, 'cabextract'], | |
| 333 | ['tnef', \&do_tnef_ext, 'tnef'], | |
| 334 | ['tnef', \&do_tnef], | |
| 335 | # ['sit', \&do_unstuff, 'unstuff'], # broken/unsafe decoder | |
| 336 | ['exe', \&do_executable, ['rar','unrar'], 'lha', ['arj','unarj'] ], | |
| 337 | ); | |
| 338 | ||
| 339 | ||
| 340 | @av_scanners = ( | |
| 341 | ||
| 342 | # ### http://www.clanfield.info/sophie/ (http://www.vanja.com/tools/sophie/) | |
| 343 | # ['Sophie', | |
| 344 | # \&ask_daemon, ["{}/\n", '/var/run/sophie'], | |
| 345 | # qr/(?x)^ 0+ ( : | [\000\r\n]* $)/, qr/(?x)^ 1 ( : | [\000\r\n]* $)/, | |
| 346 | # qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/ ], | |
| 347 | ||
| 348 | # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/ | |
| 349 | # ['Sophos SAVI', \&sophos_savi ], | |
| 350 | ||
| 351 | # ### http://www.clamav.net/ | |
| 352 | ['ClamAV-clamd', | |
| 353 | \&ask_daemon, ["CONTSCAN {}\n", "/var/spool/amavisd/clamd.sock"], | |
| 354 | qr/\bOK$/, qr/\bFOUND$/, | |
| 355 | qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ], | |
| 356 | # # NOTE: run clamd under the same user as amavisd, or run it under its own | |
| 357 | # # uid such as clamav, add user clamav to the amavis group, and then add | |
| 358 | # # AllowSupplementaryGroups to clamd.conf; | |
| 359 | # # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in | |
| 360 | # # this entry; when running chrooted one may prefer socket "$MYHOME/clamd". | |
| 361 | ||
| 362 | # ### http://www.clamav.net/ and CPAN (memory-hungry! clamd is preferred) | |
| 363 | # # note that Mail::ClamAV requires perl to be build with threading! | |
| 364 | # ['Mail::ClamAV', \&ask_clamav, "*", [0], [1], qr/^INFECTED: (.+)/], | |
| 365 | ||
| 366 | # ### http://www.openantivirus.org/ | |
| 367 | # ['OpenAntiVirus ScannerDaemon (OAV)', | |
| 368 | # \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'], | |
| 369 | # qr/^OK/, qr/^FOUND: /, qr/^FOUND: (.+)/ ], | |
| 370 | ||
| 371 | # ### http://www.vanja.com/tools/trophie/ | |
| 372 | # ['Trophie', | |
| 373 | # \&ask_daemon, ["{}/\n", '/var/run/trophie'], | |
| 374 | # qr/(?x)^ 0+ ( : | [\000\r\n]* $)/, qr/(?x)^ 1 ( : | [\000\r\n]* $)/, | |
| 375 | # qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/ ], | |
| 376 | ||
| 377 | # ### http://www.grisoft.com/ | |
| 378 | # ['AVG Anti-Virus', | |
| 379 | # \&ask_daemon, ["SCAN {}\n", '127.0.0.1:55555'], | |
| 380 | # qr/^200/, qr/^403/, qr/^403 .*?: ([^\r\n]+)/ ], | |
| 381 | ||
| 382 | # ### http://www.f-prot.com/ | |
| 383 | # ['FRISK F-Prot Daemon', | |
| 384 | # \&ask_daemon, | |
| 385 | # ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n", | |
| 386 | # ['127.0.0.1:10200','127.0.0.1:10201','127.0.0.1:10202', | |
| 387 | # '127.0.0.1:10203','127.0.0.1:10204'] ], | |
| 388 | # qr/(?i)<summary[^>]*>clean<\/summary>/, | |
| 389 | # qr/(?i)<summary[^>]*>infected<\/summary>/, | |
| 390 | # qr/(?i)<name>(.+)<\/name>/ ], | |
| 391 | ||
| 392 | # ### http://www.sald.com/, http://www.dials.ru/english/, http://www.drweb.ru/ | |
| 393 | # ['DrWebD', \&ask_daemon, # DrWebD 4.31 or later | |
| 394 | # [pack('N',1). # DRWEBD_SCAN_CMD | |
| 395 | # pack('N',0x00280001). # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES | |
| 396 | # pack('N', # path length | |
| 397 | # length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")). | |
| 398 | # '{}/*'. # path | |
| 399 | # pack('N',0). # content size | |
| 400 | # pack('N',0), | |
| 401 | # '/var/drweb/run/drwebd.sock', | |
| 402 | # # '/var/amavis/var/run/drwebd.sock', # suitable for chroot | |
| 403 | # # '/usr/local/drweb/run/drwebd.sock', # FreeBSD drweb ports default | |
| 404 | # # '127.0.0.1:3000', # or over an inet socket | |
| 405 | # ], | |
| 406 | # qr/\A\x00[\x10\x11][\x00\x10]\x00/s, # IS_CLEAN,EVAL_KEY; SKIPPED | |
| 407 | # qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/s, # KNOWN_V,UNKNOWN_V,V._MODIF | |
| 408 | # qr/\A.{12}(?:infected with )?([^\x00]+)\x00/s, | |
| 409 | # ], | |
| 410 | # # NOTE: If using amavis-milter, change length to: | |
| 411 | # # length("$TEMPBASE/amavis-milter-xxxxxxxxxxxxxx/parts/pxxx"). | |
| 412 | ||
| 413 | ### http://www.kaspersky.com/ (kav4mailservers) | |
| 414 | ['KasperskyLab AVP - aveclient', | |
| 415 | ['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient', | |
| 416 | '/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'], | |
| 417 | '-p /var/run/aveserver -s {}/*', | |
| 418 | [0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/, | |
| 419 | qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/, | |
| 420 | ], | |
| 421 | # NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious, | |
| 422 | # currupted or protected archives are to be handled | |
| 423 | ||
| 424 | ### http://www.kaspersky.com/ | |
| 425 | ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'], | |
| 426 | '-* -P -B -Y -O- {}', [0,3,6,8], [2,4], # any use for -A -K ? | |
| 427 | qr/infected: (.+)/, | |
| 428 | sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"}, | |
| 429 | sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"}, | |
| 430 | ], | |
| 431 | ||
| 432 | ### The kavdaemon and AVPDaemonClient have been removed from Kasperky | |
| 433 | ### products and replaced by aveserver and aveclient | |
| 434 | ['KasperskyLab AVPDaemonClient', | |
| 435 | [ '/opt/AVP/kavdaemon', 'kavdaemon', | |
| 436 | '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient', | |
| 437 | '/opt/AVP/AvpTeamDream', 'AvpTeamDream', | |
| 438 | '/opt/AVP/avpdc', 'avpdc' ], | |
| 439 | "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/ ], | |
| 440 | # change the startup-script in /etc/init.d/kavd to: | |
| 441 | # DPARMS="-* -Y -dl -f=/var/amavis /var/amavis" | |
| 442 | # (or perhaps: DPARMS="-I0 -Y -* /var/amavis" ) | |
| 443 | # adjusting /var/amavis above to match your $TEMPBASE. | |
| 444 | # The '-f=/var/amavis' is needed if not running it as root, so it | |
| 445 | # can find, read, and write its pid file, etc., see 'man kavdaemon'. | |
| 446 | # defUnix.prf: there must be an entry "*/var/amavis" (or whatever | |
| 447 | # directory $TEMPBASE specifies) in the 'Names=' section. | |
| 448 | # cd /opt/AVP/DaemonClients; configure; cd Sample; make | |
| 449 | # cp AvpDaemonClient /opt/AVP/ | |
| 450 | # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}" | |
| 451 | ||
| 452 | ### http://www.centralcommand.com/ | |
| 453 | ['CentralCommand Vexira (new) vascan', | |
| 454 | ['vascan','/usr/lib/Vexira/vascan'], | |
| 455 | "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ". | |
| 456 | "--log=/var/log/vascan.log {}", | |
| 457 | [0,3], [1,2,5], | |
| 458 | qr/(?x)^\s* (?:virus|iworm|macro|mutant|sequence|trojan)\ found:\ ( [^\]\s']+ )\ \.\.\.\ / ], | |
| 459 | # Adjust the path of the binary and the virus database as needed. | |
| 460 | # 'vascan' does not allow to have the temp directory to be the same as | |
| 461 | # the quarantine directory, and the quarantine option can not be disabled. | |
| 462 | # If $QUARANTINEDIR is not used, then another directory must be specified | |
| 463 | # to appease 'vascan'. Move status 3 to the second list if password | |
| 464 | # protected files are to be considered infected. | |
| 465 | ||
| 466 | ### http://www.avira.com/ | |
| 467 | ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus | |
| 468 | ['Avira AntiVir', ['antivir','vexira'], | |
| 469 | '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/, | |
| 470 | qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) | | |
| 471 | (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/ ], | |
| 472 | # NOTE: if you only have a demo version, remove -z and add 214, as in: | |
| 473 | # '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/, | |
| 474 | ||
| 475 | ### http://www.commandsoftware.com/ | |
| 476 | ['Command AntiVirus for Linux', 'csav', | |
| 477 | '-all -archive -packed {}', [50], [51,52,53], | |
| 478 | qr/Infection: (.+)/ ], | |
| 479 | ||
| 480 | ### http://www.symantec.com/ | |
| 481 | ['Symantec CarrierScan via Symantec CommandLineScanner', | |
| 482 | 'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}', | |
| 483 | qr/^Files Infected:\s+0$/, qr/^Infected\b/, | |
| 484 | qr/^(?:Info|Virus Name):\s+(.+)/ ], | |
| 485 | ||
| 486 | ### http://www.symantec.com/ | |
| 487 | ['Symantec AntiVirus Scan Engine', | |
| 488 | 'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}', | |
| 489 | [0], qr/^Infected\b/, | |
| 490 | qr/^(?:Info|Virus Name):\s+(.+)/ ], | |
| 491 | # NOTE: check options and patterns to see which entry better applies | |
| 492 | ||
| 493 | # ### http://www.f-secure.com/products/anti-virus/ version 4.65 | |
| 494 | # ['F-Secure Antivirus for Linux servers', | |
| 495 | # ['/opt/f-secure/fsav/bin/fsav', 'fsav'], | |
| 496 | # '--delete=no --disinf=no --rename=no --archive=yes --auto=yes '. | |
| 497 | # '--dumb=yes --list=no --mime=yes {}', [0], [3,6,8], | |
| 498 | # qr/(?:infection|Infected|Suspected): (.+)/ ], | |
| 499 | ||
| 500 | ### http://www.f-secure.com/products/anti-virus/ version 5.52 | |
| 501 | ['F-Secure Antivirus for Linux servers', | |
| 502 | ['/opt/f-secure/fsav/bin/fsav', 'fsav'], | |
| 503 | '--virus-action1=report --archive=yes --auto=yes '. | |
| 504 | '--dumb=yes --list=no --mime=yes {}', [0], [3,4,6,8], | |
| 505 | qr/(?:infection|Infected|Suspected|Riskware): (.+)/ ], | |
| 506 | # NOTE: internal archive handling may be switched off by '--archive=no' | |
| 507 | # to prevent fsav from exiting with status 9 on broken archives | |
| 508 | ||
| 509 | # ### http://www.avast.com/ | |
| 510 | # ['avast! Antivirus daemon', | |
| 511 | # \&ask_daemon, # greets with 220, terminate with QUIT | |
| 512 | # ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'], | |
| 513 | # qr/\t\[\+\]/, qr/\t\[L\]\t/, qr/\t\[L\]\t([^[ \t\015\012]+)/ ], | |
| 514 | ||
| 515 | # ### http://www.avast.com/ | |
| 516 | # ['avast! Antivirus - Client/Server Version', 'avastlite', | |
| 517 | # '-a /var/run/avast4/mailscanner.sock -n {}', [0], [1], | |
| 518 | # qr/\t\[L\]\t([^[ \t\015\012]+)/ ], | |
| 519 | ||
| 520 | ['CAI InoculateIT', 'inocucmd', # retired product | |
| 521 | '-sec -nex {}', [0], [100], | |
| 522 | qr/was infected by virus (.+)/ ], | |
| 523 | # see: http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html | |
| 524 | ||
| 525 | ### http://www3.ca.com/Solutions/Product.asp?ID=156 (ex InoculateIT) | |
| 526 | ['CAI eTrust Antivirus', 'etrust-wrapper', | |
| 527 | '-arc -nex -spm h {}', [0], [101], | |
| 528 | qr/is infected by virus: (.+)/ ], | |
| 529 | # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer | |
| 530 | # see http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783 | |
| 531 | ||
| 532 | ### http://mks.com.pl/english.html | |
| 533 | ['MkS_Vir for Linux (beta)', ['mks32','mks'], | |
| 534 | '-s {}/*', [0], [1,2], | |
| 535 | qr/--[ \t]*(.+)/ ], | |
| 536 | ||
| 537 | ### http://mks.com.pl/english.html | |
| 538 | ['MkS_Vir daemon', 'mksscan', | |
| 539 | '-s -q {}', [0], [1..7], | |
| 540 | qr/^... (\S+)/ ], | |
| 541 | ||
| 542 | # ### http://www.nod32.com/, version v2.52 and above | |
| 543 | # ['ESET NOD32 for Linux Mail servers', | |
| 544 | # ['/opt/eset/nod32/bin/nod32cli', 'nod32cli'], | |
| 545 | # '--subdir --files -z --sfx --rtp --adware --unsafe --pattern --heur '. | |
| 546 | # '-w -a --action-on-infected=accept --action-on-uncleanable=accept '. | |
| 547 | # '--action-on-notscanned=accept {}', | |
| 548 | # [0,3], [1,2], qr/virus="([^"]+)"/ ], | |
| 549 | ||
| 550 | ### http://www.eset.com/, version v2.7 | |
| 551 | ['ESET NOD32 Linux Mail Server - command line interface', | |
| 552 | ['/usr/bin/nod32cli', '/opt/eset/nod32/bin/nod32cli', 'nod32cli'], | |
| 553 | '--subdir {}', [0,3], [1,2], qr/virus="([^"]+)"/ ], | |
| 554 | ||
| 555 | ## http://www.nod32.com/, NOD32LFS version 2.5 and above | |
| 556 | ['ESET NOD32 for Linux File servers', | |
| 557 | ['/opt/eset/nod32/sbin/nod32','nod32'], | |
| 558 | '--files -z --mail --sfx --rtp --adware --unsafe --pattern --heur '. | |
| 559 | '-w -a --action=1 -b {}', | |
| 560 | [0], [1,10], qr/^object=.*, virus="(.*?)",/ ], | |
| 561 | ||
| 562 | # Experimental, based on posting from Rado Dibarbora (Dibo) on 2002-05-31 | |
| 563 | # ['ESET Software NOD32 Client/Server (NOD32SS)', | |
| 564 | # \&ask_daemon2, # greets with 200, persistent, terminate with QUIT | |
| 565 | # ["SCAN {}/*\r\n", '127.0.0.1:8448' ], | |
| 566 | # qr/^200 File OK/, qr/^201 /, qr/^201 (.+)/ ], | |
| 567 | ||
| 568 | ### http://www.norman.com/products_nvc.shtml | |
| 569 | ['Norman Virus Control v5 / Linux', 'nvcc', | |
| 570 | '-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14], | |
| 571 | qr/(?i).* virus in .* -> \'(.+)\'/ ], | |
| 572 | ||
| 573 | ### http://www.pandasoftware.com/ | |
| 574 | ['Panda CommandLineSecure 9 for Linux', | |
| 575 | ['/opt/pavcl/usr/bin/pavcl','pavcl'], | |
| 576 | '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}', | |
| 577 | qr/Number of files infected[ .]*: 0+(?!\d)/, | |
| 578 | qr/Number of files infected[ .]*: 0*[1-9]/, | |
| 579 | qr/Found virus :\s*(\S+)/ ], | |
| 580 | # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr' | |
| 581 | # before starting amavisd - the bases are then loaded only once at startup. | |
| 582 | # To reload bases in a signature update script: | |
| 583 | # /opt/pavcl/usr/bin/pavcl -tsr -ulr; /opt/pavcl/usr/bin/pavcl -tsr | |
| 584 | # Please review other options of pavcl, for example: | |
| 585 | # -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies | |
| 586 | ||
| 587 | # ### http://www.pandasoftware.com/ | |
| 588 | # ['Panda Antivirus for Linux', ['pavcl'], | |
| 589 | # '-TSR -aut -aex -heu -cmp -nbr -nor -nso -eng {}', | |
| 590 | # [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0], | |
| 591 | # qr/Found virus :\s*(\S+)/ ], | |
| 592 | ||
| 593 | # GeCAD AV technology is acquired by Microsoft; RAV has been discontinued. | |
| 594 | # Check your RAV license terms before fiddling with the following two lines! | |
| 595 | # ['GeCAD RAV AntiVirus 8', 'ravav', | |
| 596 | # '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/ ], | |
| 597 | # # NOTE: the command line switches changed with scan engine 8.5 ! | |
| 598 | # # (btw, assigning stdin to /dev/null causes RAV to fail) | |
| 599 | ||
| 600 | ### http://www.nai.com/ | |
| 601 | ['NAI McAfee AntiVirus (uvscan)', 'uvscan', | |
| 602 | '--secure -rv --mime --summary --noboot - {}', [0], [13], | |
| 603 | qr/(?x) Found (?: | |
| 604 | \ the\ (.+)\ (?:virus|trojan) | | |
| 605 | \ (?:virus|trojan)\ or\ variant\ ([^ ]+) | | |
| 606 | :\ (.+)\ NOT\ a\ virus)/, | |
| 607 | # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'}, | |
| 608 | # sub {delete $ENV{LD_PRELOAD}}, | |
| 609 | ], | |
| 610 | # NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before | |
| 611 | # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6 | |
| 612 | # and then clear it when finished to avoid confusing anything else. | |
| 613 | # NOTE2: to treat encrypted files as viruses replace the [13] with: | |
| 614 | # qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/ | |
| 615 | ||
| 616 | ### http://www.virusbuster.hu/en/ | |
| 617 | ['VirusBuster', ['vbuster', 'vbengcl'], | |
| 618 | "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1], | |
| 619 | qr/: '(.*)' - Virus/ ], | |
| 620 | # VirusBuster Ltd. does not support the daemon version for the workstation | |
| 621 | # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of | |
| 622 | # binaries, some parameters AND return codes have changed (from 3 to 1). | |
| 623 | # See also the new Vexira entry 'vascan' which is possibly related. | |
| 624 | ||
| 625 | # ### http://www.virusbuster.hu/en/ | |
| 626 | # ['VirusBuster (Client + Daemon)', 'vbengd', | |
| 627 | # '-f -log scandir {}', [0], [3], | |
| 628 | # qr/Virus found = (.*);/ ], | |
| 629 | # # HINT: for an infected file it always returns 3, | |
| 630 | # # although the man-page tells a different story | |
| 631 | ||
| 632 | ### http://www.cyber.com/ | |
| 633 | ['CyberSoft VFind', 'vfind', | |
| 634 | '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/, | |
| 635 | # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'}, | |
| 636 | ], | |
| 637 | ||
| 638 | ### http://www.avast.com/ | |
| 639 | ['avast! Antivirus', ['/usr/bin/avastcmd','avastcmd'], | |
| 640 | '-a -i -n -t=A {}', [0], [1], qr/\binfected by:\s+([^ \t\n\[\]]+)/ ], | |
| 641 | ||
| 642 | ### http://www.ikarus-software.com/ | |
| 643 | ['Ikarus AntiVirus for Linux', 'ikarus', | |
| 644 | '{}', [0], [40], qr/Signature (.+) found/ ], | |
| 645 | ||
| 646 | ### http://www.bitdefender.com/ | |
| 647 | ['BitDefender', 'bdc', | |
| 648 | '--arc --mail {}', qr/^Infected files *:0+(?!\d)/, | |
| 649 | qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/, | |
| 650 | qr/(?:suspected|infected): (.*)(?:\033|$)/ ], | |
| 651 | # consider also: --all --nowarn --alev=15 --flev=15. The --all argument may | |
| 652 | # not apply to your version of bdc, check documentation and see 'bdc --help' | |
| 653 | ||
| 654 | ### ArcaVir for Linux and Unix http://www.arcabit.pl/ | |
| 655 | ['ArcaVir for Linux', ['arcacmd','arcacmd.static'], | |
| 656 | '-v 1 -summary 0 -s {}', [0], [1,2], | |
| 657 | qr/(?:VIR|WIR):[ \t]*(.+)/ ], | |
| 658 | ||
| 659 | # ['File::Scan', sub {Amavis::AV::ask_av(sub{ | |
| 660 | # use File::Scan; my($fn)=@_; | |
| 661 | # my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0); | |
| 662 | # my($vname) = $f->scan($fn); | |
| 663 | # $f->error ? (2,"Error: ".$f->error) | |
| 664 | # : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) }, | |
| 665 | # ["{}/*"], [0], [1], qr/^(.*) FOUND$/ ], | |
| 666 | ||
| 667 | # ### fully-fledged checker for JPEG marker segments of invalid length | |
| 668 | # ['check-jpeg', | |
| 669 | # sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) }, | |
| 670 | # ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/ ], | |
| 671 | # # NOTE: place file JpegTester.pm somewhere where Perl can find it, | |
| 672 | # # for example in /usr/local/lib/perl5/site_perl | |
| 673 | ||
| 674 | ); | |
| 675 | ||
| 676 | ||
| 677 | @av_scanners_backup = ( | |
| 678 | ||
| 679 | ### http://www.clamav.net/ - backs up clamd or Mail::ClamAV | |
| 680 | ['ClamAV-clamscan', 'clamscan', | |
| 681 | "--stdout --no-summary -r --tempdir=$TEMPBASE {}", | |
| 682 | [0], qr/:.*\sFOUND$/, qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ], | |
| 683 | ||
| 684 | ### http://www.f-prot.com/ - backs up F-Prot Daemon | |
| 685 | ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'], | |
| 686 | '-dumb -archive -packed {}', [0,8], [3,6], # or: [0], [3,6,8], | |
| 687 | qr/(?:Infection:|security risk named) (.+)|\s+contains\s+(.+)$/ ], | |
| 688 | ||
| 689 | ### http://www.trendmicro.com/ - backs up Trophie | |
| 690 | ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'], | |
| 691 | '-za -a {}', [0], qr/Found virus/, qr/Found virus (.+) in/ ], | |
| 692 | ||
| 693 | ### http://www.sald.com/, http://drweb.imshop.de/ - backs up DrWebD | |
| 694 | ['drweb - DrWeb Antivirus', # security LHA hole in Dr.Web 4.33 and earlier | |
| 695 | ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'], | |
| 696 | '-path={} -al -go -ot -cn -upn -ok-', | |
| 697 | [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'], | |
| 698 | ||
| 699 | ### http://www.kaspersky.com/ | |
| 700 | ['Kaspersky Antivirus v5.5', | |
| 701 | ['/opt/kaspersky/kav4fs/bin/kav4fs-kavscanner', | |
| 702 | '/opt/kav/5.5/kav4unix/bin/kavscanner', | |
| 703 | '/opt/kav/5.5/kav4mailservers/bin/kavscanner', 'kavscanner'], | |
| 704 | '-i0 -xn -xp -mn -R -ePASBME {}/*', [0,10,15], [5,20,21,25], | |
| 705 | qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.*)/ , | |
| 706 | # sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"}, | |
| 707 | # sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"}, | |
| 708 | ], | |
| 709 | ||
| 710 | # Commented out because the name 'sweep' clashes with Debian and FreeBSD | |
| 711 | # package/port of an audio editor. Make sure the correct 'sweep' is found | |
| 712 | # in the path when enabling. | |
| 713 | # | |
| 714 | # ### http://www.sophos.com/ - backs up Sophie or SAVI-Perl | |
| 715 | # ['Sophos Anti Virus (sweep)', 'sweep', | |
| 716 | # '-nb -f -all -rec -ss -sc -archive -cab -mime -oe -tnef '. | |
| 717 | # '--no-reset-atime {}', | |
| 718 | # [0,2], qr/Virus .*? found/, | |
| 719 | # qr/^>>> Virus(?: fragment)? '?(.*?)'? found/, | |
| 720 | # ], | |
| 721 | # # other options to consider: -idedir=/usr/local/sav | |
| 722 | ||
| 723 | # always succeeds (uncomment to consider mail clean if all other scanners fail) | |
| 724 | # ['always-clean', sub {0}], | |
| 725 | ||
| 726 | ); | |
| 727 | ||
| 728 | ||
| 729 | @bypass_virus_checks_maps = ( | |
| 730 | \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re); | |
| 731 | ||
| 732 | @bypass_spam_checks_maps = ( | |
| 733 | \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re); | |
| 734 | ||
| 735 | # | |
| 736 | # Database connection settings | |
| 737 | # | |
| 738 | ||
| 739 | @lookup_sql_dsn = | |
| 740 | ( ['DBI:mysql:database={mysql_server_database};host={mysql_server_ip};port={mysql_server_port}', '{mysql_server_ispconfig_user}', '{mysql_server_ispconfig_password}'] ); | |
| 741 | ||
| 742 | # @storage_sql_dsn = @lookup_sql_dsn; # none, same, or separate database | |
| 743 | #$sql_select_policy = 'SELECT "Y" as local FROM mail_domain WHERE CONCAT("@",domain) IN (%k)'; | |
| 744 | # $banned_files_quarantine_method = 'sql'; | |
| 745 | # $spam_quarantine_method = 'sql'; | |
| 746 | ||
| 747 | # | |
| 748 | # SQL Select statements | |
| 749 | # | |
| 750 | ||
| 751 | $sql_select_policy = | |
| 752 | 'SELECT *,spamfilter_users.id'. | |
| 753 | ' FROM spamfilter_users LEFT JOIN spamfilter_policy ON spamfilter_users.policy_id=spamfilter_policy.id'. | |
| 754 | ' WHERE spamfilter_users.email IN (%k) ORDER BY spamfilter_users.priority DESC'; | |
| 755 | ||
| 756 | ||
| 757 | $sql_select_white_black_list = 'SELECT wb FROM spamfilter_wblist'. | |
| 9bdcb1 | 758 | ' WHERE (spamfilter_wblist.rid=?) AND (spamfilter_wblist.email IN (%k)) AND (spamfilter_wblist.active="y")' . |
| 0711af | 759 | ' ORDER BY spamfilter_wblist.priority DESC'; |
| T | 760 | |
| 761 | # | |
| 762 | # Quarantine settings | |
| 763 | # | |
| 764 | ||
| 765 | $final_virus_destiny = D_BOUNCE; | |
| 766 | $final_spam_destiny = D_DISCARD; | |
| 767 | $final_banned_destiny = D_BOUNCE; | |
| b9fcb3 | 768 | $final_bad_header_destiny = D_PASS; |
| 0711af | 769 | |
| T | 770 | # |
| 771 | # Disable spam and virus notifications for the admin user. | |
| 772 | # Can be overridden by the policies in mysql | |
| 773 | # | |
| 774 | ||
| 775 | $virus_admin = undef; | |
| 776 | $spam_admin = undef; | |
| 777 | ||
| 778 | ||
| 779 | # | |
| 780 | # Enable Logging | |
| 781 | # | |
| 782 | ||
| 783 | $DO_SYSLOG = 1; | |
| 784 | $LOGFILE = "/var/log/amavis.log"; # (defaults to empty, no log) | |
| 785 | ||
| 0f2bb1 | 786 | $log_level = 0; # (defaults to 0) |
| 0711af | 787 | |
| T | 788 | |
| b1ae8f | 789 | $enable_dkim_verification = 1; |
| FS | 790 | $enable_dkim_signing = 1; # load DKIM signing code |
| 791 | $signed_header_fields{'received'} = 0; # turn off signing of Received | |
| 792 | @dkim_signature_options_bysender_maps = ( | |
| 793 | { '.' => { ttl => 21*24*3600, c => 'relaxed/simple' } } ); | |
| 0711af | 794 | 1; # insure a defined return |
