Fixes #496 enabling all domains to get spam headers and spam checks (integration tests included)
This commit is contained in:
Thomas VIAL
parent
912cb5676b
commit
fd49396268
|
|
@ -77,7 +77,7 @@ COPY target/postfix/ldap-users.cf target/postfix/ldap-groups.cf target/postfix/l
|
|||
# Enables Spamassassin CRON updates
|
||||
RUN sed -i -r 's/^(CRON)=0/\1=1/g' /etc/default/spamassassin
|
||||
|
||||
#Enables Postgrey
|
||||
# Enables Postgrey
|
||||
COPY target/postgrey/postgrey /etc/default/postgrey
|
||||
COPY target/postgrey/postgrey.init /etc/init.d/postgrey
|
||||
RUN chmod 755 /etc/init.d/postgrey
|
||||
|
|
@ -85,7 +85,6 @@ RUN mkdir /var/run/postgrey
|
|||
RUN chown postgrey:postgrey /var/run/postgrey
|
||||
|
||||
# Enables Amavis
|
||||
RUN sed -i -r 's/#(@| \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_filter_mode
|
||||
RUN adduser clamav amavis && adduser amavis clamav
|
||||
RUN useradd -u 5000 -d /home/docker -s /bin/bash -p $(echo docker | openssl passwd -1 -stdin) docker
|
||||
RUN (echo "0 4 * * * /usr/local/bin/virus-wiper" ; crontab -l) | crontab -
|
||||
|
|
|
|||
5
Makefile
5
Makefile
|
|
@ -24,7 +24,7 @@ run:
|
|||
-v "`pwd`/test/onedir":/var/mail-state \
|
||||
-e ENABLE_CLAMAV=1 \
|
||||
-e ENABLE_SPAMASSASSIN=1 \
|
||||
-e SA_TAG=1.0 \
|
||||
-e SA_TAG=-5.0 \
|
||||
-e SA_TAG2=2.0 \
|
||||
-e SA_KILL=3.0 \
|
||||
-e VIRUSMAILS_DELETE_DELAY=7 \
|
||||
|
|
@ -150,7 +150,8 @@ fixtures:
|
|||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-external.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-local.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-alias-recipient-delimiter.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user1.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user2.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-user-and-cc-local-alias.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-external.txt"
|
||||
docker exec mail /bin/sh -c "nc 0.0.0.0 25 < /tmp/docker-mailserver-test/email-templates/existing-regexp-alias-local.txt"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,21 @@
|
|||
$Id: README.l10n 742 2005-12-26 17:15:22Z hmh $
|
||||
|
||||
First of all, read /usr/share/doc/amavisd-new/README.customize.gz
|
||||
|
||||
Amavisd-new is UTF8-aware, and it will do character-set conversion when dealing
|
||||
with DSN templates. The full unicode codespace is available, if used with the
|
||||
proper encodings... and you have to use the proper encodings if you don't want
|
||||
your DSNs to be flagged as more charset-challenged SPAM by other systems.
|
||||
|
||||
ALWAYS respect the charset when adding l10n files.
|
||||
|
||||
Amavisd-new does charset conversion twice: one when reading the text files with
|
||||
localized templates (to internal perl UTF8), and another when writing the email
|
||||
notification (from internal perl UTF8 to $hdr_encoding and $bdy_encoding).
|
||||
|
||||
Headers will be RFC2047-encoded if they have any codepoints not allowed by
|
||||
RFC2822 after the charset conversions. The body text charset encoding is
|
||||
inserted in the proper MIME header.
|
||||
|
||||
More details are available in /usr/share/doc/amavisd-new/RELEASE_NOTES.gz
|
||||
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
use strict;
|
||||
|
||||
# ADMINISTRATORS:
|
||||
# Debian suggests that any changes you need to do that should never
|
||||
# be "updated" by the Debian package should be made in another file,
|
||||
# overriding the settings in this file.
|
||||
#
|
||||
# The package will *not* overwrite your settings, but by keeping
|
||||
# them separate, you will make the task of merging changes on these
|
||||
# configuration files much simpler...
|
||||
|
||||
# see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
|
||||
# a list of all variables with their defaults;
|
||||
# see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
|
||||
# a traditional-style commented file
|
||||
# [note: the above files were not converted to Debian settings!]
|
||||
#
|
||||
# for more details see documentation in /usr/share/doc/amavisd-new
|
||||
# and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
|
||||
|
||||
|
||||
# SETTINGS RARELY MODIFIED BY THE LOCAL ADMIN
|
||||
|
||||
$ENV{PATH} = $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
|
||||
$file = 'file';
|
||||
$gzip = 'gzip';
|
||||
$bzip2 = 'bzip2';
|
||||
$lzop = 'lzop';
|
||||
$rpm2cpio = ['rpm2cpio.pl','rpm2cpio'];
|
||||
$cabextract = 'cabextract';
|
||||
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
|
||||
#$unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat']; #disabled (non-free, no security support)
|
||||
$unfreeze = undef;
|
||||
$arc = ['nomarch', 'arc'];
|
||||
$unarj = ['arj', 'unarj'];
|
||||
#$unrar = ['rar', 'unrar']; #disabled (non-free, no security support)
|
||||
$unrar = ['unrar-free'];
|
||||
$zoo = 'zoo';
|
||||
$lha = 'lha';
|
||||
$lha = undef;
|
||||
$pax = 'pax';
|
||||
$cpio = 'cpio';
|
||||
$ar = 'ar';
|
||||
$ripole = 'ripole';
|
||||
$dspam = 'dspam';
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
use strict;
|
||||
|
||||
# $mydomain is used just for convenience in the config files and it is not
|
||||
# used internally by amavisd-new except in the default X_HEADER_LINE (which
|
||||
# Debian overrides by default anyway).
|
||||
|
||||
chomp($mydomain = `head -n 1 /etc/mailname`);
|
||||
|
||||
# amavisd-new needs to know which email domains are to be considered local
|
||||
# to the administrative domain. Only emails to "local" domains are subject
|
||||
# to certain functionality, such as the addition of spam tags.
|
||||
#
|
||||
# Default local domains to $mydomain and all subdomains. Remember to
|
||||
# override or redefine this if $mydomain is changed later in the config
|
||||
# sequence.
|
||||
|
||||
@local_domains_acl = ( ".$mydomain" );
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
use strict;
|
||||
|
||||
# $myhostname is used by amavisd-new for node identification, and it is
|
||||
# important to get it right (e.g. for ESMTP EHLO, loop detection, and so on).
|
||||
|
||||
chomp($myhostname = `hostname --fqdn`);
|
||||
|
||||
# To manually set $myhostname, edit the following line with the correct Fully
|
||||
# Qualified Domain Name (FQDN) and remove the # at the beginning of the line.
|
||||
#
|
||||
$myhostname = "mail.my-domain.com";
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,473 @@
|
|||
use strict;
|
||||
|
||||
##
|
||||
## AV Scanners (Debian version)
|
||||
##
|
||||
|
||||
@av_scanners = (
|
||||
|
||||
# ### http://www.clanfield.info/sophie/ (http://www.vanja.com/tools/sophie/)
|
||||
# ['Sophie',
|
||||
# \&ask_daemon, ["{}/\n", '/var/run/sophie'],
|
||||
# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
|
||||
# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
|
||||
|
||||
# ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
|
||||
# ['Sophos SAVI', \&sophos_savi ],
|
||||
|
||||
### http://www.clamav.net/
|
||||
['ClamAV-clamd',
|
||||
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
|
||||
qr/\bOK$/m, qr/\bFOUND$/m,
|
||||
qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
||||
# NOTE: run clamd under the same user as amavisd, or run it under its own
|
||||
# uid such as clamav, add user clamav to the amavis group, and then add
|
||||
# AllowSupplementaryGroups to clamd.conf;
|
||||
# NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
|
||||
# this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
|
||||
|
||||
# ### http://www.openantivirus.org/
|
||||
# ['OpenAntiVirus ScannerDaemon (OAV)',
|
||||
# \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
|
||||
# qr/^OK/m, qr/^FOUND: /m, qr/^FOUND: (.+)/m ],
|
||||
|
||||
# ### http://www.vanja.com/tools/trophie/
|
||||
# ['Trophie',
|
||||
# \&ask_daemon, ["{}/\n", '/var/run/trophie'],
|
||||
# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
|
||||
# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
|
||||
|
||||
# ### http://www.grisoft.com/
|
||||
# ['AVG Anti-Virus',
|
||||
# \&ask_daemon, ["SCAN {}\n", '127.0.0.1:55555'],
|
||||
# qr/^200/m, qr/^403/m, qr/^403 .*?: ([^\r\n]+)/m ],
|
||||
|
||||
# ### http://www.f-prot.com/
|
||||
# ['F-Prot fpscand', # F-PROT Antivirus for BSD/Linux/Solaris, version 6
|
||||
# \&ask_daemon,
|
||||
# ["SCAN FILE {}/*\n", '127.0.0.1:10200'],
|
||||
# qr/^(0|8|64) /m,
|
||||
# qr/^([1235679]|1[01345]) |<[^>:]*(?i)(infected|suspicious|unwanted)/m,
|
||||
# qr/(?i)<[^>:]*(?:infected|suspicious|unwanted)[^>:]*: ([^>]*)>/m ],
|
||||
|
||||
# ### http://www.f-prot.com/
|
||||
# ['F-Prot f-protd', # old version
|
||||
# \&ask_daemon,
|
||||
# ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n",
|
||||
# ['127.0.0.1:10200', '127.0.0.1:10201', '127.0.0.1:10202',
|
||||
# '127.0.0.1:10203', '127.0.0.1:10204'] ],
|
||||
# qr/(?i)<summary[^>]*>clean<\/summary>/m,
|
||||
# qr/(?i)<summary[^>]*>infected<\/summary>/m,
|
||||
# qr/(?i)<name>(.+)<\/name>/m ],
|
||||
|
||||
# ### http://www.sald.com/, http://www.dials.ru/english/, http://www.drweb.ru/
|
||||
# ['DrWebD', \&ask_daemon, # DrWebD 4.31 or later
|
||||
# [pack('N',1). # DRWEBD_SCAN_CMD
|
||||
# pack('N',0x00280001). # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES
|
||||
# pack('N', # path length
|
||||
# length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
|
||||
# '{}/*'. # path
|
||||
# pack('N',0). # content size
|
||||
# pack('N',0),
|
||||
# '/var/drweb/run/drwebd.sock',
|
||||
# # '/var/amavis/var/run/drwebd.sock', # suitable for chroot
|
||||
# # '/usr/local/drweb/run/drwebd.sock', # FreeBSD drweb ports default
|
||||
# # '127.0.0.1:3000', # or over an inet socket
|
||||
# ],
|
||||
# qr/\A\x00[\x10\x11][\x00\x10]\x00/sm, # IS_CLEAN,EVAL_KEY; SKIPPED
|
||||
# qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/sm,# KNOWN_V,UNKNOWN_V,V._MODIF
|
||||
# qr/\A.{12}(?:infected with )?([^\x00]+)\x00/sm,
|
||||
# ],
|
||||
# # NOTE: If using amavis-milter, change length to:
|
||||
# # length("$TEMPBASE/amavis-milter-xxxxxxxxxxxxxx/parts/pxxx").
|
||||
|
||||
### http://www.kaspersky.com/ (kav4mailservers)
|
||||
['KasperskyLab AVP - aveclient',
|
||||
['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
|
||||
'/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
|
||||
'-p /var/run/aveserver -s {}/*',
|
||||
[0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
|
||||
qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
|
||||
],
|
||||
# NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
|
||||
# currupted or protected archives are to be handled
|
||||
|
||||
### http://www.kaspersky.com/
|
||||
['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'],
|
||||
'-* -P -B -Y -O- {}', [0,3,6,8], [2,4], # any use for -A -K ?
|
||||
qr/infected: (.+)/m,
|
||||
sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
|
||||
sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
|
||||
],
|
||||
|
||||
### The kavdaemon and AVPDaemonClient have been removed from Kasperky
|
||||
### products and replaced by aveserver and aveclient
|
||||
['KasperskyLab AVPDaemonClient',
|
||||
[ '/opt/AVP/kavdaemon', 'kavdaemon',
|
||||
'/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
|
||||
'/opt/AVP/AvpTeamDream', 'AvpTeamDream',
|
||||
'/opt/AVP/avpdc', 'avpdc' ],
|
||||
"-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/m ],
|
||||
# change the startup-script in /etc/init.d/kavd to:
|
||||
# DPARMS="-* -Y -dl -f=/var/amavis /var/amavis"
|
||||
# (or perhaps: DPARMS="-I0 -Y -* /var/amavis" )
|
||||
# adjusting /var/amavis above to match your $TEMPBASE.
|
||||
# The '-f=/var/amavis' is needed if not running it as root, so it
|
||||
# can find, read, and write its pid file, etc., see 'man kavdaemon'.
|
||||
# defUnix.prf: there must be an entry "*/var/amavis" (or whatever
|
||||
# directory $TEMPBASE specifies) in the 'Names=' section.
|
||||
# cd /opt/AVP/DaemonClients; configure; cd Sample; make
|
||||
# cp AvpDaemonClient /opt/AVP/
|
||||
# su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}"
|
||||
|
||||
### http://www.centralcommand.com/
|
||||
['CentralCommand Vexira (new) vascan',
|
||||
['vascan','/usr/lib/Vexira/vascan'],
|
||||
"-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ".
|
||||
"--log=/var/log/vascan.log {}",
|
||||
[0,3], [1,2,5],
|
||||
qr/(?x)^\s* (?:virus|iworm|macro|mutant|sequence|trojan)\ found:\ ( [^\]\s']+ )\ \.\.\.\ /m ],
|
||||
# Adjust the path of the binary and the virus database as needed.
|
||||
# 'vascan' does not allow to have the temp directory to be the same as
|
||||
# the quarantine directory, and the quarantine option can not be disabled.
|
||||
# If $QUARANTINEDIR is not used, then another directory must be specified
|
||||
# to appease 'vascan'. Move status 3 to the second list if password
|
||||
# protected files are to be considered infected.
|
||||
|
||||
### http://www.avira.com/
|
||||
### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus
|
||||
['Avira AntiVir', ['antivir','vexira'],
|
||||
'--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/m,
|
||||
qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
|
||||
(?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/m ],
|
||||
# NOTE: if you only have a demo version, remove -z and add 214, as in:
|
||||
# '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
|
||||
|
||||
### http://www.commandsoftware.com/
|
||||
['Command AntiVirus for Linux', 'csav',
|
||||
'-all -archive -packed {}', [50], [51,52,53],
|
||||
qr/Infection: (.+)/m ],
|
||||
|
||||
### http://www.symantec.com/
|
||||
['Symantec CarrierScan via Symantec CommandLineScanner',
|
||||
'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
|
||||
qr/^Files Infected:\s+0$/m, qr/^Infected\b/m,
|
||||
qr/^(?:Info|Virus Name):\s+(.+)/m ],
|
||||
|
||||
### http://www.symantec.com/
|
||||
['Symantec AntiVirus Scan Engine',
|
||||
'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}',
|
||||
[0], qr/^Infected\b/m,
|
||||
qr/^(?:Info|Virus Name):\s+(.+)/m ],
|
||||
# NOTE: check options and patterns to see which entry better applies
|
||||
|
||||
# ### http://www.f-secure.com/products/anti-virus/ version 4.65
|
||||
# ['F-Secure Antivirus for Linux servers',
|
||||
# ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
|
||||
# '--delete=no --disinf=no --rename=no --archive=yes --auto=yes '.
|
||||
# '--dumb=yes --list=no --mime=yes {}', [0], [3,6,8],
|
||||
# qr/(?:infection|Infected|Suspected): (.+)/m ],
|
||||
|
||||
### http://www.f-secure.com/products/anti-virus/ version 5.52
|
||||
['F-Secure Antivirus for Linux servers',
|
||||
['/opt/f-secure/fsav/bin/fsav', 'fsav'],
|
||||
'--virus-action1=report --archive=yes --auto=yes '.
|
||||
'--dumb=yes --list=no --mime=yes {}', [0], [3,4,6,8],
|
||||
qr/(?:infection|Infected|Suspected|Riskware): (.+)/m ],
|
||||
# NOTE: internal archive handling may be switched off by '--archive=no'
|
||||
# to prevent fsav from exiting with status 9 on broken archives
|
||||
|
||||
# ### http://www.avast.com/
|
||||
# ['avast! Antivirus daemon',
|
||||
# \&ask_daemon, # greets with 220, terminate with QUIT
|
||||
# ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'],
|
||||
# qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
|
||||
|
||||
# ### http://www.avast.com/
|
||||
# ['avast! Antivirus - Client/Server Version', 'avastlite',
|
||||
# '-a /var/run/avast4/mailscanner.sock -n {}', [0], [1],
|
||||
# qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
|
||||
|
||||
['CAI InoculateIT', 'inocucmd', # retired product
|
||||
'-sec -nex {}', [0], [100],
|
||||
qr/was infected by virus (.+)/m ],
|
||||
# see: http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html
|
||||
|
||||
### http://www3.ca.com/Solutions/Product.asp?ID=156 (ex InoculateIT)
|
||||
['CAI eTrust Antivirus', 'etrust-wrapper',
|
||||
'-arc -nex -spm h {}', [0], [101],
|
||||
qr/is infected by virus: (.+)/m ],
|
||||
# NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer
|
||||
# see http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783
|
||||
|
||||
### http://mks.com.pl/english.html
|
||||
['MkS_Vir for Linux (beta)', ['mks32','mks'],
|
||||
'-s {}/*', [0], [1,2],
|
||||
qr/--[ \t]*(.+)/m ],
|
||||
|
||||
### http://mks.com.pl/english.html
|
||||
['MkS_Vir daemon', 'mksscan',
|
||||
'-s -q {}', [0], [1..7],
|
||||
qr/^... (\S+)/m ],
|
||||
|
||||
# ### http://www.nod32.com/, version v2.52 (old)
|
||||
# ['ESET NOD32 for Linux Mail servers',
|
||||
# ['/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
|
||||
# '--subdir --files -z --sfx --rtp --adware --unsafe --pattern --heur '.
|
||||
# '-w -a --action-on-infected=accept --action-on-uncleanable=accept '.
|
||||
# '--action-on-notscanned=accept {}',
|
||||
# [0,3], [1,2], qr/virus="([^"]+)"/m ],
|
||||
|
||||
# ### http://www.eset.com/, version v2.7 (old)
|
||||
# ['ESET NOD32 Linux Mail Server - command line interface',
|
||||
# ['/usr/bin/nod32cli', '/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
|
||||
# '--subdir {}', [0,3], [1,2], qr/virus="([^"]+)"/m ],
|
||||
|
||||
# ### http://www.eset.com/, version 2.71.12
|
||||
# ['ESET Software ESETS Command Line Interface',
|
||||
# ['/usr/bin/esets_cli', 'esets_cli'],
|
||||
# '--subdir {}', [0], [1,2,3], qr/virus="([^"]+)"/m ],
|
||||
|
||||
### http://www.eset.com/, version 3.0
|
||||
['ESET Software ESETS Command Line Interface',
|
||||
['/usr/bin/esets_cli', 'esets_cli'],
|
||||
'--subdir {}', [0], [2,3],
|
||||
qr/:\s*action="(?!accepted)[^"]*"\n.*:\s*virus="([^"]*)"/m ],
|
||||
|
||||
## http://www.nod32.com/, NOD32LFS version 2.5 and above
|
||||
['ESET NOD32 for Linux File servers',
|
||||
['/opt/eset/nod32/sbin/nod32','nod32'],
|
||||
'--files -z --mail --sfx --rtp --adware --unsafe --pattern --heur '.
|
||||
'-w -a --action=1 -b {}',
|
||||
[0], [1,10], qr/^object=.*, virus="(.*?)",/m ],
|
||||
|
||||
# Experimental, based on posting from Rado Dibarbora (Dibo) on 2002-05-31
|
||||
# ['ESET Software NOD32 Client/Server (NOD32SS)',
|
||||
# \&ask_daemon2, # greets with 200, persistent, terminate with QUIT
|
||||
# ["SCAN {}/*\r\n", '127.0.0.1:8448' ],
|
||||
# qr/^200 File OK/m, qr/^201 /m, qr/^201 (.+)/m ],
|
||||
|
||||
### http://www.norman.com/products_nvc.shtml
|
||||
['Norman Virus Control v5 / Linux', 'nvcc',
|
||||
'-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14],
|
||||
qr/(?i).* virus in .* -> \'(.+)\'/m ],
|
||||
|
||||
### http://www.pandasoftware.com/
|
||||
['Panda CommandLineSecure 9 for Linux',
|
||||
['/opt/pavcl/usr/bin/pavcl','pavcl'],
|
||||
'-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}',
|
||||
qr/Number of files infected[ .]*: 0+(?!\d)/m,
|
||||
qr/Number of files infected[ .]*: 0*[1-9]/m,
|
||||
qr/Found virus :\s*(\S+)/m ],
|
||||
# NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr'
|
||||
# before starting amavisd - the bases are then loaded only once at startup.
|
||||
# To reload bases in a signature update script:
|
||||
# /opt/pavcl/usr/bin/pavcl -tsr -ulr; /opt/pavcl/usr/bin/pavcl -tsr
|
||||
# Please review other options of pavcl, for example:
|
||||
# -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies
|
||||
|
||||
# ### http://www.pandasoftware.com/
|
||||
# ['Panda Antivirus for Linux', ['pavcl'],
|
||||
# '-TSR -aut -aex -heu -cmp -nbr -nor -nso -eng {}',
|
||||
# [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0],
|
||||
# qr/Found virus :\s*(\S+)/m ],
|
||||
|
||||
# GeCAD AV technology is acquired by Microsoft; RAV has been discontinued.
|
||||
# Check your RAV license terms before fiddling with the following two lines!
|
||||
# ['GeCAD RAV AntiVirus 8', 'ravav',
|
||||
# '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/m ],
|
||||
# # NOTE: the command line switches changed with scan engine 8.5 !
|
||||
# # (btw, assigning stdin to /dev/null causes RAV to fail)
|
||||
|
||||
### http://www.nai.com/
|
||||
['NAI McAfee AntiVirus (uvscan)', 'uvscan',
|
||||
'--secure -rv --mime --summary --noboot - {}', [0], [13],
|
||||
qr/(?x) Found (?:
|
||||
\ the\ (.+)\ (?:virus|trojan) |
|
||||
\ (?:virus|trojan)\ or\ variant\ ([^ ]+) |
|
||||
:\ (.+)\ NOT\ a\ virus)/m,
|
||||
# sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
|
||||
# sub {delete $ENV{LD_PRELOAD}},
|
||||
],
|
||||
# NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before
|
||||
# anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6
|
||||
# and then clear it when finished to avoid confusing anything else.
|
||||
# NOTE2: to treat encrypted files as viruses replace the [13] with:
|
||||
# qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/
|
||||
|
||||
### http://www.virusbuster.hu/en/
|
||||
['VirusBuster', ['vbuster', 'vbengcl'],
|
||||
"{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
|
||||
qr/: '(.*)' - Virus/m ],
|
||||
# VirusBuster Ltd. does not support the daemon version for the workstation
|
||||
# engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of
|
||||
# binaries, some parameters AND return codes have changed (from 3 to 1).
|
||||
# See also the new Vexira entry 'vascan' which is possibly related.
|
||||
|
||||
# ### http://www.virusbuster.hu/en/
|
||||
# ['VirusBuster (Client + Daemon)', 'vbengd',
|
||||
# '-f -log scandir {}', [0], [3],
|
||||
# qr/Virus found = (.*);/m ],
|
||||
# # HINT: for an infected file it always returns 3,
|
||||
# # although the man-page tells a different story
|
||||
|
||||
### http://www.cyber.com/
|
||||
['CyberSoft VFind', 'vfind',
|
||||
'--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/m,
|
||||
# sub {$ENV{VSTK_HOME}='/usr/lib/vstk'},
|
||||
],
|
||||
|
||||
### http://www.avast.com/
|
||||
['avast! Antivirus', ['/usr/bin/avastcmd','avastcmd'],
|
||||
'-a -i -n -t=A {}', [0], [1], qr/\binfected by:\s+([^ \t\n\[\]]+)/m ],
|
||||
|
||||
### http://www.ikarus-software.com/
|
||||
['Ikarus AntiVirus for Linux', 'ikarus',
|
||||
'{}', [0], [40], qr/Signature (.+) found/m ],
|
||||
|
||||
### http://www.bitdefender.com/
|
||||
['BitDefender', 'bdscan', # new version
|
||||
'--action=ignore --no-list {}', qr/^Infected files *:0+(?!\d)/m,
|
||||
qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
|
||||
qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
|
||||
|
||||
### http://www.bitdefender.com/
|
||||
['BitDefender', 'bdc', # old version
|
||||
'--arc --mail {}', qr/^Infected files *:0+(?!\d)/m,
|
||||
qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
|
||||
qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
|
||||
# consider also: --all --nowarn --alev=15 --flev=15. The --all argument may
|
||||
# not apply to your version of bdc, check documentation and see 'bdc --help'
|
||||
|
||||
### ArcaVir for Linux and Unix http://www.arcabit.pl/
|
||||
['ArcaVir for Linux', ['arcacmd','arcacmd.static'],
|
||||
'-v 1 -summary 0 -s {}', [0], [1,2],
|
||||
qr/(?:VIR|WIR):[ \t]*(.+)/m ],
|
||||
|
||||
# ['File::Scan', sub {Amavis::AV::ask_av(sub{
|
||||
# use File::Scan; my($fn)=@_;
|
||||
# my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0);
|
||||
# my($vname) = $f->scan($fn);
|
||||
# $f->error ? (2,"Error: ".$f->error)
|
||||
# : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) },
|
||||
# ["{}/*"], [0], [1], qr/^(.*) FOUND$/m ],
|
||||
|
||||
# ### fully-fledged checker for JPEG marker segments of invalid length
|
||||
# ['check-jpeg',
|
||||
# sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) },
|
||||
# ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
|
||||
# # NOTE: place file JpegTester.pm somewhere where Perl can find it,
|
||||
# # for example in /usr/local/lib/perl5/site_perl
|
||||
|
||||
# ### example: simpleminded checker for JPEG marker segments with
|
||||
# ### invalid length (only checks first 32k, which is not thorough enough)
|
||||
# ['check-jpeg-simple',
|
||||
# sub { Amavis::AV::ask_av(sub {
|
||||
# my($f)=@_; local(*FF,$_,$1,$2); my(@r)=(0,'not jpeg');
|
||||
# open(FF,$f) or die "jpeg: open err $f: $!";
|
||||
# binmode(FF) or die "jpeg: binmode err $f: $!";
|
||||
# defined read(FF,$_,32000) or die "jpeg: read err $f: $!";
|
||||
# close(FF) or die "jpeg: close err $f: $!";
|
||||
# if (/^\xff\xd8\xff/) {
|
||||
# @r=(0,'jpeg ok');
|
||||
# while (!/\G(?:\xff\xd9|\z)/gc) { # EOI or eof
|
||||
# if (/\G\xff+(?=\xff|\z)/gc) {} # fill-bytes before marker
|
||||
# elsif (/\G\xff([\x01\xd0-\xd8])/gc) {} # TEM, RSTi, SOI
|
||||
# elsif (/\G\xff([^\x00\xff])(..)/gcs) { # marker segment start
|
||||
# my($n)=unpack("n",$2)-2;
|
||||
# $n=32766 if $n>32766; # Perl regexp limit
|
||||
# if ($n<0) {@r=(1,"bad jpeg: len=$n, pos=".pos); last}
|
||||
# elsif (/\G.{$n}/gcs) {} # ok
|
||||
# elsif (/\G.{0,$n}\z/gcs) {last} # truncated
|
||||
# else {@r=(1,"bad jpeg: unexpected, pos=".pos); last}
|
||||
# }
|
||||
# elsif (/\G[^\xff]+/gc) {} # ECS
|
||||
# elsif (/\G(?:\xff\x00)+/gc) {} # ECS
|
||||
# else {@r=(2,"bad jpeg: unexpected char, pos=".pos); last}
|
||||
# }
|
||||
# }; @r}, @_) },
|
||||
# ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
|
||||
|
||||
# ### an example/testing/template virus scanner (external), wastes 3 seconds
|
||||
# ['wasteful sleeper example',
|
||||
# '/bin/sleep', '3', # calls external program
|
||||
# undef, undef, qr/no such/m ],
|
||||
|
||||
# ### an example/testing/template virus scanner (internal), does nothing
|
||||
# ['null',
|
||||
# sub {}, ["{}"], # supplies its own subroutine, no external program
|
||||
# undef, undef, qr/no such/m ],
|
||||
|
||||
);
|
||||
|
||||
|
||||
# If no virus scanners from the @av_scanners list produce 'clean' nor
|
||||
# 'infected' status (i.e. they all fail to run or the list is empty),
|
||||
# then _all_ scanners from the @av_scanners_backup list are tried
|
||||
# (again, subject to $first_infected_stops_scan). When there are both
|
||||
# daemonized and equivalent or similar command-line scanners available,
|
||||
# it is customary to place slower command-line scanners in the
|
||||
# @av_scanners_backup list. The default choice is somewhat arbitrary,
|
||||
# move entries from one list to another as desired, keeping main scanners
|
||||
# in the primary list to avoid warnings.
|
||||
|
||||
@av_scanners_backup = (
|
||||
|
||||
### http://www.clamav.net/ - backs up clamd or Mail::ClamAV
|
||||
['ClamAV-clamscan', 'clamscan',
|
||||
"--stdout --no-summary -r --tempdir=$TEMPBASE {}",
|
||||
[0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
||||
|
||||
### http://www.f-prot.com/ - backs up F-Prot Daemon, V6
|
||||
['F-PROT Antivirus for UNIX', ['fpscan'],
|
||||
'--report --mount --adware {}', # consider: --applications -s 4 -u 3 -z 10
|
||||
[0,8,64], [1,2,3, 4+1,4+2,4+3, 8+1,8+2,8+3, 12+1,12+2,12+3],
|
||||
qr/^\[Found\s+[^\]]*\]\s+<([^ \t(>]*)/m ],
|
||||
|
||||
### http://www.f-prot.com/ - backs up F-Prot Daemon (old)
|
||||
['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
|
||||
'-dumb -archive -packed {}', [0,8], [3,6], # or: [0], [3,6,8],
|
||||
qr/(?:Infection:|security risk named) (.+)|\s+contains\s+(.+)$/m ],
|
||||
|
||||
### http://www.trendmicro.com/ - backs up Trophie
|
||||
['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
|
||||
'-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ],
|
||||
|
||||
### http://www.sald.com/, http://drweb.imshop.de/ - backs up DrWebD
|
||||
['drweb - DrWeb Antivirus', # security LHA hole in Dr.Web 4.33 and earlier
|
||||
['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
|
||||
'-path={} -al -go -ot -cn -upn -ok-',
|
||||
[0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'m ],
|
||||
|
||||
### http://www.kaspersky.com/
|
||||
['Kaspersky Antivirus v5.5',
|
||||
['/opt/kaspersky/kav4fs/bin/kav4fs-kavscanner',
|
||||
'/opt/kav/5.5/kav4unix/bin/kavscanner',
|
||||
'/opt/kav/5.5/kav4mailservers/bin/kavscanner', 'kavscanner'],
|
||||
'-i0 -xn -xp -mn -R -ePASBME {}/*', [0,10,15], [5,20,21,25],
|
||||
qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.*)/m,
|
||||
# sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"},
|
||||
# sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
|
||||
],
|
||||
|
||||
# Commented out because the name 'sweep' clashes with Debian and FreeBSD
|
||||
# package/port of an audio editor. Make sure the correct 'sweep' is found
|
||||
# in the path when enabling.
|
||||
#
|
||||
# ### http://www.sophos.com/ - backs up Sophie or SAVI-Perl
|
||||
# ['Sophos Anti Virus (sweep)', 'sweep',
|
||||
# '-nb -f -all -rec -ss -sc -archive -cab -mime -oe -tnef '.
|
||||
# '--no-reset-atime {}',
|
||||
# [0,2], qr/Virus .*? found/m,
|
||||
# qr/^>>> Virus(?: fragment)? '?(.*?)'? found/m,
|
||||
# ],
|
||||
# # other options to consider: -idedir=/usr/local/sav
|
||||
|
||||
# Always succeeds and considers mail clean.
|
||||
# Potentially useful when all other scanners fail and it is desirable
|
||||
# to let mail continue to flow with no virus checking (when uncommented).
|
||||
# ['always-clean', sub {0}],
|
||||
|
||||
);
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
use strict;
|
||||
|
||||
# You can modify this file to re-enable SPAM checking through spamassassin
|
||||
# and to re-enable antivirus checking.
|
||||
|
||||
#
|
||||
# Default antivirus checking mode
|
||||
# Please note, that anti-virus checking is DISABLED by
|
||||
# default.
|
||||
# If You wish to enable it, please uncomment the following lines:
|
||||
|
||||
|
||||
@bypass_virus_checks_maps = (
|
||||
\%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
|
||||
|
||||
|
||||
#
|
||||
# Default SPAM checking mode
|
||||
# Please note, that anti-spam checking is DISABLED by
|
||||
# default.
|
||||
# If You wish to enable it, please uncomment the following lines:
|
||||
|
||||
|
||||
@bypass_spam_checks_maps = (
|
||||
\%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,212 @@
|
|||
use strict;
|
||||
|
||||
# ADMINISTRATORS:
|
||||
# Debian suggests that any changes you need to do that should never
|
||||
# be "updated" by the Debian package should be made in another file,
|
||||
# overriding the settings in this file.
|
||||
#
|
||||
# The package will *not* overwrite your settings, but by keeping
|
||||
# them separate, you will make the task of merging changes on these
|
||||
# configuration files much simpler...
|
||||
|
||||
# see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
|
||||
# a list of all variables with their defaults;
|
||||
# see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
|
||||
# a traditional-style commented file
|
||||
# [note: the above files were not converted to Debian settings!]
|
||||
#
|
||||
# for more details see documentation in /usr/share/doc/amavisd-new
|
||||
# and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
|
||||
|
||||
$QUARANTINEDIR = "$MYHOME/virusmails";
|
||||
$quarantine_subdir_levels = 1; # enable quarantine dir hashing
|
||||
|
||||
$log_recip_templ = undef; # disable by-recipient level-0 log entries
|
||||
$DO_SYSLOG = 1; # log via syslogd (preferred)
|
||||
$syslog_ident = 'amavis'; # syslog ident tag, prepended to all messages
|
||||
$syslog_facility = 'mail';
|
||||
$syslog_priority = 'debug'; # switch to info to drop debug output, etc
|
||||
|
||||
$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
|
||||
$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
|
||||
|
||||
$inet_socket_port = 10024; # default listening socket
|
||||
|
||||
$sa_spam_subject_tag = '***SPAM*** ';
|
||||
$sa_tag_level_deflt = 1.0; # add spam info headers if at, or above that level
|
||||
$sa_tag2_level_deflt = 2.0; # add 'spam detected' headers at that level
|
||||
$sa_kill_level_deflt = 3.0; # triggers spam evasive actions
|
||||
$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
|
||||
|
||||
$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
|
||||
$sa_local_tests_only = 0; # only tests which do not require internet access?
|
||||
|
||||
# Quota limits to avoid bombs (like 42.zip)
|
||||
|
||||
$MAXLEVELS = 14;
|
||||
$MAXFILES = 1500;
|
||||
$MIN_EXPANSION_QUOTA = 100*1024; # bytes
|
||||
$MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes
|
||||
|
||||
# You should:
|
||||
# Use D_DISCARD to discard data (viruses)
|
||||
# Use D_BOUNCE to generate local bounces by amavisd-new
|
||||
# Use D_REJECT to generate local or remote bounces by the calling MTA
|
||||
# Use D_PASS to deliver the message
|
||||
#
|
||||
# Whatever you do, *NEVER* use D_REJECT if you have other MTAs *forwarding*
|
||||
# mail to your account. Use D_BOUNCE instead, otherwise you are delegating
|
||||
# the bounce work to your friendly forwarders, which might not like it at all.
|
||||
#
|
||||
# On dual-MTA setups, one can often D_REJECT, as this just makes your own
|
||||
# MTA generate the bounce message. Test it first.
|
||||
#
|
||||
# Bouncing viruses is stupid, always discard them after you are sure the AV
|
||||
# is working correctly. Bouncing real SPAM is also useless, if you cannot
|
||||
# D_REJECT it (and don't D_REJECT mail coming from your forwarders!).
|
||||
|
||||
$final_virus_destiny = D_DISCARD; # (data not lost, see virus quarantine)
|
||||
$final_banned_destiny = D_BOUNCE; # D_REJECT when front-end MTA
|
||||
$final_spam_destiny = D_BOUNCE;
|
||||
$final_bad_header_destiny = D_PASS; # False-positive prone (for spam)
|
||||
|
||||
$enable_dkim_verification = 0; #disabled to prevent warning
|
||||
|
||||
$virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default
|
||||
|
||||
# Set to empty ("") to add no header
|
||||
$X_HEADER_LINE = "Debian $myproduct_name at $mydomain";
|
||||
|
||||
# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
|
||||
|
||||
#
|
||||
# DO NOT SEND VIRUS NOTIFICATIONS TO OUTSIDE OF YOUR DOMAIN. EVER.
|
||||
#
|
||||
# These days, almost all viruses fake the envelope sender and mail headers.
|
||||
# Therefore, "virus notifications" became nothing but undesired, aggravating
|
||||
# SPAM. This holds true even inside one's domain. We disable them all by
|
||||
# default, except for the EICAR test pattern.
|
||||
#
|
||||
|
||||
@viruses_that_fake_sender_maps = (new_RE(
|
||||
[qr'\bEICAR\b'i => 0], # av test pattern name
|
||||
[qr/.*/ => 1], # true for everything else
|
||||
));
|
||||
|
||||
@keep_decoded_original_maps = (new_RE(
|
||||
# qr'^MAIL$', # retain full original message for virus checking (can be slow)
|
||||
qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
|
||||
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
|
||||
# qr'^Zip archive data', # don't trust Archive::Zip
|
||||
));
|
||||
|
||||
|
||||
# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample
|
||||
|
||||
$banned_filename_re = new_RE(
|
||||
# qr'^UNDECIPHERABLE$', # is or contains any undecipherable components
|
||||
|
||||
# block certain double extensions anywhere in the base name
|
||||
qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
|
||||
|
||||
qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?$'i, # Windows Class ID CLSID, strict
|
||||
|
||||
qr'^application/x-msdownload$'i, # block these MIME types
|
||||
qr'^application/x-msdos-program$'i,
|
||||
qr'^application/hta$'i,
|
||||
|
||||
# qr'^application/x-msmetafile$'i, # Windows Metafile MIME type
|
||||
# qr'^\.wmf$', # Windows Metafile file(1) type
|
||||
|
||||
# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
|
||||
|
||||
# [ qr'^\.(Z|gz|bz2)$' => 0 ], # allow any in Unix-compressed
|
||||
# [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
|
||||
# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within such archives
|
||||
# [ qr'^application/x-zip-compressed$'i => 0], # allow any within such archives
|
||||
|
||||
qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic
|
||||
# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
|
||||
# inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
|
||||
# ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
|
||||
# wmf|wsc|wsf|wsh)$'ix, # banned ext - long
|
||||
|
||||
# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
|
||||
|
||||
qr'^\.(exe-ms)$', # banned file(1) types
|
||||
# qr'^\.(exe|lha|tnef|cab|dll)$', # banned file(1) types
|
||||
);
|
||||
# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
|
||||
# and http://www.cknow.com/vtutor/vtextensions.htm
|
||||
|
||||
|
||||
# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
|
||||
|
||||
@score_sender_maps = ({ # a by-recipient hash lookup table,
|
||||
# results from all matching recipient tables are summed
|
||||
|
||||
# ## per-recipient personal tables (NOTE: positive: black, negative: white)
|
||||
# 'user1@example.com' => [{'bla-mobile.press@example.com' => 10.0}],
|
||||
# 'user3@example.com' => [{'.ebay.com' => -3.0}],
|
||||
# 'user4@example.com' => [{'cleargreen@cleargreen.com' => -7.0,
|
||||
# '.cleargreen.com' => -5.0}],
|
||||
|
||||
## site-wide opinions about senders (the '.' matches any recipient)
|
||||
'.' => [ # the _first_ matching sender determines the score boost
|
||||
|
||||
new_RE( # regexp-type lookup table, just happens to be all soft-blacklist
|
||||
[qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i => 5.0],
|
||||
[qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
|
||||
[qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
|
||||
[qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i => 5.0],
|
||||
[qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i => 5.0],
|
||||
[qr'^(your_friend|greatoffers)@'i => 5.0],
|
||||
[qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i => 5.0],
|
||||
),
|
||||
|
||||
# read_hash("/var/amavis/sender_scores_sitewide"),
|
||||
|
||||
# This are some examples for whitelists, since envelope senders can be forged
|
||||
# they are not enabled by default.
|
||||
{ # a hash-type lookup table (associative array)
|
||||
#'nobody@cert.org' => -3.0,
|
||||
#'cert-advisory@us-cert.gov' => -3.0,
|
||||
#'owner-alert@iss.net' => -3.0,
|
||||
#'slashdot@slashdot.org' => -3.0,
|
||||
#'securityfocus.com' => -3.0,
|
||||
#'ntbugtraq@listserv.ntbugtraq.com' => -3.0,
|
||||
#'security-alerts@linuxsecurity.com' => -3.0,
|
||||
#'mailman-announce-admin@python.org' => -3.0,
|
||||
#'amavis-user-admin@lists.sourceforge.net'=> -3.0,
|
||||
#'amavis-user-bounces@lists.sourceforge.net' => -3.0,
|
||||
#'spamassassin.apache.org' => -3.0,
|
||||
#'notification-return@lists.sophos.com' => -3.0,
|
||||
#'owner-postfix-users@postfix.org' => -3.0,
|
||||
#'owner-postfix-announce@postfix.org' => -3.0,
|
||||
#'owner-sendmail-announce@lists.sendmail.org' => -3.0,
|
||||
#'sendmail-announce-request@lists.sendmail.org' => -3.0,
|
||||
#'donotreply@sendmail.org' => -3.0,
|
||||
#'ca+envelope@sendmail.org' => -3.0,
|
||||
#'noreply@freshmeat.net' => -3.0,
|
||||
#'owner-technews@postel.acm.org' => -3.0,
|
||||
#'ietf-123-owner@loki.ietf.org' => -3.0,
|
||||
#'cvs-commits-list-admin@gnome.org' => -3.0,
|
||||
#'rt-users-admin@lists.fsck.com' => -3.0,
|
||||
#'clp-request@comp.nus.edu.sg' => -3.0,
|
||||
#'surveys-errors@lists.nua.ie' => -3.0,
|
||||
#'emailnews@genomeweb.com' => -5.0,
|
||||
#'yahoo-dev-null@yahoo-inc.com' => -3.0,
|
||||
#'returns.groups.yahoo.com' => -3.0,
|
||||
#'clusternews@linuxnetworx.com' => -3.0,
|
||||
#lc('lvs-users-admin@LinuxVirtualServer.org') => -3.0,
|
||||
#lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,
|
||||
|
||||
# soft-blacklisting (positive score)
|
||||
#'sender@example.net' => 3.0,
|
||||
#'.example.net' => 1.0,
|
||||
|
||||
},
|
||||
], # end of site-wide tables
|
||||
});
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
use strict;
|
||||
|
||||
#
|
||||
# These are Ubuntu specific defaults for amavisd-new configuration
|
||||
#
|
||||
# DOMAIN KEYS IDENTIFIED MAIL (DKIM)
|
||||
$enable_dkim_verification = 1;
|
||||
# Don't be verbose about sending mail:
|
||||
@whitelist_sender_acl = qw( .$mydomain );
|
||||
$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)
|
||||
$final_banned_destiny = D_DISCARD; # (defaults to D_BOUNCE)
|
||||
$final_spam_destiny = D_DISCARD; # (defaults to D_REJECT)
|
||||
$final_bad_header_destiny = D_PASS; # (defaults to D_PASS), D_BOUNCE suggested
|
||||
|
||||
$virus_admin = undef;
|
||||
$spam_admin = undef;
|
||||
|
||||
#------------ Do not modify anything below this line -------------
|
||||
1; # insure a defined return
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
use strict;
|
||||
|
||||
##
|
||||
## Functionality required for amavis helpers like
|
||||
## amavis-release.
|
||||
##
|
||||
|
||||
# Enable required AM.PDP protocol socket.
|
||||
#
|
||||
# this is incompatible with the old helpers, but one can
|
||||
# have multiple inet (not unix) sockets to overcome this
|
||||
# issue. Refer to the amavisd-new documentation for more
|
||||
# information
|
||||
|
||||
$unix_socketname = "/var/lib/amavis/amavisd.sock";
|
||||
|
||||
$interface_policy{'SOCK'} = 'AM.PDP-SOCK';
|
||||
$policy_bank{'AM.PDP-SOCK'} = {
|
||||
protocol => 'AM.PDP',
|
||||
auth_required_release => 0, # don't require secret-id for release
|
||||
};
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
use strict;
|
||||
|
||||
# l10n (localization) of the AMaViSd-new DSN templates
|
||||
# Override or change as necessary
|
||||
|
||||
# Select notifications text encoding when Unicode-aware Perl is converting
|
||||
# text from internal character representation to external encoding (charset
|
||||
# in MIME terminology). Used as argument to Perl Encode::encode subroutine.
|
||||
#
|
||||
# to be used in RFC 2047-encoded header field bodies, e.g. in Subject:
|
||||
#$hdr_encoding = 'iso-8859-1'; # (default: 'iso-8859-1')
|
||||
#
|
||||
# to be used in notification body text: its encoding and Content-type.charset
|
||||
#$bdy_encoding = 'iso-8859-1'; # (default: 'iso-8859-1')
|
||||
|
||||
# Default template texts for notifications may be overruled by directly
|
||||
# assigning new text to template variables, or by reading template text
|
||||
# from files. A second argument may be specified in a call to read_text(),
|
||||
# specifying character encoding layer to be used when reading from the
|
||||
# external file, e.g. 'utf8', 'iso-8859-1', or often just $bdy_encoding.
|
||||
# Text will be converted to internal character representation by Perl 5.8.0
|
||||
# or later; second argument is ignored otherwise. See PerlIO::encoding,
|
||||
# Encode::PerlIO and perluniintro man pages.
|
||||
#
|
||||
# $notify_sender_templ = read_text('/var/amavis/notify_sender.txt');
|
||||
# $notify_virus_sender_templ= read_text('/var/amavis/notify_virus_sender.txt');
|
||||
# $notify_virus_admin_templ = read_text('/var/amavis/notify_virus_admin.txt');
|
||||
# $notify_virus_recips_templ= read_text('/var/amavis/notify_virus_recips.txt');
|
||||
# $notify_spam_sender_templ = read_text('/var/amavis/notify_spam_sender.txt');
|
||||
# $notify_spam_admin_templ = read_text('/var/amavis/notify_spam_admin.txt');
|
||||
|
||||
# If notification template files are collectively available in some directory,
|
||||
# you can use read_l10n_templates which calls read_text for each known
|
||||
# template. Name the files as above, and include a file named "charset" with
|
||||
# the charset used in the files. This is how Debian ships l10n templates.
|
||||
#
|
||||
# syntax: read_l10n_templates(<directory>); OR
|
||||
# read_l10n_templates(<subdirectory>, <master directory>);
|
||||
#
|
||||
read_l10n_templates('en_US', '/etc/amavis');
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
# DKIM signing domain whitelist. The domain to use is the domain after
|
||||
# d= in the DKIM header.
|
||||
|
||||
@author_to_policy_bank_maps = ( {
|
||||
# 'friends.example.net' => 'WHITELIST,NOBANNEDCHECK',
|
||||
# 'user1@cust.example.net' => 'WHITELIST,NOBANNEDCHECK',
|
||||
'.ebay.com' => 'WHITELIST',
|
||||
'.ebay.co.uk' => 'WHITELIST',
|
||||
'ebay.at' => 'WHITELIST',
|
||||
'ebay.ca' => 'WHITELIST',
|
||||
'ebay.de' => 'WHITELIST',
|
||||
'ebay.fr' => 'WHITELIST',
|
||||
'.paypal.co.uk' => 'WHITELIST',
|
||||
'.paypal.com' => 'WHITELIST', # author signatures
|
||||
'./@paypal.com' => 'WHITELIST', # 3rd-party sign. by paypal.com
|
||||
'alert.bankofamerica.com' => 'WHITELIST',
|
||||
'amazon.com' => 'WHITELIST',
|
||||
'cisco.com' => 'WHITELIST',
|
||||
'.cnn.com' => 'WHITELIST',
|
||||
'skype.net' => 'WHITELIST',
|
||||
'welcome.skype.com' => 'WHITELIST',
|
||||
'cc.yahoo-inc.com' => 'WHITELIST',
|
||||
'cc.yahoo-inc.com/@yahoo-inc.com' => 'WHITELIST',
|
||||
# 'google.com' => 'MILD_WHITELIST',
|
||||
# 'googlemail.com' => 'MILD_WHITELIST',
|
||||
# './@googlegroups.com' => 'MILD_WHITELIST',
|
||||
# './@yahoogroups.com' => 'MILD_WHITELIST',
|
||||
# './@yahoogroups.co.uk' => 'MILD_WHITELIST',
|
||||
# './@yahoogroupes.fr' => 'MILD_WHITELIST',
|
||||
# 'yousendit.com' => 'MILD_WHITELIST',
|
||||
# 'meetup.com' => 'MILD_WHITELIST',
|
||||
# 'dailyhoroscope@astrology.com' => 'MILD_WHITELIST',
|
||||
} );
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
use strict;
|
||||
|
||||
#
|
||||
# Place your configuration directives here. They will override those in
|
||||
# earlier files.
|
||||
#
|
||||
# See /usr/share/doc/amavisd-new/ for documentation and examples of
|
||||
# the directives you can use in this file
|
||||
#
|
||||
|
||||
# Test Verification
|
||||
|
||||
#------------ Do not modify anything below this line -------------
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
use strict;
|
||||
|
||||
@local_domains_maps = (
|
||||
read_hash('/etc/postfix/vhost')
|
||||
);
|
||||
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
# WARNING: this file is auto-generated.
|
||||
use strict;
|
||||
1; # ensure a defined return
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
# This is charset for en_US messages.
|
||||
# If you are creating new messages, use 'iconv -l' to get possible encodings.
|
||||
ascii # or iso-8859-1
|
||||
ignored lines after first one
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for the plain text part of an auto response (e.g.
|
||||
# vacation, out-of-office), see RFC 3834.
|
||||
#
|
||||
From: %f
|
||||
Date: %d
|
||||
To: [? %#T |undisclosed-recipients:;|[%T|, ]]
|
||||
[? %#C |#|Cc: [%C|, ]]
|
||||
Reply-To: postmaster@%h
|
||||
Message-ID: <ARE%i@%h>
|
||||
Auto-Submitted: auto-replied
|
||||
[:wrap|76||\t|Subject: Auto: autoresponse to: %s]
|
||||
[? %m |#|In-Reply-To: %m]
|
||||
Precedence: junk
|
||||
|
||||
This is an auto-response to a message \
|
||||
[? %a |\nreceived on %d,|received from\nIP address \[%a\] on %d,]
|
||||
envelope sender: %s
|
||||
(author) From: [:rfc2822_from]
|
||||
[? %j |#|[:wrap|78|| |Subject: %j]]
|
||||
[?[:dkim|author]|#|
|
||||
A first-party DKIM or DomainKeys signature is valid, d=[:dkim|author].]
|
||||
|
|
@ -0,0 +1,134 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for (neutral: non-virus, non-spam, non-banned)
|
||||
# DELIVERY STATUS NOTIFICATIONS to sender.
|
||||
# For syntax and customization instructions see README.customize.
|
||||
# The From, To and Date header fields will be provided automatically.
|
||||
# Long header fields will be automatically wrapped by the program.
|
||||
#
|
||||
Subject: [?%#D|Undeliverable mail|Delivery status notification]\
|
||||
[? [:ccat|major] |||, MTA-BLOCKED\
|
||||
|, OVERSIZED message\
|
||||
|, invalid header section[=explain_badh|1]\
|
||||
[?[:ccat|minor]||: bad MIME|: unencoded 8-bit character\
|
||||
|: improper use of control char|: all-whitespace header line\
|
||||
|: header line longer than 998 characters|: header field syntax error\
|
||||
|: missing required header field|: duplicate header field|]\
|
||||
|, UNSOLICITED BULK EMAIL apparently from you\
|
||||
|, UNSOLICITED BULK EMAIL apparently from you\
|
||||
|, contents UNCHECKED\
|
||||
|, BANNED contents type (%F)\
|
||||
|, VIRUS in message apparently from you (%V)\
|
||||
]
|
||||
Message-ID: <DSN%i@%h>
|
||||
|
||||
[? %#D |#|Your message WAS SUCCESSFULLY RELAYED to:[\n %D]
|
||||
[~[:dsn_notify]|["\\bSUCCESS\\b"]|\
|
||||
and you explicitly requested a delivery status notification on success.\n]\
|
||||
]
|
||||
[? %#N |#|The message WAS NOT relayed to:[\n %N]
|
||||
]
|
||||
[:wrap|78|||This [?%#D|nondelivery|delivery] report was \
|
||||
generated by the program amavisd-new at host %h. \
|
||||
Our internal reference code for your message is %n/%i]
|
||||
|
||||
# ccat_min 0: other, 1: bad MIME, 2: 8-bit char, 3: NUL/CR,
|
||||
# 4: empty, 5: long, 6: syntax, 7: missing, 8: multiple
|
||||
[? [:explain_badh] ||[? [:ccat|minor]
|
||||
|INVALID HEADER
|
||||
|INVALID HEADER: BAD MIME HEADER SECTION OR BAD MIME STRUCTURE
|
||||
|INVALID HEADER: INVALID 8-BIT CHARACTERS IN HEADER SECTION
|
||||
|INVALID HEADER: INVALID CONTROL CHARACTERS IN HEADER SECTION
|
||||
|INVALID HEADER: FOLDED HEADER FIELD LINE MADE UP ENTIRELY OF WHITESPACE
|
||||
|INVALID HEADER: HEADER LINE LONGER THAN RFC 5322 LIMIT OF 998 CHARACTERS
|
||||
|INVALID HEADER: HEADER FIELD SYNTAX ERROR
|
||||
|INVALID HEADER: MISSING REQUIRED HEADER FIELD
|
||||
|INVALID HEADER: DUPLICATE HEADER FIELD
|
||||
|INVALID HEADER
|
||||
]
|
||||
[[:wrap|78| | |%X]\n]
|
||||
]\
|
||||
#
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From|100][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender|100]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
[? %#X|#|[? [:useragent] |#|[:wrap|78|| |[:useragent]]]]
|
||||
[? %j |#|[:wrap|78|| |Subject: [:header_field|Subject|100]]]
|
||||
|
||||
# ccat_min 0: other, 1: bad MIME, 2: 8-bit char, 3: NUL/CR,
|
||||
# 4: empty, 5: long, 6: syntax, 7: missing, 8: multiple
|
||||
[? [:explain_badh] ||[? [:ccat|minor]
|
||||
|# 0: other
|
||||
|# 1: bad MIME
|
||||
|# 2: 8-bit char
|
||||
WHAT IS AN INVALID CHARACTER IN A MAIL HEADER SECTION?
|
||||
|
||||
The RFC 5322 document specifies rules for forming internet messages.
|
||||
It does not allow the use of characters with codes above 127 to be
|
||||
used directly (non-encoded) in a mail header section.
|
||||
|
||||
If such characters (e.g. with diacritics) from ISO Latin or other
|
||||
alphabets need to be included in a header section, these characters
|
||||
need to be properly encoded according to RFC 2047. Such encoding
|
||||
is often done transparently by mail reader (MUA), but if automatic
|
||||
encoding is not available (e.g. by some older MUA) it is a user's
|
||||
responsibility to avoid using such characters in a header section,
|
||||
or to encode them manually. Typically the offending header fields
|
||||
in this category are 'Subject', 'Organization', and comment fields
|
||||
or display names in e-mail addresses of 'From', 'To' or 'Cc'.
|
||||
|
||||
Sometimes such invalid header fields are inserted automatically
|
||||
by some MUA, MTA, content filter, or other mail handling service.
|
||||
If this is the case, such service needs to be fixed or properly
|
||||
configured. Typically the offending header fields in this category
|
||||
are 'Date', 'Received', 'X-Mailer', 'X-Priority', 'X-Scanned', etc.
|
||||
|
||||
If you don't know how to fix or avoid the problem, please report it
|
||||
to _your_ postmaster or system manager.
|
||||
#
|
||||
[~[:useragent]|^X-Mailer:\\s*Microsoft Outlook Express 6\\.00|["
|
||||
If using Microsoft Outlook Express as your MUA, make sure its
|
||||
settings under:
|
||||
Tools -> Options -> Send -> Mail Sending Format -> Plain & HTML
|
||||
are: "MIME format" MUST BE selected,
|
||||
and "Allow 8-bit characters in headers" MUST NOT be enabled!
|
||||
"]]#
|
||||
|# 3: NUL/CR
|
||||
IMPROPER USE OF CONTROL CHARACTER IN A MESSAGE HEADER SECTION
|
||||
|
||||
The RFC 5322 document specifies rules for forming internet messages.
|
||||
It does not allow the use of control characters NUL and bare CR
|
||||
to be used directly in a mail header section.
|
||||
|# 4: empty
|
||||
IMPROPERLY FOLDED HEADER FIELD LINE MADE UP ENTIRELY OF WHITESPACE
|
||||
|
||||
The RFC 5322 document specifies rules for forming internet messages.
|
||||
In section '3.2.2. Folding white space and comments' it explicitly
|
||||
prohibits folding of header fields in such a way that any line of a
|
||||
folded header field is made up entirely of white-space characters
|
||||
(control characters SP and HTAB) and nothing else.
|
||||
|# 5: long
|
||||
HEADER LINE LONGER THAN RFC 5322 LIMIT OF 998 CHARACTERS
|
||||
|
||||
The RFC 5322 document specifies rules for forming internet messages.
|
||||
Section '2.1.1. Line Length Limits' prohibits each line of a header
|
||||
section to be more than 998 characters in length (excluding the CRLF).
|
||||
|# 6: syntax
|
||||
|# 7: missing
|
||||
MISSING REQUIRED HEADER FIELD
|
||||
|
||||
The RFC 5322 document specifies rules for forming internet messages.
|
||||
Section '3.6. Field Definitions' specifies that certain header fields
|
||||
are required (origination date field and the "From:" originator field).
|
||||
|# 8: multiple
|
||||
DUPLICATE HEADER FIELD
|
||||
|
||||
The RFC 5322 document specifies rules for forming internet messages.
|
||||
Section '3.6. Field Definitions' specifies that certain header fields
|
||||
must not occur more than once in a message header section.
|
||||
|# other
|
||||
]]#
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for the plain text part of a problem/feedback report,
|
||||
# with either the original message included in-line, or attached,
|
||||
# or the message is structured as a FEEDBACK REPORT NOTIFICATIONS format.
|
||||
# See RFC 5965 - "An Extensible Format for Email Feedback Reports".
|
||||
#
|
||||
From: %f
|
||||
Date: %d
|
||||
Subject: Fw: %j
|
||||
To: [? %#T |undisclosed-recipients:;|[%T|, ]]
|
||||
[? %#C |#|Cc: [%C|, ]]
|
||||
Message-ID: <ARF%i@%h>
|
||||
#Auto-Submitted: auto-generated
|
||||
|
||||
This is an e-mail [:feedback_type] report for a message \
|
||||
[? %a |\nreceived on %d,|received from\nIP address [:client_addr_port] on %d,]
|
||||
|
||||
[:wrap|78|| |Return-Path: %s]
|
||||
[:wrap|78|| |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|[:wrap|78|| |Sender: [:header_field|Sender]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
[? %j |#|[:wrap|78|| |Subject: [:header_field|Subject|100]]]
|
||||
[?[:dkim|author]|#|
|
||||
A first-party DKIM or DomainKeys signature is valid, d=[:dkim|author].]
|
||||
|
||||
Reporting-MTA: %h
|
||||
Our internal reference code for the message is %n/%i
|
||||
|
||||
[~[:report_format]|["^(arf|attach|dsn)$"]|["\
|
||||
A complete original message is attached.
|
||||
[~[:report_format]|["^arf$"]|\
|
||||
For more information on the ARF format please see RFC 5965.
|
||||
]"]|["\
|
||||
A complete original message in its pristine form follows:
|
||||
"]]#
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for the plain text part of a RELEASE FROM A QUARANTINE,
|
||||
# applicable if a chosen release format is 'attach' (not 'resend').
|
||||
#
|
||||
From: %f
|
||||
Date: %d
|
||||
Subject: \[released message\] %j
|
||||
To: [? %#T |undisclosed-recipients:;|[%T|, ]]
|
||||
[? %#C |#|Cc: [%C|, ]]
|
||||
Message-ID: <QRA%i@%h>
|
||||
|
||||
Please find attached a message which was held in a quarantine,
|
||||
and has now been released.
|
||||
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
# [? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
# [? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
# [? [:useragent] |#|[:wrap|78|| |[:useragent]]]
|
||||
[? %j |#|[:wrap|78|| |Subject: %j]]
|
||||
|
||||
Our internal reference code for the message is %n/%i
|
||||
#
|
||||
[~[:report_format]|["^attach$"]|["[? [:attachment_password] |#|
|
||||
|
||||
Contents of the attached mail message may pose a threat to your computer or
|
||||
could be a social engineering deception, so it should be handled cautiously.
|
||||
To prevent undesired automatic opening, the attached original mail message
|
||||
has been wrapped in a password-protected ZIP archive.
|
||||
|
||||
Here is the password that allows opening of the attached archive:
|
||||
|
||||
[:attachment_password]
|
||||
|
||||
Note that the attachment is not strongly encrypted and the password
|
||||
is not a strong secret (being displayed in this non-encrypted text),
|
||||
so this attachment is not suitable for guarding a secret contents.
|
||||
The sole purpose of this password protection it to prevent undesired
|
||||
accidental or automatic opening of a message, either by some filtering
|
||||
software, a virus scanner, or by a mail reader.
|
||||
]"]|]#
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for spam ADMINISTRATOR NOTIFICATIONS.
|
||||
# For syntax and customization instructions see README.customize.
|
||||
# Long header fields will be automatically wrapped by the program.
|
||||
#
|
||||
From: %f
|
||||
Date: %d
|
||||
Subject: Spam FROM [?%l||LOCAL ][?%a||[:client_addr_port] ]%s
|
||||
To: [? %#T |undisclosed-recipients:;|[%T|, ]]
|
||||
[? %#C |#|Cc: [%C|, ]]
|
||||
Message-ID: <SA%i@%h>
|
||||
|
||||
Content type: [:ccat|name|main]#
|
||||
[? [:ccat|is_blocked_by_nonmain] ||, blocked for [:ccat|name]]
|
||||
Internal reference code for the message is %n/%i
|
||||
|
||||
[? %a |#|[:wrap|78|| |First upstream SMTP client IP address: \[%a\] %g]]
|
||||
[? %e |#|[:wrap|78|| |According to a 'Received:' trace,\
|
||||
the message apparently originated at: \[%e\], %t]]
|
||||
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
[? [:useragent] |#|[:wrap|78|| |[:useragent]]]
|
||||
[? %j |#|[:wrap|78|| |Subject: %j]]
|
||||
[? %q |Not quarantined.|The message has been quarantined as: %q]
|
||||
|
||||
[? %#D |#|The message WILL BE relayed to:[\n%D]
|
||||
]
|
||||
[? %#N |#|The message WAS NOT relayed to:[\n%N]
|
||||
]
|
||||
Spam scanner report:
|
||||
[%A
|
||||
]\
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for spam SENDER NOTIFICATIONS.
|
||||
# For syntax and customization instructions see README.customize.
|
||||
# The From, To and Date header fields will be provided automatically.
|
||||
# Long header fields will be automatically wrapped by the program.
|
||||
#
|
||||
Subject: Considered UNSOLICITED BULK EMAIL, apparently from you
|
||||
[? %m |#|In-Reply-To: %m]
|
||||
Message-ID: <SS%i@%h>
|
||||
|
||||
A message from %s[
|
||||
to: %R]
|
||||
|
||||
was considered unsolicited bulk e-mail (UBE).
|
||||
|
||||
Our internal reference code for your message is %n/%i
|
||||
|
||||
The message carried your return address, so it was either a genuine mail
|
||||
from you, or a sender address was faked and your e-mail address abused
|
||||
by third party, in which case we apologize for undesired notification.
|
||||
|
||||
We do try to minimize backscatter for more prominent cases of UBE and
|
||||
for infected mail, but for less obvious cases some balance between
|
||||
losing genuine mail and sending undesired backscatter is sought,
|
||||
and there can be some collateral damage on either side.
|
||||
|
||||
[? %a |#|[:wrap|78|| |First upstream SMTP client IP address: \[%a\] %g]]
|
||||
[? %e |#|[:wrap|78|| |According to a 'Received:' trace,\
|
||||
the message apparently originated at: \[%e\], %t]]
|
||||
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From|100][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender|100]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
# [? [:useragent] |#|[:wrap|78|| |[:useragent]]]
|
||||
[? %j |#|[:wrap|78|| |Subject: [:header_field|Subject|100]]]
|
||||
[? %#X |#|\n[[:wrap|78|| |%X]\n]]
|
||||
|
||||
[? %#D |Delivery of the email was stopped!
|
||||
]#
|
||||
#
|
||||
# Spam scanner report:
|
||||
# [%A
|
||||
# ]\
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for non-spam (e.g. VIRUS,...) ADMINISTRATOR NOTIFICATIONS.
|
||||
# For syntax and customization instructions see README.customize.
|
||||
# Long header fields will be automatically wrapped by the program.
|
||||
#
|
||||
From: %f
|
||||
Date: %d
|
||||
Subject: [? [:ccat|major] |Clean mail|Clean mail|MTA-blocked mail|\
|
||||
OVERSIZED mail|INVALID HEADER in mail|Spammy|Spam|UNCHECKED contents in mail|\
|
||||
BANNED contents (%F) in mail|VIRUS (%V) in mail]\
|
||||
FROM [?%l||LOCAL ][?%a||[:client_addr_port] ]%s
|
||||
To: [? %#T |undisclosed-recipients:;|[%T|, ]]
|
||||
[? %#C |#|Cc: [%C|, ]]
|
||||
Message-ID: <VA%i@%h>
|
||||
|
||||
[? %#V |No viruses were found.
|
||||
|A virus was found: %V
|
||||
|Two viruses were found:\n %V
|
||||
|%#V viruses were found:\n %V
|
||||
]
|
||||
[? %#F |#|[:wrap|78|| |Banned [?%#F|names|name|names]: %F]]
|
||||
[? %#X |#|Bad header:[\n[:wrap|78| | |%X]]]
|
||||
[? %#W |#\
|
||||
|Scanner detecting a virus: %W
|
||||
|Scanners detecting a virus: %W
|
||||
]
|
||||
Content type: [:ccat|name|main]#
|
||||
[? [:ccat|is_blocked_by_nonmain] ||, blocked for [:ccat|name]]
|
||||
Internal reference code for the message is %n/%i
|
||||
|
||||
[? %a |#|[:wrap|78|| |First upstream SMTP client IP address: \[%a\] %g]]
|
||||
[? %e |#|[:wrap|78|| |According to a 'Received:' trace,\
|
||||
the message apparently originated at: \[%e\], %t]]
|
||||
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
[? %j |#|[:wrap|78|| |Subject: %j]]
|
||||
[? %q |Not quarantined.|The message has been quarantined as: %q]
|
||||
|
||||
[? %#S |Notification to sender will not be mailed.
|
||||
|
||||
]#
|
||||
[? %#D |#|The message WILL BE relayed to:[\n%D]
|
||||
]
|
||||
[? %#N |#|The message WAS NOT relayed to:[\n%N]
|
||||
]
|
||||
[? %#V |#|[? %#v |#|Virus scanner output:[\n %v]
|
||||
]]
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for VIRUS/BANNED/BAD-HEADER RECIPIENTS NOTIFICATIONS.
|
||||
# For syntax and customization instructions see README.customize.
|
||||
# Long header fields will be automatically wrapped by the program.
|
||||
#
|
||||
From: %f
|
||||
Date: %d
|
||||
Subject: [? [:ccat|major] |Clean mail|Clean mail|MTA-blocked mail|\
|
||||
OVERSIZED mail|INVALID HEADER in mail|Spammy|Spam|UNCHECKED contents in mail|\
|
||||
BANNED contents (%F) in mail|VIRUS (%V) in mail] TO YOU from %s
|
||||
[? [:header_field|To] |To: undisclosed-recipients:;|To: [:header_field|To]]
|
||||
[? [:header_field|Cc] |#|Cc: [:header_field|Cc]]
|
||||
Message-ID: <VR%i@%h>
|
||||
|
||||
[? %#V |[? %#F ||BANNED CONTENTS ALERT]|VIRUS ALERT]
|
||||
|
||||
Our content checker found
|
||||
[? %#V |#|[:wrap|78| | |[?%#V|viruses|virus|viruses]: %V]]
|
||||
[? %#F |#|[:wrap|78| | |banned [?%#F|names|name|names]: %F]]
|
||||
[? %#X |#|[[:wrap|78| | |%X]\n]]
|
||||
|
||||
in an email to you [? %#V |from:|from probably faked sender:]
|
||||
%o
|
||||
[? %#V |#|claiming to be: %s]
|
||||
|
||||
Content type: [:ccat|name|main]#
|
||||
[? [:ccat|is_blocked_by_nonmain] ||, blocked for [:ccat|name]]
|
||||
Our internal reference code for your message is %n/%i
|
||||
|
||||
[? %a |#|[:wrap|78|| |First upstream SMTP client IP address: \[%a\] %g]]
|
||||
[? %e |#|[:wrap|78|| |According to a 'Received:' trace,\
|
||||
the message apparently originated at: \[%e\], %t]]
|
||||
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
[? [:useragent] |#|[:wrap|78|| |[:useragent]]]
|
||||
[? %j |#|[:wrap|78|| |Subject: %j]]
|
||||
[? %q |Not quarantined.|The message has been quarantined as: %q]
|
||||
|
||||
Please contact your system administrator for details.
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
#
|
||||
# =============================================================================
|
||||
# This is a template for VIRUS/BANNED SENDER NOTIFICATIONS.
|
||||
# For syntax and customization instructions see README.customize.
|
||||
# The From, To and Date header fields will be provided automatically.
|
||||
# Long header fields will be automatically wrapped by the program.
|
||||
#
|
||||
Subject: [? [:ccat|major]
|
||||
|Clean message from you\
|
||||
|Clean message from you\
|
||||
|Clean message from you (MTA blocked)\
|
||||
|OVERSIZED message from you\
|
||||
|BAD-HEADER in message from you\
|
||||
|Spam claiming to be from you\
|
||||
|Spam claiming to be from you\
|
||||
|A message with UNCHECKED contents from you\
|
||||
|BANNED contents from you (%F)\
|
||||
|VIRUS in message apparently from you (%V)\
|
||||
]
|
||||
[? %m |#|In-Reply-To: %m]
|
||||
Message-ID: <VS%i@%h>
|
||||
|
||||
[? [:ccat|major] |Clean|Clean|MTA-BLOCKED|OVERSIZED|INVALID HEADER|\
|
||||
Spammy|Spam|UNCHECKED contents|BANNED CONTENTS ALERT|VIRUS ALERT]
|
||||
|
||||
Our content checker found
|
||||
[? %#V |#|[:wrap|78| | |[? %#V |viruses|virus|viruses]: %V]]
|
||||
[? %#F |#|[:wrap|78| | |banned [? %#F |names|name|names]: %F]]
|
||||
[? %#X |#|[[:wrap|78| | |%X]\n]]
|
||||
|
||||
in email presumably from you %s
|
||||
to the following [? %#R |recipients|recipient|recipients]:[
|
||||
-> %R]
|
||||
|
||||
Our internal reference code for your message is %n/%i
|
||||
|
||||
[? %a |#|[:wrap|78|| |First upstream SMTP client IP address: \[%a\] %g]]
|
||||
[? %e |#|[:wrap|78|| |According to a 'Received:' trace,\
|
||||
the message apparently originated at: \[%e\], %t]]
|
||||
|
||||
[:wrap|78|| |Return-Path: %s[?[:dkim|envsender]|| (OK)]]
|
||||
[:wrap|78|| |From: [:header_field|From|100][?[:dkim|author]|| (dkim:AUTHOR)]]
|
||||
[? [:header_field|Sender]|#|\
|
||||
[:wrap|78|| |Sender: [:header_field|Sender|100]\
|
||||
[?[:dkim|sender]|| (dkim:SENDER)]]]
|
||||
[? %m |#|[:wrap|78|| |Message-ID: %m]]
|
||||
[? %r |#|[:wrap|78|| |Resent-Message-ID: %r]]
|
||||
[? %j |#|[:wrap|78|| |Subject: [:header_field|Subject|100]]]
|
||||
|
||||
[? %#D |Delivery of the email was stopped!
|
||||
|
||||
]#
|
||||
[? %#V ||Please check your system for viruses,
|
||||
or ask your system administrator to do so.
|
||||
|
||||
]#
|
||||
[? %#V |[? %#F ||#
|
||||
The message [?%#D|has been blocked|triggered this warning] because it contains a component
|
||||
(as a MIME part or nested within) with declared name
|
||||
or MIME type or contents type violating our access policy.
|
||||
|
||||
To transfer contents that may be considered risky or unwanted
|
||||
by site policies, or simply too large for mailing, please consider
|
||||
publishing your content on the web, and only sending an URL of the
|
||||
document to the recipient.
|
||||
|
||||
Depending on the recipient and sender site policies, with a little
|
||||
effort it might still be possible to send any contents (including
|
||||
viruses) using one of the following methods:
|
||||
|
||||
- encrypted using pgp, gpg or other encryption methods;
|
||||
|
||||
- wrapped in a password-protected or scrambled container or archive
|
||||
(e.g.: zip -e, arj -g, arc g, rar -p, or other methods)
|
||||
|
||||
Note that if the contents is not intended to be secret, the
|
||||
encryption key or password may be included in the same message
|
||||
for recipient's convenience.
|
||||
|
||||
We are sorry for inconvenience if the contents was not malicious.
|
||||
|
||||
The purpose of these restrictions is to cut the most common propagation
|
||||
methods used by viruses and other malware. These often exploit automatic
|
||||
mechanisms and security holes in more popular mail readers (Microsoft
|
||||
mail readers and browsers are a common target). By requiring an explicit
|
||||
and decisive action from the recipient to decode mail, the danger of
|
||||
automatic malware propagation is largely reduced.
|
||||
#
|
||||
# Details of our mail restrictions policy are available at ...
|
||||
|
||||
]]#
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
HELO mail.external.tld
|
||||
MAIL FROM: user@external.tld
|
||||
RCPT TO: user2@otherdomain.tld
|
||||
DATA
|
||||
From: Docker Mail Server <dockermailserver@external.tld>
|
||||
To: Existing Local User <user2@otherdomain.tld>
|
||||
Date: Sat, 22 May 2010 07:43:25 -0400
|
||||
Subject: Test Message
|
||||
This is a test mail.
|
||||
|
||||
.
|
||||
QUIT
|
||||
|
|
@ -406,7 +406,7 @@ load 'test_helper/bats-assert/load'
|
|||
}
|
||||
|
||||
@test "checking spamassassin: docker env variables are set correctly (custom)" {
|
||||
run docker exec mail /bin/sh -c "grep '\$sa_tag_level_deflt' /etc/amavis/conf.d/20-debian_defaults | grep '= 1.0'"
|
||||
run docker exec mail /bin/sh -c "grep '\$sa_tag_level_deflt' /etc/amavis/conf.d/20-debian_defaults | grep '= -5.0'"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "grep '\$sa_tag2_level_deflt' /etc/amavis/conf.d/20-debian_defaults | grep '= 2.0'"
|
||||
assert_success
|
||||
|
|
@ -414,6 +414,14 @@ load 'test_helper/bats-assert/load'
|
|||
assert_success
|
||||
}
|
||||
|
||||
@test "checking spamassassin: all registered domains should see spam headers" {
|
||||
run docker exec mail /bin/sh -c "grep -ir 'X-Spam-' /var/mail/localhost.localdomain/user1/new"
|
||||
assert_success
|
||||
run docker exec mail /bin/sh -c "grep -ir 'X-Spam-' /var/mail/otherdomain.tld/user2/new"
|
||||
assert_success
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# clamav
|
||||
#
|
||||
|
|
|
|||
Loading…
Reference in New Issue