1. ==> /etc/amavis/conf.d/01-debian <==
  2. use strict;
  4. # ADMINISTRATORS:
  5. # Debian suggests that any changes you need to do that should never
  6. # be "updated" by the Debian package should be made in another file,
  7. # overriding the settings in this file.
  8. #
  9. # The package will *not* overwrite your settings, but by keeping
  10. # them separate, you will make the task of merging changes on these
  11. # configuration files much simpler...
  13. # see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
  14. # a list of all variables with their defaults;
  15. # see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
  16. # a traditional-style commented file
  17. # [note: the above files were not converted to Debian settings!]
  18. #
  19. # for more details see documentation in /usr/share/doc/amavisd-new
  20. # and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
  23. # SETTINGS RARELY MODIFIED BY THE LOCAL ADMIN
  25. $ENV{PATH} = $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
  26. $file = 'file';
  27. $gzip = 'gzip';
  28. $bzip2 = 'bzip2';
  29. $lzop = 'lzop';
  30. $rpm2cpio = ['rpm2cpio.pl','rpm2cpio'];
  31. $cabextract = 'cabextract';
  32. $uncompress = ['uncompress', 'gzip -d', 'zcat'];
  33. #$unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat']; #disabled (non-free, no security support)
  34. $unfreeze = undef;
  35. $arc = ['nomarch', 'arc'];
  36. $unarj = ['arj', 'unarj'];
  37. #$unrar = ['rar', 'unrar']; #disabled (non-free, no security support)
  38. $unrar = ['unrar-free'];
  39. $zoo = 'zoo';
  40. $lha = 'lha';
  41. $lha = undef;
  42. $pax = 'pax';
  43. $cpio = 'cpio';
  44. $ar = 'ar';
  45. $ripole = 'ripole';
  46. $dspam = 'dspam';
  48. 1; # ensure a defined return
  50. ==> /etc/amavis/conf.d/05-domain_id <==
  51. use strict;
  53. # $mydomain is used just for convenience in the config files and it is not
  54. # used internally by amavisd-new except in the default X_HEADER_LINE (which
  55. # Debian overrides by default anyway).
  57. chomp($mydomain = `head -n 1 /etc/mailname`);
  59. # amavisd-new needs to know which email domains are to be considered local
  60. # to the administrative domain. Only emails to "local" domains are subject
  61. # to certain functionality, such as the addition of spam tags.
  62. #
  63. # Default local domains to $mydomain and all subdomains. Remember to
  64. # override or redefine this if $mydomain is changed later in the config
  65. # sequence.
  67. @local_domains_acl = ( ".$mydomain" );
  69. 1; # ensure a defined return
  71. ==> /etc/amavis/conf.d/05-node_id <==
  72. use strict;
  74. # $myhostname is used by amavisd-new for node identification, and it is
  75. # important to get it right (e.g. for ESMTP EHLO, loop detection, and so on).
  77. chomp($myhostname = `hostname --fqdn`);
  79. # To manually set $myhostname, edit the following line with the correct Fully
  80. # Qualified Domain Name (FQDN) and remove the # at the beginning of the line.
  81. #
  82. #$myhostname = "mail.example.com";
  84. 1; # ensure a defined return
  86. ==> /etc/amavis/conf.d/15-av_scanners <==
  87. use strict;
  89. ##
  90. ## AV Scanners (Debian version)
  91. ##
  93. @av_scanners = (
  95. # ### http://www.clanfield.info/sophie/ (http://www.vanja.com/tools/sophie/)
  96. # ['Sophie',
  97. # \&ask_daemon, ["{}/\n", '/var/run/sophie'],
  98. # qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
  99. # qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
  101. # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
  102. # ['Sophos SAVI', \&sophos_savi ],
  104. ### http://www.clamav.net/
  105. ['ClamAV-clamd',
  106. \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
  107. qr/\bOK$/m, qr/\bFOUND$/m,
  108. qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
  109. # NOTE: run clamd under the same user as amavisd, or run it under its own
  110. # uid such as clamav, add user clamav to the amavis group, and then add
  111. # AllowSupplementaryGroups to clamd.conf;
  112. # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
  113. # this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
  115. # ### http://www.openantivirus.org/
  116. # ['OpenAntiVirus ScannerDaemon (OAV)',
  117. # \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
  118. # qr/^OK/m, qr/^FOUND: /m, qr/^FOUND: (.+)/m ],
  120. # ### http://www.vanja.com/tools/trophie/
  121. # ['Trophie',
  122. # \&ask_daemon, ["{}/\n", '/var/run/trophie'],
  123. # qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
  124. # qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
  126. # ### http://www.grisoft.com/
  127. # ['AVG Anti-Virus',
  128. # \&ask_daemon, ["SCAN {}\n", '127.0.0.1:55555'],
  129. # qr/^200/m, qr/^403/m, qr/^403 .*?: ([^\r\n]+)/m ],
  131. # ### http://www.f-prot.com/
  132. # ['F-Prot fpscand', # F-PROT Antivirus for BSD/Linux/Solaris, version 6
  133. # \&ask_daemon,
  134. # ["SCAN FILE {}/*\n", '127.0.0.1:10200'],
  135. # qr/^(0|8|64) /m,
  136. # qr/^([1235679]|1[01345]) |<[^>:]*(?i)(infected|suspicious|unwanted)/m,
  137. # qr/(?i)<[^>:]*(?:infected|suspicious|unwanted)[^>:]*: ([^>]*)>/m ],
  139. # ### http://www.f-prot.com/
  140. # ['F-Prot f-protd', # old version
  141. # \&ask_daemon,
  142. # ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n",
  143. # ['127.0.0.1:10200', '127.0.0.1:10201', '127.0.0.1:10202',
  144. # '127.0.0.1:10203', '127.0.0.1:10204'] ],
  145. # qr/(?i)<summary[^>]*>clean<\/summary>/m,
  146. # qr/(?i)<summary[^>]*>infected<\/summary>/m,
  147. # qr/(?i)<name>(.+)<\/name>/m ],
  149. # ### http://www.sald.com/, http://www.dials.ru/english/, http://www.drweb.ru/
  150. # ['DrWebD', \&ask_daemon, # DrWebD 4.31 or later
  151. # [pack('N',1). # DRWEBD_SCAN_CMD
  152. # pack('N',0x00280001). # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES
  153. # pack('N', # path length
  154. # length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
  155. # '{}/*'. # path
  156. # pack('N',0). # content size
  157. # pack('N',0),
  158. # '/var/drweb/run/drwebd.sock',
  159. # # '/var/amavis/var/run/drwebd.sock', # suitable for chroot
  160. # # '/usr/local/drweb/run/drwebd.sock', # FreeBSD drweb ports default
  161. # # '127.0.0.1:3000', # or over an inet socket
  162. # ],
  163. # qr/\A\x00[\x10\x11][\x00\x10]\x00/sm, # IS_CLEAN,EVAL_KEY; SKIPPED
  164. # qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/sm,# KNOWN_V,UNKNOWN_V,V._MODIF
  165. # qr/\A.{12}(?:infected with )?([^\x00]+)\x00/sm,
  166. # ],
  167. # # NOTE: If using amavis-milter, change length to:
  168. # # length("$TEMPBASE/amavis-milter-xxxxxxxxxxxxxx/parts/pxxx").
  170. ### http://www.kaspersky.com/ (kav4mailservers)
  171. ['KasperskyLab AVP - aveclient',
  172. ['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
  173. '/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
  174. '-p /var/run/aveserver -s {}/*',
  175. [0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
  176. qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
  177. ],
  178. # NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
  179. # currupted or protected archives are to be handled
  181. ### http://www.kaspersky.com/
  182. ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'],
  183. '-* -P -B -Y -O- {}', [0,3,6,8], [2,4], # any use for -A -K ?
  184. qr/infected: (.+)/m,
  185. sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
  186. sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
  187. ],
  189. ### The kavdaemon and AVPDaemonClient have been removed from Kasperky
  190. ### products and replaced by aveserver and aveclient
  191. ['KasperskyLab AVPDaemonClient',
  192. [ '/opt/AVP/kavdaemon', 'kavdaemon',
  193. '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
  194. '/opt/AVP/AvpTeamDream', 'AvpTeamDream',
  195. '/opt/AVP/avpdc', 'avpdc' ],
  196. "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/m ],
  197. # change the startup-script in /etc/init.d/kavd to:
  198. # DPARMS="-* -Y -dl -f=/var/amavis /var/amavis"
  199. # (or perhaps: DPARMS="-I0 -Y -* /var/amavis" )
  200. # adjusting /var/amavis above to match your $TEMPBASE.
  201. # The '-f=/var/amavis' is needed if not running it as root, so it
  202. # can find, read, and write its pid file, etc., see 'man kavdaemon'.
  203. # defUnix.prf: there must be an entry "*/var/amavis" (or whatever
  204. # directory $TEMPBASE specifies) in the 'Names=' section.
  205. # cd /opt/AVP/DaemonClients; configure; cd Sample; make
  206. # cp AvpDaemonClient /opt/AVP/
  207. # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}"
  209. ### http://www.centralcommand.com/
  210. ['CentralCommand Vexira (new) vascan',
  211. ['vascan','/usr/lib/Vexira/vascan'],
  212. "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ".
  213. "--log=/var/log/vascan.log {}",
  214. [0,3], [1,2,5],
  215. qr/(?x)^\s* (?:virus|iworm|macro|mutant|sequence|trojan)\ found:\ ( [^\]\s']+ )\ \.\.\.\ /m ],
  216. # Adjust the path of the binary and the virus database as needed.
  217. # 'vascan' does not allow to have the temp directory to be the same as
  218. # the quarantine directory, and the quarantine option can not be disabled.
  219. # If $QUARANTINEDIR is not used, then another directory must be specified
  220. # to appease 'vascan'. Move status 3 to the second list if password
  221. # protected files are to be considered infected.
  223. ### http://www.avira.com/
  224. ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus
  225. ['Avira AntiVir', ['antivir','vexira'],
  226. '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/m,
  227. qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
  228. (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/m ],
  229. # NOTE: if you only have a demo version, remove -z and add 214, as in:
  230. # '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
  232. ### http://www.commandsoftware.com/
  233. ['Command AntiVirus for Linux', 'csav',
  234. '-all -archive -packed {}', [50], [51,52,53],
  235. qr/Infection: (.+)/m ],
  237. ### http://www.symantec.com/
  238. ['Symantec CarrierScan via Symantec CommandLineScanner',
  239. 'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
  240. qr/^Files Infected:\s+0$/m, qr/^Infected\b/m,
  241. qr/^(?:Info|Virus Name):\s+(.+)/m ],
  243. ### http://www.symantec.com/
  244. ['Symantec AntiVirus Scan Engine',
  245. 'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}',
  246. [0], qr/^Infected\b/m,
  247. qr/^(?:Info|Virus Name):\s+(.+)/m ],
  248. # NOTE: check options and patterns to see which entry better applies
  250. # ### http://www.f-secure.com/products/anti-virus/ version 4.65
  251. # ['F-Secure Antivirus for Linux servers',
  252. # ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
  253. # '--delete=no --disinf=no --rename=no --archive=yes --auto=yes '.
  254. # '--dumb=yes --list=no --mime=yes {}', [0], [3,6,8],
  255. # qr/(?:infection|Infected|Suspected): (.+)/m ],
  257. ### http://www.f-secure.com/products/anti-virus/ version 5.52
  258. ['F-Secure Antivirus for Linux servers',
  259. ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
  260. '--virus-action1=report --archive=yes --auto=yes '.
  261. '--dumb=yes --list=no --mime=yes {}', [0], [3,4,6,8],
  262. qr/(?:infection|Infected|Suspected|Riskware): (.+)/m ],
  263. # NOTE: internal archive handling may be switched off by '--archive=no'
  264. # to prevent fsav from exiting with status 9 on broken archives
  266. # ### http://www.avast.com/
  267. # ['avast! Antivirus daemon',
  268. # \&ask_daemon, # greets with 220, terminate with QUIT
  269. # ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'],
  270. # qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
  272. # ### http://www.avast.com/
  273. # ['avast! Antivirus - Client/Server Version', 'avastlite',
  274. # '-a /var/run/avast4/mailscanner.sock -n {}', [0], [1],
  275. # qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
  277. ['CAI InoculateIT', 'inocucmd', # retired product
  278. '-sec -nex {}', [0], [100],
  279. qr/was infected by virus (.+)/m ],
  280. # see: http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html
  282. ### http://www3.ca.com/Solutions/Product.asp?ID=156 (ex InoculateIT)
  283. ['CAI eTrust Antivirus', 'etrust-wrapper',
  284. '-arc -nex -spm h {}', [0], [101],
  285. qr/is infected by virus: (.+)/m ],
  286. # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer
  287. # see http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783
  289. ### http://mks.com.pl/english.html
  290. ['MkS_Vir for Linux (beta)', ['mks32','mks'],
  291. '-s {}/*', [0], [1,2],
  292. qr/--[ \t]*(.+)/m ],
  294. ### http://mks.com.pl/english.html
  295. ['MkS_Vir daemon', 'mksscan',
  296. '-s -q {}', [0], [1..7],
  297. qr/^... (\S+)/m ],
  299. # ### http://www.nod32.com/, version v2.52 (old)
  300. # ['ESET NOD32 for Linux Mail servers',
  301. # ['/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
  302. # '--subdir --files -z --sfx --rtp --adware --unsafe --pattern --heur '.
  303. # '-w -a --action-on-infected=accept --action-on-uncleanable=accept '.
  304. # '--action-on-notscanned=accept {}',
  305. # [0,3], [1,2], qr/virus="([^"]+)"/m ],
  307. # ### http://www.eset.com/, version v2.7 (old)
  308. # ['ESET NOD32 Linux Mail Server - command line interface',
  309. # ['/usr/bin/nod32cli', '/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
  310. # '--subdir {}', [0,3], [1,2], qr/virus="([^"]+)"/m ],
  312. # ### http://www.eset.com/, version 2.71.12
  313. # ['ESET Software ESETS Command Line Interface',
  314. # ['/usr/bin/esets_cli', 'esets_cli'],
  315. # '--subdir {}', [0], [1,2,3], qr/virus="([^"]+)"/m ],
  317. ### http://www.eset.com/, version 3.0
  318. ['ESET Software ESETS Command Line Interface',
  319. ['/usr/bin/esets_cli', 'esets_cli'],
  320. '--subdir {}', [0], [2,3],
  321. qr/:\s*action="(?!accepted)[^"]*"\n.*:\s*virus="([^"]*)"/m ],
  323. ## http://www.nod32.com/, NOD32LFS version 2.5 and above
  324. ['ESET NOD32 for Linux File servers',
  325. ['/opt/eset/nod32/sbin/nod32','nod32'],
  326. '--files -z --mail --sfx --rtp --adware --unsafe --pattern --heur '.
  327. '-w -a --action=1 -b {}',
  328. [0], [1,10], qr/^object=.*, virus="(.*?)",/m ],
  330. # Experimental, based on posting from Rado Dibarbora (Dibo) on 2002-05-31
  331. # ['ESET Software NOD32 Client/Server (NOD32SS)',
  332. # \&ask_daemon2, # greets with 200, persistent, terminate with QUIT
  333. # ["SCAN {}/*\r\n", '127.0.0.1:8448' ],
  334. # qr/^200 File OK/m, qr/^201 /m, qr/^201 (.+)/m ],
  336. ### http://www.norman.com/products_nvc.shtml
  337. ['Norman Virus Control v5 / Linux', 'nvcc',
  338. '-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14],
  339. qr/(?i).* virus in .* -> \'(.+)\'/m ],
  341. ### http://www.pandasoftware.com/
  342. ['Panda CommandLineSecure 9 for Linux',
  343. ['/opt/pavcl/usr/bin/pavcl','pavcl'],
  344. '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}',
  345. qr/Number of files infected[ .]*: 0+(?!\d)/m,
  346. qr/Number of files infected[ .]*: 0*[1-9]/m,
  347. qr/Found virus :\s*(\S+)/m ],
  348. # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr'
  349. # before starting amavisd - the bases are then loaded only once at startup.
  350. # To reload bases in a signature update script:
  351. # /opt/pavcl/usr/bin/pavcl -tsr -ulr; /opt/pavcl/usr/bin/pavcl -tsr
  352. # Please review other options of pavcl, for example:
  353. # -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies
  355. # ### http://www.pandasoftware.com/
  356. # ['Panda Antivirus for Linux', ['pavcl'],
  357. # '-TSR -aut -aex -heu -cmp -nbr -nor -nso -eng {}',
  358. # [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0],
  359. # qr/Found virus :\s*(\S+)/m ],
  361. # GeCAD AV technology is acquired by Microsoft; RAV has been discontinued.
  362. # Check your RAV license terms before fiddling with the following two lines!
  363. # ['GeCAD RAV AntiVirus 8', 'ravav',
  364. # '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/m ],
  365. # # NOTE: the command line switches changed with scan engine 8.5 !
  366. # # (btw, assigning stdin to /dev/null causes RAV to fail)
  368. ### http://www.nai.com/
  369. ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
  370. '--secure -rv --mime --summary --noboot - {}', [0], [13],
  371. qr/(?x) Found (?:
  372. \ the\ (.+)\ (?:virus|trojan) |
  373. \ (?:virus|trojan)\ or\ variant\ ([^ ]+) |
  374. :\ (.+)\ NOT\ a\ virus)/m,
  375. # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
  376. # sub {delete $ENV{LD_PRELOAD}},
  377. ],
  378. # NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before
  379. # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6
  380. # and then clear it when finished to avoid confusing anything else.
  381. # NOTE2: to treat encrypted files as viruses replace the [13] with:
  382. # qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/
  384. ### http://www.virusbuster.hu/en/
  385. ['VirusBuster', ['vbuster', 'vbengcl'],
  386. "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
  387. qr/: '(.*)' - Virus/m ],
  388. # VirusBuster Ltd. does not support the daemon version for the workstation
  389. # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of
  390. # binaries, some parameters AND return codes have changed (from 3 to 1).
  391. # See also the new Vexira entry 'vascan' which is possibly related.
  393. # ### http://www.virusbuster.hu/en/
  394. # ['VirusBuster (Client + Daemon)', 'vbengd',
  395. # '-f -log scandir {}', [0], [3],
  396. # qr/Virus found = (.*);/m ],
  397. # # HINT: for an infected file it always returns 3,
  398. # # although the man-page tells a different story
  400. ### http://www.cyber.com/
  401. ['CyberSoft VFind', 'vfind',
  402. '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/m,
  403. # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'},
  404. ],
  406. ### http://www.avast.com/
  407. ['avast! Antivirus', ['/usr/bin/avastcmd','avastcmd'],
  408. '-a -i -n -t=A {}', [0], [1], qr/\binfected by:\s+([^ \t\n\[\]]+)/m ],
  410. ### http://www.ikarus-software.com/
  411. ['Ikarus AntiVirus for Linux', 'ikarus',
  412. '{}', [0], [40], qr/Signature (.+) found/m ],
  414. ### http://www.bitdefender.com/
  415. ['BitDefender', 'bdscan', # new version
  416. '--action=ignore --no-list {}', qr/^Infected files *:0+(?!\d)/m,
  417. qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
  418. qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
  420. ### http://www.bitdefender.com/
  421. ['BitDefender', 'bdc', # old version
  422. '--arc --mail {}', qr/^Infected files *:0+(?!\d)/m,
  423. qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
  424. qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
  425. # consider also: --all --nowarn --alev=15 --flev=15. The --all argument may
  426. # not apply to your version of bdc, check documentation and see 'bdc --help'
  428. ### ArcaVir for Linux and Unix http://www.arcabit.pl/
  429. ['ArcaVir for Linux', ['arcacmd','arcacmd.static'],
  430. '-v 1 -summary 0 -s {}', [0], [1,2],
  431. qr/(?:VIR|WIR):[ \t]*(.+)/m ],
  433. # ['File::Scan', sub {Amavis::AV::ask_av(sub{
  434. # use File::Scan; my($fn)=@_;
  435. # my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0);
  436. # my($vname) = $f->scan($fn);
  437. # $f->error ? (2,"Error: ".$f->error)
  438. # : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) },
  439. # ["{}/*"], [0], [1], qr/^(.*) FOUND$/m ],
  441. # ### fully-fledged checker for JPEG marker segments of invalid length
  442. # ['check-jpeg',
  443. # sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) },
  444. # ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
  445. # # NOTE: place file JpegTester.pm somewhere where Perl can find it,
  446. # # for example in /usr/local/lib/perl5/site_perl
  448. # ### example: simpleminded checker for JPEG marker segments with
  449. # ### invalid length (only checks first 32k, which is not thorough enough)
  450. # ['check-jpeg-simple',
  451. # sub { Amavis::AV::ask_av(sub {
  452. # my($f)=@_; local(*FF,$_,$1,$2); my(@r)=(0,'not jpeg');
  453. # open(FF,$f) or die "jpeg: open err $f: $!";
  454. # binmode(FF) or die "jpeg: binmode err $f: $!";
  455. # defined read(FF,$_,32000) or die "jpeg: read err $f: $!";
  456. # close(FF) or die "jpeg: close err $f: $!";
  457. # if (/^\xff\xd8\xff/) {
  458. # @r=(0,'jpeg ok');
  459. # while (!/\G(?:\xff\xd9|\z)/gc) { # EOI or eof
  460. # if (/\G\xff+(?=\xff|\z)/gc) {} # fill-bytes before marker
  461. # elsif (/\G\xff([\x01\xd0-\xd8])/gc) {} # TEM, RSTi, SOI
  462. # elsif (/\G\xff([^\x00\xff])(..)/gcs) { # marker segment start
  463. # my($n)=unpack("n",$2)-2;
  464. # $n=32766 if $n>32766; # Perl regexp limit
  465. # if ($n<0) {@r=(1,"bad jpeg: len=$n, pos=".pos); last}
  466. # elsif (/\G.{$n}/gcs) {} # ok
  467. # elsif (/\G.{0,$n}\z/gcs) {last} # truncated
  468. # else {@r=(1,"bad jpeg: unexpected, pos=".pos); last}
  469. # }
  470. # elsif (/\G[^\xff]+/gc) {} # ECS
  471. # elsif (/\G(?:\xff\x00)+/gc) {} # ECS
  472. # else {@r=(2,"bad jpeg: unexpected char, pos=".pos); last}
  473. # }
  474. # }; @r}, @_) },
  475. # ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
  477. # ### an example/testing/template virus scanner (external), wastes 3 seconds
  478. # ['wasteful sleeper example',
  479. # '/bin/sleep', '3', # calls external program
  480. # undef, undef, qr/no such/m ],
  482. # ### an example/testing/template virus scanner (internal), does nothing
  483. # ['null',
  484. # sub {}, ["{}"], # supplies its own subroutine, no external program
  485. # undef, undef, qr/no such/m ],
  487. );
  490. # If no virus scanners from the @av_scanners list produce 'clean' nor
  491. # 'infected' status (i.e. they all fail to run or the list is empty),
  492. # then _all_ scanners from the @av_scanners_backup list are tried
  493. # (again, subject to $first_infected_stops_scan). When there are both
  494. # daemonized and equivalent or similar command-line scanners available,
  495. # it is customary to place slower command-line scanners in the
  496. # @av_scanners_backup list. The default choice is somewhat arbitrary,
  497. # move entries from one list to another as desired, keeping main scanners
  498. # in the primary list to avoid warnings.
  500. @av_scanners_backup = (
  502. ### http://www.clamav.net/ - backs up clamd or Mail::ClamAV
  503. ['ClamAV-clamscan', 'clamscan',
  504. "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
  505. [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
  507. ### http://www.f-prot.com/ - backs up F-Prot Daemon, V6
  508. ['F-PROT Antivirus for UNIX', ['fpscan'],
  509. '--report --mount --adware {}', # consider: --applications -s 4 -u 3 -z 10
  510. [0,8,64], [1,2,3, 4+1,4+2,4+3, 8+1,8+2,8+3, 12+1,12+2,12+3],
  511. qr/^\[Found\s+[^\]]*\]\s+<([^ \t(>]*)/m ],
  513. ### http://www.f-prot.com/ - backs up F-Prot Daemon (old)
  514. ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
  515. '-dumb -archive -packed {}', [0,8], [3,6], # or: [0], [3,6,8],
  516. qr/(?:Infection:|security risk named) (.+)|\s+contains\s+(.+)$/m ],
  518. ### http://www.trendmicro.com/ - backs up Trophie
  519. ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
  520. '-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ],
  522. ### http://www.sald.com/, http://drweb.imshop.de/ - backs up DrWebD
  523. ['drweb - DrWeb Antivirus', # security LHA hole in Dr.Web 4.33 and earlier
  524. ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
  525. '-path={} -al -go -ot -cn -upn -ok-',
  526. [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'m ],
  528. ### http://www.kaspersky.com/
  529. ['Kaspersky Antivirus v5.5',
  530. ['/opt/kaspersky/kav4fs/bin/kav4fs-kavscanner',
  531. '/opt/kav/5.5/kav4unix/bin/kavscanner',
  532. '/opt/kav/5.5/kav4mailservers/bin/kavscanner', 'kavscanner'],
  533. '-i0 -xn -xp -mn -R -ePASBME {}/*', [0,10,15], [5,20,21,25],
  534. qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.*)/m,
  535. # sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"},
  536. # sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
  537. ],
  539. # Commented out because the name 'sweep' clashes with Debian and FreeBSD
  540. # package/port of an audio editor. Make sure the correct 'sweep' is found
  541. # in the path when enabling.
  542. #
  543. # ### http://www.sophos.com/ - backs up Sophie or SAVI-Perl
  544. # ['Sophos Anti Virus (sweep)', 'sweep',
  545. # '-nb -f -all -rec -ss -sc -archive -cab -mime -oe -tnef '.
  546. # '--no-reset-atime {}',
  547. # [0,2], qr/Virus .*? found/m,
  548. # qr/^>>> Virus(?: fragment)? '?(.*?)'? found/m,
  549. # ],
  550. # # other options to consider: -idedir=/usr/local/sav
  552. # Always succeeds and considers mail clean.
  553. # Potentially useful when all other scanners fail and it is desirable
  554. # to let mail continue to flow with no virus checking (when uncommented).
  555. # ['always-clean', sub {0}],
  557. );
  559. 1; # ensure a defined return
  561. ==> /etc/amavis/conf.d/15-content_filter_mode <==
  562. use strict;
  564. # You can modify this file to re-enable SPAM checking through spamassassin
  565. # and to re-enable antivirus checking.
  567. #
  568. # Default antivirus checking mode
  569. # Please note, that anti-virus checking is DISABLED by
  570. # default.
  571. # If You wish to enable it, please uncomment the following lines:
  574. @bypass_virus_checks_maps = (
  575. \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
  578. #
  579. # Default SPAM checking mode
  580. # Please note, that anti-spam checking is DISABLED by
  581. # default.
  582. # If You wish to enable it, please uncomment the following lines:
  585. @bypass_spam_checks_maps = (
  586. \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
  588. 1; # ensure a defined return
  590. ==> /etc/amavis/conf.d/20-debian_defaults <==
  591. use strict;
  593. # ADMINISTRATORS:
  594. # Debian suggests that any changes you need to do that should never
  595. # be "updated" by the Debian package should be made in another file,
  596. # overriding the settings in this file.
  597. #
  598. # The package will *not* overwrite your settings, but by keeping
  599. # them separate, you will make the task of merging changes on these
  600. # configuration files much simpler...
  602. # see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
  603. # a list of all variables with their defaults;
  604. # see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
  605. # a traditional-style commented file
  606. # [note: the above files were not converted to Debian settings!]
  607. #
  608. # for more details see documentation in /usr/share/doc/amavisd-new
  609. # and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
  611. $QUARANTINEDIR = "$MYHOME/virusmails";
  612. $quarantine_subdir_levels = 1; # enable quarantine dir hashing
  614. $log_recip_templ = undef; # disable by-recipient level-0 log entries
  615. $DO_SYSLOG = 1; # log via syslogd (preferred)
  616. $syslog_ident = 'amavis'; # syslog ident tag, prepended to all messages
  617. $syslog_facility = 'mail';
  618. $syslog_priority = 'debug'; # switch to info to drop debug output, etc
  620. $enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
  621. $enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
  623. $inet_socket_port = 10024; # default listening socket
  625. $sa_spam_subject_tag = '***SPAM*** ';
  626. $sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
  627. $sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level
  628. $sa_kill_level_deflt = 6.31; # triggers spam evasive actions
  629. $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
  631. $sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
  632. $sa_local_tests_only = 0; # only tests which do not require internet access?
  634. # Quota limits to avoid bombs (like 42.zip)
  636. $MAXLEVELS = 14;
  637. $MAXFILES = 1500;
  638. $MIN_EXPANSION_QUOTA = 100*1024; # bytes
  639. $MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes
  641. # You should:
  642. # Use D_DISCARD to discard data (viruses)
  643. # Use D_BOUNCE to generate local bounces by amavisd-new
  644. # Use D_REJECT to generate local or remote bounces by the calling MTA
  645. # Use D_PASS to deliver the message
  646. #
  647. # Whatever you do, *NEVER* use D_REJECT if you have other MTAs *forwarding*
  648. # mail to your account. Use D_BOUNCE instead, otherwise you are delegating
  649. # the bounce work to your friendly forwarders, which might not like it at all.
  650. #
  651. # On dual-MTA setups, one can often D_REJECT, as this just makes your own
  652. # MTA generate the bounce message. Test it first.
  653. #
  654. # Bouncing viruses is stupid, always discard them after you are sure the AV
  655. # is working correctly. Bouncing real SPAM is also useless, if you cannot
  656. # D_REJECT it (and don't D_REJECT mail coming from your forwarders!).
  658. $final_virus_destiny = D_PASS; # (data not lost, see virus quarantine)
  659. $final_banned_destiny = D_PASS; # D_REJECT when front-end MTA
  660. $final_spam_destiny = D_PASS;
  661. $final_bad_header_destiny = D_PASS; # False-positive prone (for spam)
  663. $enable_dkim_verification = 0; #disabled to prevent warning
  665. $virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default
  667. # Set to empty ("") to add no header
  668. $X_HEADER_LINE = "Scanned with ClamAV";
  670. # REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
  672. #
  673. # DO NOT SEND VIRUS NOTIFICATIONS TO OUTSIDE OF YOUR DOMAIN. EVER.
  674. #
  675. # These days, almost all viruses fake the envelope sender and mail headers.
  676. # Therefore, "virus notifications" became nothing but undesired, aggravating
  677. # SPAM. This holds true even inside one's domain. We disable them all by
  678. # default, except for the EICAR test pattern.
  679. #
  681. @viruses_that_fake_sender_maps = (new_RE(
  682. [qr'\bEICAR\b'i => 0], # av test pattern name
  683. [qr/.*/ => 1], # true for everything else
  684. ));
  686. @keep_decoded_original_maps = (new_RE(
  687. # qr'^MAIL$', # retain full original message for virus checking (can be slow)
  688. qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
  689. qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
  690. # qr'^Zip archive data', # don't trust Archive::Zip
  691. ));
  694. # for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample
  696. $banned_filename_re = new_RE(
  697. # qr'^UNDECIPHERABLE$', # is or contains any undecipherable components
  699. # block certain double extensions anywhere in the base name
  700. qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
  702. qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i, # Windows Class ID CLSID, strict
  704. qr'^application/x-msdownload$'i, # block these MIME types
  705. qr'^application/x-msdos-program$'i,
  706. qr'^application/hta$'i,
  708. # qr'^application/x-msmetafile$'i, # Windows Metafile MIME type
  709. # qr'^\.wmf$', # Windows Metafile file(1) type
  711. # qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
  713. # [ qr'^\.(Z|gz|bz2)$' => 0 ], # allow any in Unix-compressed
  714. # [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
  715. # [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within such archives
  716. # [ qr'^application/x-zip-compressed$'i => 0], # allow any within such archives
  718. qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic
  719. # qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
  720. # inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
  721. # ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
  722. # wmf|wsc|wsf|wsh)$'ix, # banned ext - long
  724. # qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
  726. qr'^\.(exe-ms)$', # banned file(1) types
  727. # qr'^\.(exe|lha|tnef|cab|dll)$', # banned file(1) types
  728. );
  729. # See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
  730. # and http://www.cknow.com/vtutor/vtextensions.htm
  733. # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
  735. @score_sender_maps = ({ # a by-recipient hash lookup table,
  736. # results from all matching recipient tables are summed
  738. # ## per-recipient personal tables (NOTE: positive: black, negative: white)
  740. # '[email protected]' => [{'.ebay.com' => -3.0}],
  742. # '.cleargreen.com' => -5.0}],
  744. ## site-wide opinions about senders (the '.' matches any recipient)
  745. '.' => [ # the _first_ matching sender determines the score boost
  747. new_RE( # regexp-type lookup table, just happens to be all soft-blacklist
  748. [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i => 5.0],
  749. [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
  750. [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
  751. [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i => 5.0],
  752. [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i => 5.0],
  753. [qr'^(your_friend|greatoffers)@'i => 5.0],
  754. [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i => 5.0],
  755. ),
  757. # read_hash("/var/amavis/sender_scores_sitewide"),
  759. # This are some examples for whitelists, since envelope senders can be forged
  760. # they are not enabled by default.
  761. { # a hash-type lookup table (associative array)
  762. #'[email protected]' => -3.0,
  763. #'[email protected]' => -3.0,
  764. #'[email protected]' => -3.0,
  765. #'[email protected]' => -3.0,
  766. #'securityfocus.com' => -3.0,
  767. #'[email protected]' => -3.0,
  768. #'[email protected]' => -3.0,
  769. #'[email protected]' => -3.0,
  770. #'[email protected]'=> -3.0,
  771. #'[email protected]' => -3.0,
  772. #'spamassassin.apache.org' => -3.0,
  773. #'[email protected]' => -3.0,
  774. #'[email protected]' => -3.0,
  775. #'[email protected]' => -3.0,
  776. #'[email protected]' => -3.0,
  777. #'[email protected]' => -3.0,
  778. #'[email protected]' => -3.0,
  779. #'[email protected]' => -3.0,
  780. #'[email protected]' => -3.0,
  781. #'[email protected]' => -3.0,
  782. #'[email protected]' => -3.0,
  783. #'[email protected]' => -3.0,
  784. #'[email protected]' => -3.0,
  785. #'[email protected]' => -3.0,
  786. #'[email protected]' => -3.0,
  787. #'[email protected]' => -5.0,
  788. #'[email protected]' => -3.0,
  789. #'returns.groups.yahoo.com' => -3.0,
  790. #'[email protected]' => -3.0,
  791. #lc('[email protected]') => -3.0,
  792. #lc('[email protected]') => -5.0,
  794. # soft-blacklisting (positive score)
  795. #'[email protected]' => 3.0,
  796. #'.example.net' => 1.0,
  798. },
  799. ], # end of site-wide tables
  800. });
  802. 1; # ensure a defined return
  804. ==> /etc/amavis/conf.d/25-amavis_helpers <==
  805. use strict;
  807. ##
  808. ## Functionality required for amavis helpers like
  809. ## amavis-release.
  810. ##
  812. # Enable required AM.PDP protocol socket.
  813. #
  814. # this is incompatible with the old helpers, but one can
  815. # have multiple inet (not unix) sockets to overcome this
  816. # issue. Refer to the amavisd-new documentation for more
  817. # information
  819. $unix_socketname = "/var/lib/amavis/amavisd.sock";
  821. $interface_policy{'SOCK'} = 'AM.PDP-SOCK';
  822. $policy_bank{'AM.PDP-SOCK'} = {
  823. protocol => 'AM.PDP',
  824. auth_required_release => 0, # don't require secret-id for release
  825. };
  827. 1; # ensure a defined return
  829. ==> /etc/amavis/conf.d/30-template_localization <==
  830. use strict;
  832. # l10n (localization) of the AMaViSd-new DSN templates
  833. # Override or change as necessary
  835. # Select notifications text encoding when Unicode-aware Perl is converting
  836. # text from internal character representation to external encoding (charset
  837. # in MIME terminology). Used as argument to Perl Encode::encode subroutine.
  838. #
  839. # to be used in RFC 2047-encoded header field bodies, e.g. in Subject:
  840. #$hdr_encoding = 'iso-8859-1'; # (default: 'iso-8859-1')
  841. #
  842. # to be used in notification body text: its encoding and Content-type.charset
  843. #$bdy_encoding = 'iso-8859-1'; # (default: 'iso-8859-1')
  845. # Default template texts for notifications may be overruled by directly
  846. # assigning new text to template variables, or by reading template text
  847. # from files. A second argument may be specified in a call to read_text(),
  848. # specifying character encoding layer to be used when reading from the
  849. # external file, e.g. 'utf8', 'iso-8859-1', or often just $bdy_encoding.
  850. # Text will be converted to internal character representation by Perl 5.8.0
  851. # or later; second argument is ignored otherwise. See PerlIO::encoding,
  852. # Encode::PerlIO and perluniintro man pages.
  853. #
  854. # $notify_sender_templ = read_text('/var/amavis/notify_sender.txt');
  855. # $notify_virus_sender_templ= read_text('/var/amavis/notify_virus_sender.txt');
  856. # $notify_virus_admin_templ = read_text('/var/amavis/notify_virus_admin.txt');
  857. # $notify_virus_recips_templ= read_text('/var/amavis/notify_virus_recips.txt');
  858. # $notify_spam_sender_templ = read_text('/var/amavis/notify_spam_sender.txt');
  859. # $notify_spam_admin_templ = read_text('/var/amavis/notify_spam_admin.txt');
  861. # If notification template files are collectively available in some directory,
  862. # you can use read_l10n_templates which calls read_text for each known
  863. # template. Name the files as above, and include a file named "charset" with
  864. # the charset used in the files. This is how Debian ships l10n templates.
  865. #
  866. # syntax: read_l10n_templates(<directory>); OR
  867. # read_l10n_templates(<subdirectory>, <master directory>);
  868. #
  869. read_l10n_templates('en_US', '/etc/amavis');
  871. 1; # ensure a defined return
  873. ==> /etc/amavis/conf.d/50-user <==
  874. use strict;
  876. #
  877. # Place your configuration directives here. They will override those in
  878. # earlier files.
  879. #
  880. # See /usr/share/doc/amavisd-new/ for documentation and examples of
  881. # the directives you can use in this file
  882. #
  884. @local_domains_acl = ( "localhost" );
  885. $log_level = 3;
  887. #------------ Do not modify anything below this line -------------
  888. 1; # ensure a defined return