1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-sysadm] [413] - add the start of a amavis module ( to interface postfix with spamassassin )
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20%5B413%5D%20-%20add%20the%20start%20of%20a%20amavis%20module%20%28%20to%0A%20interface%20postfix%20with%20spamassassin%20%29&In-Reply-To=%3C20101123021936.D92D33FC92%40valstar.mageia.org%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="000834.html">
<LINK REL="Next" HREF="000810.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-sysadm] [413] - add the start of a amavis module ( to interface postfix with spamassassin )</H1>
<B>root at mageia.org</B>
<A HREF="mailto:mageia-sysadm%40mageia.org?Subject=Re%3A%20%5BMageia-sysadm%5D%20%5B413%5D%20-%20add%20the%20start%20of%20a%20amavis%20module%20%28%20to%0A%20interface%20postfix%20with%20spamassassin%20%29&In-Reply-To=%3C20101123021936.D92D33FC92%40valstar.mageia.org%3E"
TITLE="[Mageia-sysadm] [413] - add the start of a amavis module ( to interface postfix with spamassassin )">root at mageia.org
</A><BR>
<I>Tue Nov 23 03:19:36 CET 2010</I>
<P><UL>
<LI>Previous message: <A HREF="000834.html">[Mageia-sysadm] [412] - it is IMHO cleaner and logical to have apache:: vhost_other_app directly requiring apache:: base rather than letting every people adding it when using the class
</A></li>
<LI>Next message: <A HREF="000810.html">[Mageia-sysadm] [414] - add spamassassin module
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#814">[ date ]</a>
<a href="thread.html#814">[ thread ]</a>
<a href="subject.html#814">[ subject ]</a>
<a href="author.html#814">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>Revision: 413
Author: misc
Date: 2010-11-23 03:19:36 +0100 (Tue, 23 Nov 2010)
Log Message:
-----------
- add the start of a amavis module ( to interface postfix with spamassassin )
Added Paths:
-----------
puppet/modules/amavis/
puppet/modules/amavis/manifests/
puppet/modules/amavis/manifests/init.pp
puppet/modules/amavis/templates/
puppet/modules/amavis/templates/amavisd.conf
Added: puppet/modules/amavis/manifests/init.pp
===================================================================
--- puppet/modules/amavis/manifests/init.pp (rev 0)
+++ puppet/modules/amavis/manifests/init.pp 2010-11-23 02:19:36 UTC (rev 413)
@@ -0,0 +1,20 @@
+class amavis {
+
+ package { "amavisd-new":
+ ensure => installed,
+ }
+
+ service { "amavisd":
+ ensure => running,
+ path => "/etc/init.d/amavisd",
+ }
+
+ file { "/etc/amavisd/amavisd.conf":
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 644,
+ requires => Package["amavisd-new"],
+ content => template('amavis/amavisd.conf')
+ }
+}
Added: puppet/modules/amavis/templates/amavisd.conf
===================================================================
--- puppet/modules/amavis/templates/amavisd.conf (rev 0)
+++ puppet/modules/amavis/templates/amavisd.conf 2010-11-23 02:19:36 UTC (rev 413)
@@ -0,0 +1,781 @@
+use strict;
+
+# a minimalistic configuration file for amavisd-new with all necessary settings
+#
+# see amavisd.conf-default for a list of all variables with their defaults;
+# see amavisd.conf-sample for a traditional-style commented file;
+# for more details see documentation in INSTALL, README_FILES/*
+# and at <A HREF="http://www.ijs.si/software/amavisd/amavisd-new-docs.html">http://www.ijs.si/software/amavisd/amavisd-new-docs.html</A>
+
+
+# COMMONLY ADJUSTED SETTINGS:
+
+# @bypass_virus_checks_maps = (1); # controls running of anti-virus code
+# @bypass_spam_checks_maps = (1); # controls running of anti-spam code
+# $bypass_decode_parts = 1; # controls running of decoders&dearchivers
+
+$max_servers = 2; # num of pre-forked children (2..30 is common), -m
+$daemon_user = 'amavis'; # (no default; customary: vscan or amavis), -u
+$daemon_group = 'amavis'; # (no default; customary: vscan or amavis), -g
+
+(my $__hn,$mydomain) = split (/\./, $myhostname, 2); # try to discover domainname,
+ # a convenient default for other settings could be localhost.localdomain
+ # or change this as your needs
+
+# $MYHOME = '/var/lib/amavis'; # a convenient default for other settings, -H
+$TEMPBASE = "$MYHOME/tmp"; # working directory, needs to exist, -T
+$ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR, used by SA, etc.
+$QUARANTINEDIR = '/var/spool/amavis/virusmails'; # -Q
+# $quarantine_subdir_levels = 1; # add level of subdirs to disperse quarantine
+# $release_format = 'resend'; # 'attach', 'plain', 'resend'
+# $report_format = 'arf'; # 'attach', 'plain', 'resend', 'arf'
+
+# $daemon_chroot_dir = $MYHOME; # chroot directory or undef, -R
+
+# $db_home = "$MYHOME/db"; # dir for bdb nanny/cache/snmp databases, -D
+# $helpers_home = "$MYHOME/var"; # working directory for SpamAssassin, -S
+# $lock_file = "$MYHOME/var/lib/amavisd.lock"; # -L
+# $pid_file = "$MYHOME/var/lib/amavisd.pid"; # -P
+
+#NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually
+
+$log_level = 0; # verbosity 0..5, -d
+$log_recip_templ = undef; # disable by-recipient level-0 log entries
+$DO_SYSLOG = 1; # log via syslogd (preferred)
+$syslog_facility = 'mail'; # Syslog facility as a string
+ # e.g.: mail, daemon, user, local0, ... local7
+$syslog_priority = 'debug'; # Syslog base (minimal) priority as a string,
+ # choose from: emerg, alert, crit, err, warning, notice, info, debug
+
+$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
+$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
+$nanny_details_level = 2; # nanny verbosity: 1: traditional, 2: detailed
+$enable_dkim_verification = 1; # enable DKIM signatures verification
+$enable_dkim_signing = 1; # load DKIM signing code, keys defined by dkim_key
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at local_domains_maps</A> = ( [".$mydomain"] ); # list of all local domains
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at mynetworks</A> = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
+ 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );
+
+$unix_socketname = "$MYHOME/amavisd.sock"; # amavisd-release or amavis-milter
+ # option(s) -p overrides $inet_socket_port and $unix_socketname
+
+$inet_socket_port = 10025; # listen on this local TCP port(s)
+# $inet_socket_port = [10024,10026]; # listen on multiple TCP ports
+
+$policy_bank{'MYNETS'} = { # mail originating from @mynetworks
+ originating => 1, # is true in MYNETS by default, but let's make it explicit
+ os_fingerprint_method => undef, # don't query p0f for internal clients
+};
+
+# it is up to MTA to re-route mail from authenticated roaming users or
+# from internal hosts to a dedicated TCP port (such as 10026) for filtering
+$interface_policy{'10026'} = 'ORIGINATING';
+
+$policy_bank{'ORIGINATING'} = { # mail supposedly originating from our users
+ originating => 1, # declare that mail was submitted by our smtp client
+ allow_disclaimers => 1, # enables disclaimer insertion if available
+ # notify administrator of locally originating malware
+ virus_admin_maps => ["virusalert\@$mydomain"],
+ spam_admin_maps => ["virusalert\@$mydomain"],
+ warnbadhsender => 1,
+ # forward to a smtpd service providing DKIM signing service
+ forward_method => 'smtp:[127.0.0.1]:10027',
+ # force MTA conversion to 7-bit (e.g. before DKIM signing)
+ smtpd_discard_ehlo_keywords => ['8BITMIME'],
+ bypass_banned_checks_maps => [1], # allow sending any file names and types
+ terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option
+};
+
+$interface_policy{'SOCK'} = 'AM.PDP-SOCK'; # only applies with $unix_socketname
+
+# Use with amavis-release over a socket or with Petr Rehor's amavis-milter.c
+# (with amavis-milter.c from this package or old amavis.c client use 'AM.CL'):
+$policy_bank{'AM.PDP-SOCK'} = {
+ protocol => 'AM.PDP',
+ auth_required_release => 0, # do not require secret_id for amavisd-release
+};
+
+$sa_tag_level_deflt = 1.0; # add spam info headers if at, or above that level
+$sa_tag2_level_deflt = 4.7; # add 'spam detected' headers at that level
+$sa_kill_level_deflt = 4.7; # triggers spam evasive actions (e.g. blocks mail)
+$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
+$sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From
+# $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off
+$penpals_bonus_score = 8; # (no effect without a @storage_sql_dsn database)
+$penpals_threshold_high = $sa_kill_level_deflt; # don't waste time on hi spam
+$bounce_killer_score = 100; # spam score points to add for joe-jobbed bounces
+
+$sa_mail_body_size_limit = 512*1024; # don't waste time on SA if mail is larger
+$sa_local_tests_only = 0; # only tests which do not require internet access?
+
+# @lookup_sql_dsn =
+# ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'],
+# ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'],
+# ["DBI:SQLite:dbname=$MYHOME/sql/mail_prefs.sqlite", '', ''] );
+# @storage_sql_dsn = @lookup_sql_dsn; # none, same, or separate database
+
+# $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP;
+# defaults to 0, which is good for non-MySQL or if msgs.time_iso is CHAR(16)
+
+$virus_admin = "virusalert\@$mydomain"; # notifications recip.
+
+$mailfrom_notify_admin = "virusalert\@$mydomain"; # notifications sender
+$mailfrom_notify_recip = "virusalert\@$mydomain"; # notifications sender
+$mailfrom_notify_spamadmin = "spam.police\@$mydomain"; # notifications sender
+$mailfrom_to_quarantine = ''; # null return path; uses original sender if undef
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at addr_extension_virus_maps</A> = ('virus');
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at addr_extension_banned_maps</A> = ('banned');
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at addr_extension_spam_maps</A> = ('spam');
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at addr_extension_bad_header_maps</A> = ('badh');
+# $recipient_delimiter = '+'; # undef disables address extensions altogether
+# when enabling addr extensions do also Postfix/main.cf: recipient_delimiter=+
+
+$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
+# $dspam = 'dspam';
+
+$MAXLEVELS = 14;
+$MAXFILES = 1500;
+$MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced)
+$MAX_EXPANSION_QUOTA = 512*1024*1024; # bytes (default undef, not enforced)
+
+$sa_spam_subject_tag = '***SPAM*** ';
+$defang_virus = 1; # MIME-wrap passed infected mail
+$defang_banned = 1; # MIME-wrap passed mail containing banned name
+# for defanging bad headers only turn on certain minor contents categories:
+$defang_by_ccat{+CC_BADH.",3"} = 1; # NUL or CR character in header
+$defang_by_ccat{+CC_BADH.",5"} = 1; # header line longer than 998 characters
+$defang_by_ccat{+CC_BADH.",6"} = 1; # header field syntax error
+
+
+# OTHER MORE COMMON SETTINGS (defaults may suffice):
+
+# $myhostname = 'host.example.com'; # must be a fully-qualified domain name!
+
+# $notify_method = 'smtp:[127.0.0.1]:10026';
+# $forward_method = 'smtp:[127.0.0.1]:10026'; # set to undef with milter!
+
+# $final_virus_destiny = D_DISCARD;
+# $final_banned_destiny = D_BOUNCE;
+# $final_spam_destiny = D_PASS;
+# $final_bad_header_destiny = D_PASS;
+# $bad_header_quarantine_method = undef;
+
+# $os_fingerprint_method = 'p0f:*:2345'; # to query p0f-analyzer.pl
+
+## hierarchy by which a final setting is chosen:
+## policy bank (based on port or IP address) -> *_by_ccat
+## *_by_ccat (based on mail contents) -> *_maps
+## *_maps (based on recipient address) -> final configuration value
+
+
+# SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all)
+
+# $warnbadhsender,
+# $warnvirusrecip, $warnbannedrecip, $warnbadhrecip, (or @warn*recip_maps)
+#
+# @bypass_virus_checks_maps, @bypass_spam_checks_maps,
+# @bypass_banned_checks_maps, @bypass_header_checks_maps,
+#
+# @virus_lovers_maps, @spam_lovers_maps,
+# @banned_files_lovers_maps, @bad_header_lovers_maps,
+#
+# @blacklist_sender_maps, @score_sender_maps,
+#
+# $clean_quarantine_method, $virus_quarantine_to, $banned_quarantine_to,
+# $bad_header_quarantine_to, $spam_quarantine_to,
+#
+# $defang_bad_header, $defang_undecipherable, $defang_spam
+
+
+# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at keep_decoded_original_maps</A> = (new_RE(
+ qr'^MAIL$', # retain full original message for virus checking
+ qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
+ qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
+# qr'^Zip archive data', # don't trust Archive::Zip
+));
+
+
+# for $banned_namepath_re (a new-style of banned table) see amavisd.conf-sample
+
+$banned_filename_re = new_RE(
+
+### BLOCKED ANYWHERE
+# qr'^UNDECIPHERABLE$', # is or contains any undecipherable components
+ qr'^\.(exe-ms|dll)$', # banned file(1) types, rudimentary
+# qr'^\.(exe|lha|tnef|cab|dll)$', # banned file(1) types
+
+### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
+# [ qr'^\.(gz|bz2)$' => 0 ], # allow any in gzip or bzip2
+ [ qr'^\.(rpm|cpio|tar)$' => 0 ], # allow any in Unix-type archives
+
+ qr'.\.(pif|scr)$'i, # banned extensions - rudimentary
+# qr'^\.zip$', # block zip type
+
+### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
+# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ], # allow any within these archives
+
+ qr'^application/x-msdownload$'i, # block these MIME types
+ qr'^application/x-msdos-program$'i,
+ qr'^application/hta$'i,
+
+# qr'^message/partial$'i, # rfc2046 MIME type
+# qr'^message/external-body$'i, # rfc2046 MIME type
+
+# qr'^(application/x-msmetafile|image/x-wmf)$'i, # Windows Metafile MIME type
+# qr'^\.wmf$', # Windows Metafile file(1) type
+
+ # block certain double extensions in filenames
+ qr'\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
+
+# qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Class ID CLSID, strict
+# qr'\{[0-9a-z]{4,}(-[0-9a-z]{4,}){0,7}\}?'i, # Class ID extension CLSID, loose
+
+ qr'.\.(exe|vbs|pif|scr|cpl)$'i, # banned extension - basic
+# qr'.\.(exe|vbs|pif|scr|cpl|bat|cmd|com)$'i, # banned extension - basic+cmd
+# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
+# inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
+# ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
+# wmf|wsc|wsf|wsh)$'ix, # banned ext - long
+# qr'.\.(ani|cur|ico)$'i, # banned cursors and icons filename
+# qr'^\.ani$', # banned animated cursor file(1) type
+
+# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
+);
+# See <A HREF="http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631">http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631</A>
+# and <A HREF="http://www.cknow.com/vtutor/vtextensions.htm">http://www.cknow.com/vtutor/vtextensions.htm</A>
+
+
+# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at score_sender_maps</A> = ({ # a by-recipient hash lookup table,
+ # results from all matching recipient tables are summed
+
+# ## per-recipient personal tables (NOTE: positive: black, negative: white)
+# '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">user1 at example.com</A>' => [{'<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">bla-mobile.press at example.com</A>' => 10.0}],
+# '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">user3 at example.com</A>' => [{'.ebay.com' => -3.0}],
+# '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">user4 at example.com</A>' => [{'<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">cleargreen at cleargreen.com</A>' => -7.0,
+# '.cleargreen.com' => -5.0}],
+
+ ## site-wide opinions about senders (the '.' matches any recipient)
+ '.' => [ # the _first_ matching sender determines the score boost
+
+ new_RE( # regexp-type lookup table, just happens to be all soft-blacklist
+ [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i => 5.0],
+ [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
+ [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
+ [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i => 5.0],
+ [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i => 5.0],
+ [qr'^(your_friend|greatoffers)@'i => 5.0],
+ [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i => 5.0],
+ ),
+
+# read_hash("/var/lib/amavis/sender_scores_sitewide"),
+
+ { # a hash-type lookup table (associative array)
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">nobody at cert.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">cert-advisory at us-cert.gov</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">owner-alert at iss.net</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">slashdot at slashdot.org</A>' => -3.0,
+ 'securityfocus.com' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">ntbugtraq at listserv.ntbugtraq.com</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">security-alerts at linuxsecurity.com</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">mailman-announce-admin at python.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">amavis-user-admin at lists.sourceforge.net</A>'=> -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">amavis-user-bounces at lists.sourceforge.net</A>' => -3.0,
+ 'spamassassin.apache.org' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">notification-return at lists.sophos.com</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">owner-postfix-users at postfix.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">owner-postfix-announce at postfix.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">owner-sendmail-announce at lists.sendmail.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">sendmail-announce-request at lists.sendmail.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">donotreply at sendmail.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">ca+envelope at sendmail.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">noreply at freshmeat.net</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">owner-technews at postel.acm.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">ietf-123-owner at loki.ietf.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">cvs-commits-list-admin at gnome.org</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">rt-users-admin at lists.fsck.com</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">clp-request at comp.nus.edu.sg</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">surveys-errors at lists.nua.ie</A>' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">emailnews at genomeweb.com</A>' => -5.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">yahoo-dev-null at yahoo-inc.com</A>' => -3.0,
+ 'returns.groups.yahoo.com' => -3.0,
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">clusternews at linuxnetworx.com</A>' => -3.0,
+ lc('<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">lvs-users-admin at LinuxVirtualServer.org</A>') => -3.0,
+ lc('<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">owner-textbreakingnews at CNNIMAIL12.CNN.COM</A>') => -5.0,
+
+ # soft-blacklisting (positive score)
+ '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">sender at example.net</A>' => 3.0,
+ '.example.net' => 1.0,
+
+ },
+ ], # end of site-wide tables
+});
+
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at decoders</A> = (
+ ['mail', \&do_mime_decode],
+ ['asc', \&do_ascii],
+ ['uue', \&do_ascii],
+ ['hqx', \&do_ascii],
+ ['ync', \&do_ascii],
+ ['F', \&do_uncompress, ['unfreeze','freeze -d','melt','fcat'] ],
+ ['Z', \&do_uncompress, ['uncompress','gzip -d','zcat'] ],
+ ['gz', \&do_uncompress, 'gzip -d'],
+ ['gz', \&do_gunzip],
+ ['bz2', \&do_uncompress, 'bzip2 -d'],
+ ['lzo', \&do_uncompress, 'lzop -d'],
+ ['rpm', \&do_uncompress, ['rpm2cpio.pl','rpm2cpio'] ],
+ ['cpio', \&do_pax_cpio, ['pax','gcpio','cpio'] ],
+ ['tar', \&do_pax_cpio, ['pax','gcpio','cpio'] ],
+ ['deb', \&do_ar, 'ar'],
+# ['a', \&do_ar, 'ar'], # unpacking .a seems an overkill
+ ['zip', \&do_unzip],
+ ['7z', \&do_7zip, ['7zr','7za','7z'] ],
+ ['rar', \&do_unrar, ['rar','unrar'] ],
+ ['arj', \&do_unarj, ['arj','unarj'] ],
+ ['arc', \&do_arc, ['nomarch','arc'] ],
+ ['zoo', \&do_zoo, ['zoo','unzoo'] ],
+ ['lha', \&do_lha, 'lha'],
+# ['doc', \&do_ole, 'ripole'],
+ ['cab', \&do_cabextract, 'cabextract'],
+ ['tnef', \&do_tnef_ext, 'tnef'],
+ ['tnef', \&do_tnef],
+# ['sit', \&do_unstuff, 'unstuff'], # broken/unsafe decoder
+ ['exe', \&do_executable, ['rar','unrar'], 'lha', ['arj','unarj'] ],
+);
+
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at av_scanners</A> = (
+
+# ### <A HREF="http://www.clanfield.info/sophie/">http://www.clanfield.info/sophie/</A> (<A HREF="http://www.vanja.com/tools/sophie/">http://www.vanja.com/tools/sophie/</A>)
+# ['Sophie',
+# \&ask_daemon, ["{}/\n", '/var/run/sophie'],
+# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
+# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
+
+# ### <A HREF="http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/">http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/</A>
+# ['Sophos SAVI', \&sophos_savi ],
+
+# ### <A HREF="http://www.clamav.net/">http://www.clamav.net/</A>
+# ['ClamAV-clamd',
+# \&ask_daemon, ["CONTSCAN {}\n", "/var/lib/clamav/clamd.socket"],
+# qr/\bOK$/m, qr/\bFOUND$/m,
+# qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
+# # NOTE: run clamd under the same user as amavisd, or run it under its own
+# # uid such as clamav, add user clamav to the amavis group, and then add
+# # AllowSupplementaryGroups to clamd.conf;
+# # NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
+# # this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
+
+# ### <A HREF="http://www.clamav.net/">http://www.clamav.net/</A> and CPAN (memory-hungry! clamd is preferred)
+# # note that Mail::ClamAV requires perl to be build with threading!
+# ['Mail::ClamAV', \&ask_clamav, "*", [0], [1], qr/^INFECTED: (.+)/m ],
+
+# ### <A HREF="http://www.openantivirus.org/">http://www.openantivirus.org/</A>
+# ['OpenAntiVirus ScannerDaemon (OAV)',
+# \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
+# qr/^OK/m, qr/^FOUND: /m, qr/^FOUND: (.+)/m ],
+
+# ### <A HREF="http://www.vanja.com/tools/trophie/">http://www.vanja.com/tools/trophie/</A>
+# ['Trophie',
+# \&ask_daemon, ["{}/\n", '/var/run/trophie'],
+# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
+# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
+
+# ### <A HREF="http://www.grisoft.com/">http://www.grisoft.com/</A>
+# ['AVG Anti-Virus',
+# \&ask_daemon, ["SCAN {}\n", '127.0.0.1:55555'],
+# qr/^200/m, qr/^403/m, qr/^403 .*?: ([^\r\n]+)/m ],
+
+# ### <A HREF="http://www.f-prot.com/">http://www.f-prot.com/</A>
+# ['F-Prot fpscand', # F-PROT Antivirus for BSD/Linux/Solaris, version 6
+# \&ask_daemon,
+# ["SCAN FILE {}/*\n", '127.0.0.1:10200'],
+# qr/^(0|8|64) /m,
+# qr/^([1235679]|1[01345]) |<[^>:]*(?i)(infected|suspicious|unwanted)/m,
+# qr/(?i)<[^>:]*(?:infected|suspicious|unwanted)[^>:]*: ([^>]*)>/m ],
+
+# ### <A HREF="http://www.f-prot.com/">http://www.f-prot.com/</A>
+# ['F-Prot f-protd', # old version
+# \&ask_daemon,
+# ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n",
+# ['127.0.0.1:10200', '127.0.0.1:10201', '127.0.0.1:10202',
+# '127.0.0.1:10203', '127.0.0.1:10204'] ],
+# qr/(?i)<summary[^>]*>clean<\/summary>/m,
+# qr/(?i)<summary[^>]*>infected<\/summary>/m,
+# qr/(?i)<name>(.+)<\/name>/m ],
+
+# ### <A HREF="http://www.sald.com/,">http://www.sald.com/,</A> <A HREF="http://www.dials.ru/english/,">http://www.dials.ru/english/,</A> <A HREF="http://www.drweb.ru/">http://www.drweb.ru/</A>
+# ['DrWebD', \&ask_daemon, # DrWebD 4.31 or later
+# [pack('N',1). # DRWEBD_SCAN_CMD
+# pack('N',0x00280001). # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES
+# pack('N', # path length
+# length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
+# '{}/*'. # path
+# pack('N',0). # content size
+# pack('N',0),
+# '/var/drweb/run/drwebd.sock',
+# # '/var/lib/amavis/var/run/drwebd.sock', # suitable for chroot
+# # '/usr/local/drweb/run/drwebd.sock', # FreeBSD drweb ports default
+# # '127.0.0.1:3000', # or over an inet socket
+# ],
+# qr/\A\x00[\x10\x11][\x00\x10]\x00/sm, # IS_CLEAN,EVAL_KEY; SKIPPED
+# qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/sm,# KNOWN_V,UNKNOWN_V,V._MODIF
+# qr/\A.{12}(?:infected with )?([^\x00]+)\x00/sm,
+# ],
+# # NOTE: If using amavis-milter, change length to:
+# # length("$TEMPBASE/amavis-milter-xxxxxxxxxxxxxx/parts/pxxx").
+
+ ### <A HREF="http://www.kaspersky.com/">http://www.kaspersky.com/</A> (kav4mailservers)
+ ['KasperskyLab AVP - aveclient',
+ ['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
+ '/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
+ '-p /var/run/aveserver -s {}/*',
+ [0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
+ qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
+ ],
+ # NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
+ # currupted or protected archives are to be handled
+
+ ### <A HREF="http://www.kaspersky.com/">http://www.kaspersky.com/</A>
+ ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'],
+ '-* -P -B -Y -O- {}', [0,3,6,8], [2,4], # any use for -A -K ?
+ qr/infected: (.+)/m,
+ sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
+ sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
+ ],
+
+ ### The kavdaemon and AVPDaemonClient have been removed from Kasperky
+ ### products and replaced by aveserver and aveclient
+ ['KasperskyLab AVPDaemonClient',
+ [ '/opt/AVP/kavdaemon', 'kavdaemon',
+ '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
+ '/opt/AVP/AvpTeamDream', 'AvpTeamDream',
+ '/opt/AVP/avpdc', 'avpdc' ],
+ "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/m ],
+ # change the startup-script in /etc/init.d/kavd to:
+ # DPARMS="-* -Y -dl -f=/var/lib/amavis /var/lib/amavis"
+ # (or perhaps: DPARMS="-I0 -Y -* /var/lib/amavis" )
+ # adjusting /var/lib/amavis above to match your $TEMPBASE.
+ # The '-f=/var/lib/amavis' is needed if not running it as root, so it
+ # can find, read, and write its pid file, etc., see 'man kavdaemon'.
+ # defUnix.prf: there must be an entry "*/var/lib/amavis" (or whatever
+ # directory $TEMPBASE specifies) in the 'Names=' section.
+ # cd /opt/AVP/DaemonClients; configure; cd Sample; make
+ # cp AvpDaemonClient /opt/AVP/
+ # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}"
+
+ ### <A HREF="http://www.centralcommand.com/">http://www.centralcommand.com/</A>
+ ['CentralCommand Vexira (new) vascan',
+ ['vascan','/usr/lib/Vexira/vascan'],
+ "-a s --timeout=60 --temp=$TEMPBASE -y $QUARANTINEDIR ".
+ "--log=/var/log/vascan.log {}",
+ [0,3], [1,2,5],
+ qr/(?x)^\s* (?:virus|iworm|macro|mutant|sequence|trojan)\ found:\ ( [^\]\s']+ )\ \.\.\.\ /m ],
+ # Adjust the path of the binary and the virus database as needed.
+ # 'vascan' does not allow to have the temp directory to be the same as
+ # the quarantine directory, and the quarantine option can not be disabled.
+ # If $QUARANTINEDIR is not used, then another directory must be specified
+ # to appease 'vascan'. Move status 3 to the second list if password
+ # protected files are to be considered infected.
+
+ ### <A HREF="http://www.avira.com/">http://www.avira.com/</A>
+ ### Avira AntiVir (formerly H+BEDV) or (old) CentralCommand Vexira Antivirus
+ ['Avira AntiVir', ['antivir','vexira'],
+ '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/m,
+ qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
+ (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/m ],
+ # NOTE: if you only have a demo version, remove -z and add 214, as in:
+ # '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
+
+ ### <A HREF="http://www.commandsoftware.com/">http://www.commandsoftware.com/</A>
+ ['Command AntiVirus for Linux', 'csav',
+ '-all -archive -packed {}', [50], [51,52,53],
+ qr/Infection: (.+)/m ],
+
+ ### <A HREF="http://www.symantec.com/">http://www.symantec.com/</A>
+ ['Symantec CarrierScan via Symantec CommandLineScanner',
+ 'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
+ qr/^Files Infected:\s+0$/m, qr/^Infected\b/m,
+ qr/^(?:Info|Virus Name):\s+(.+)/m ],
+
+ ### <A HREF="http://www.symantec.com/">http://www.symantec.com/</A>
+ ['Symantec AntiVirus Scan Engine',
+ 'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}',
+ [0], qr/^Infected\b/m,
+ qr/^(?:Info|Virus Name):\s+(.+)/m ],
+ # NOTE: check options and patterns to see which entry better applies
+
+# ### <A HREF="http://www.f-secure.com/products/anti-virus/">http://www.f-secure.com/products/anti-virus/</A> version 4.65
+# ['F-Secure Antivirus for Linux servers',
+# ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
+# '--delete=no --disinf=no --rename=no --archive=yes --auto=yes '.
+# '--dumb=yes --list=no --mime=yes {}', [0], [3,6,8],
+# qr/(?:infection|Infected|Suspected): (.+)/m ],
+
+ ### <A HREF="http://www.f-secure.com/products/anti-virus/">http://www.f-secure.com/products/anti-virus/</A> version 5.52
+ ['F-Secure Antivirus for Linux servers',
+ ['/opt/f-secure/fsav/bin/fsav', 'fsav'],
+ '--virus-action1=report --archive=yes --auto=yes '.
+ '--dumb=yes --list=no --mime=yes {}', [0], [3,4,6,8],
+ qr/(?:infection|Infected|Suspected|Riskware): (.+)/m ],
+ # NOTE: internal archive handling may be switched off by '--archive=no'
+ # to prevent fsav from exiting with status 9 on broken archives
+
+# ### <A HREF="http://www.avast.com/">http://www.avast.com/</A>
+# ['avast! Antivirus daemon',
+# \&ask_daemon, # greets with 220, terminate with QUIT
+# ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'],
+# qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
+
+# ### <A HREF="http://www.avast.com/">http://www.avast.com/</A>
+# ['avast! Antivirus - Client/Server Version', 'avastlite',
+# '-a /var/run/avast4/mailscanner.sock -n {}', [0], [1],
+# qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
+
+ ['CAI InoculateIT', 'inocucmd', # retired product
+ '-sec -nex {}', [0], [100],
+ qr/was infected by virus (.+)/m ],
+ # see: <A HREF="http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html">http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html</A>
+
+ ### <A HREF="http://www3.ca.com/Solutions/Product.asp?ID=156">http://www3.ca.com/Solutions/Product.asp?ID=156</A> (ex InoculateIT)
+ ['CAI eTrust Antivirus', 'etrust-wrapper',
+ '-arc -nex -spm h {}', [0], [101],
+ qr/is infected by virus: (.+)/m ],
+ # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer
+ # see <A HREF="http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783">http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783</A>
+
+ ### <A HREF="http://mks.com.pl/english.html">http://mks.com.pl/english.html</A>
+ ['MkS_Vir for Linux (beta)', ['mks32','mks'],
+ '-s {}/*', [0], [1,2],
+ qr/--[ \t]*(.+)/m ],
+
+ ### <A HREF="http://mks.com.pl/english.html">http://mks.com.pl/english.html</A>
+ ['MkS_Vir daemon', 'mksscan',
+ '-s -q {}', [0], [1..7],
+ qr/^... (\S+)/m ],
+
+# ### <A HREF="http://www.nod32.com/,">http://www.nod32.com/,</A> version v2.52 (old)
+# ['ESET NOD32 for Linux Mail servers',
+# ['/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
+# '--subdir --files -z --sfx --rtp --adware --unsafe --pattern --heur '.
+# '-w -a --action-on-infected=accept --action-on-uncleanable=accept '.
+# '--action-on-notscanned=accept {}',
+# [0,3], [1,2], qr/virus="([^"]+)"/m ],
+
+# ### <A HREF="http://www.eset.com/,">http://www.eset.com/,</A> version v2.7 (old)
+# ['ESET NOD32 Linux Mail Server - command line interface',
+# ['/usr/bin/nod32cli', '/opt/eset/nod32/bin/nod32cli', 'nod32cli'],
+# '--subdir {}', [0,3], [1,2], qr/virus="([^"]+)"/m ],
+
+# ### <A HREF="http://www.eset.com/,">http://www.eset.com/,</A> version 2.71.12
+# ['ESET Software ESETS Command Line Interface',
+# ['/usr/bin/esets_cli', 'esets_cli'],
+# '--subdir {}', [0], [1,2,3], qr/virus="([^"]+)"/m ],
+
+ ### <A HREF="http://www.eset.com/,">http://www.eset.com/,</A> version 3.0
+ ['ESET Software ESETS Command Line Interface',
+ ['/usr/bin/esets_cli', 'esets_cli'],
+ '--subdir {}', [0], [1,2,3],
+ qr/:\s*action="(?!accepted)[^"]*"\n.*:\s*virus="([^"]*)"/m ],
+
+ ## <A HREF="http://www.nod32.com/,">http://www.nod32.com/,</A> NOD32LFS version 2.5 and above
+ ['ESET NOD32 for Linux File servers',
+ ['/opt/eset/nod32/sbin/nod32','nod32'],
+ '--files -z --mail --sfx --rtp --adware --unsafe --pattern --heur '.
+ '-w -a --action=1 -b {}',
+ [0], [1,10], qr/^object=.*, virus="(.*?)",/m ],
+
+# Experimental, based on posting from Rado Dibarbora (Dibo) on 2002-05-31
+# ['ESET Software NOD32 Client/Server (NOD32SS)',
+# \&ask_daemon2, # greets with 200, persistent, terminate with QUIT
+# ["SCAN {}/*\r\n", '127.0.0.1:8448' ],
+# qr/^200 File OK/m, qr/^201 /m, qr/^201 (.+)/m ],
+
+ ### <A HREF="http://www.norman.com/products_nvc.shtml">http://www.norman.com/products_nvc.shtml</A>
+ ['Norman Virus Control v5 / Linux', 'nvcc',
+ '-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14],
+ qr/(?i).* virus in .* -> \'(.+)\'/m ],
+
+ ### <A HREF="http://www.pandasoftware.com/">http://www.pandasoftware.com/</A>
+ ['Panda CommandLineSecure 9 for Linux',
+ ['/opt/pavcl/usr/bin/pavcl','pavcl'],
+ '-auto -aex -heu -cmp -nbr -nor -nos -eng -nob {}',
+ qr/Number of files infected[ .]*: 0+(?!\d)/m,
+ qr/Number of files infected[ .]*: 0*[1-9]/m,
+ qr/Found virus :\s*(\S+)/m ],
+ # NOTE: for efficiency, start the Panda in resident mode with 'pavcl -tsr'
+ # before starting amavisd - the bases are then loaded only once at startup.
+ # To reload bases in a signature update script:
+ # /opt/pavcl/usr/bin/pavcl -tsr -ulr; /opt/pavcl/usr/bin/pavcl -tsr
+ # Please review other options of pavcl, for example:
+ # -nomalw, -nojoke, -nodial, -nohackt, -nospyw, -nocookies
+
+# ### <A HREF="http://www.pandasoftware.com/">http://www.pandasoftware.com/</A>
+# ['Panda Antivirus for Linux', ['pavcl'],
+# '-TSR -aut -aex -heu -cmp -nbr -nor -nso -eng {}',
+# [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0],
+# qr/Found virus :\s*(\S+)/m ],
+
+# GeCAD AV technology is acquired by Microsoft; RAV has been discontinued.
+# Check your RAV license terms before fiddling with the following two lines!
+# ['GeCAD RAV AntiVirus 8', 'ravav',
+# '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/m ],
+# # NOTE: the command line switches changed with scan engine 8.5 !
+# # (btw, assigning stdin to /dev/null causes RAV to fail)
+
+ ### <A HREF="http://www.nai.com/">http://www.nai.com/</A>
+ ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
+ '--secure -rv --mime --summary --noboot - {}', [0], [13],
+ qr/(?x) Found (?:
+ \ the\ (.+)\ (?:virus|trojan) |
+ \ (?:virus|trojan)\ or\ variant\ ([^ ]+) |
+ :\ (.+)\ NOT\ a\ virus)/m,
+ # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
+ # sub {delete $ENV{LD_PRELOAD}},
+ ],
+ # NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before
+ # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6
+ # and then clear it when finished to avoid confusing anything else.
+ # NOTE2: to treat encrypted files as viruses replace the [13] with:
+ # qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/
+
+ ### <A HREF="http://www.virusbuster.hu/en/">http://www.virusbuster.hu/en/</A>
+ ['VirusBuster', ['vbuster', 'vbengcl'],
+ "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
+ qr/: '(.*)' - Virus/m ],
+ # VirusBuster Ltd. does not support the daemon version for the workstation
+ # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of
+ # binaries, some parameters AND return codes have changed (from 3 to 1).
+ # See also the new Vexira entry 'vascan' which is possibly related.
+
+# ### <A HREF="http://www.virusbuster.hu/en/">http://www.virusbuster.hu/en/</A>
+# ['VirusBuster (Client + Daemon)', 'vbengd',
+# '-f -log scandir {}', [0], [3],
+# qr/Virus found = (.*);/m ],
+# # HINT: for an infected file it always returns 3,
+# # although the man-page tells a different story
+
+ ### <A HREF="http://www.cyber.com/">http://www.cyber.com/</A>
+ ['CyberSoft VFind', 'vfind',
+ '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/m,
+ # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'},
+ ],
+
+ ### <A HREF="http://www.avast.com/">http://www.avast.com/</A>
+ ['avast! Antivirus', ['/usr/bin/avastcmd','avastcmd'],
+ '-a -i -n -t=A {}', [0], [1], qr/\binfected by:\s+([^ \t\n\[\]]+)/m ],
+
+ ### <A HREF="http://www.ikarus-software.com/">http://www.ikarus-software.com/</A>
+ ['Ikarus AntiVirus for Linux', 'ikarus',
+ '{}', [0], [40], qr/Signature (.+) found/m ],
+
+ ### <A HREF="http://www.bitdefender.com/">http://www.bitdefender.com/</A>
+ ['BitDefender', 'bdscan', # new version
+ '--action=ignore --no-list {}', qr/^Infected files\s*:\s*0+(?!\d)/m,
+ qr/^(?:Infected files|Identified viruses|Suspect files)\s*:\s*0*[1-9]/m,
+ qr/(?:suspected|infected)\s*:\s*(.*)(?:\033|$)/m ],
+
+ ### <A HREF="http://www.bitdefender.com/">http://www.bitdefender.com/</A>
+ ['BitDefender', 'bdc', # old version
+ '--arc --mail {}', qr/^Infected files *:0+(?!\d)/m,
+ qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/m,
+ qr/(?:suspected|infected): (.*)(?:\033|$)/m ],
+ # consider also: --all --nowarn --alev=15 --flev=15. The --all argument may
+ # not apply to your version of bdc, check documentation and see 'bdc --help'
+
+ ### ArcaVir for Linux and Unix <A HREF="http://www.arcabit.pl/">http://www.arcabit.pl/</A>
+ ['ArcaVir for Linux', ['arcacmd','arcacmd.static'],
+ '-v 1 -summary 0 -s {}', [0], [1,2],
+ qr/(?:VIR|WIR):[ \t]*(.+)/m ],
+
+# ### a generic SMTP-client interface to a SMTP-based virus scanner
+# ['av_smtp', \&ask_av_smtp,
+# ['{}', 'smtp:[127.0.0.1]:5525', '<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">dummy at localhost</A>'],
+# qr/^2/, qr/^5/, qr/^\s*(.*?)\s*$/m ],
+
+# ['File::Scan', sub {Amavis::AV::ask_av(sub{
+# use File::Scan; my($fn)=@_;
+# my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0);
+# my($vname) = $f->scan($fn);
+# $f->error ? (2,"Error: ".$f->error)
+# : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) },
+# ["{}/*"], [0], [1], qr/^(.*) FOUND$/m ],
+
+# ### fully-fledged checker for JPEG marker segments of invalid length
+# ['check-jpeg',
+# sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) },
+# ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/m ],
+# # NOTE: place file JpegTester.pm somewhere where Perl can find it,
+# # for example in /usr/local/lib/perl5/site_perl
+
+);
+
+
<A HREF="https://www.mageia.org/mailman/listinfo/mageia-sysadm">+ at av_scanners_backup</A> = (
+
+ ### <A HREF="http://www.clamav.net/">http://www.clamav.net/</A> - backs up clamd or Mail::ClamAV
+ ['ClamAV-clamscan', 'clamscan',
+ "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
+ [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
+
+ ### <A HREF="http://www.f-prot.com/">http://www.f-prot.com/</A> - backs up F-Prot Daemon, V6
+ ['F-PROT Antivirus for UNIX', ['fpscan'],
+ '--report --mount --adware {}', # consider: --applications -s 4 -u 3 -z 10
+ [0,8,64], [1,2,3, 4+1,4+2,4+3, 8+1,8+2,8+3, 12+1,12+2,12+3],
+ qr/^\[Found\s+[^\]]*\]\s+<([^ \t(>]*)/m ],
+
+ ### <A HREF="http://www.f-prot.com/">http://www.f-prot.com/</A> - backs up F-Prot Daemon (old)
+ ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
+ '-dumb -archive -packed {}', [0,8], [3,6], # or: [0], [3,6,8],
+ qr/(?:Infection:|security risk named) (.+)|\s+contains\s+(.+)$/m ],
+
+ ### <A HREF="http://www.trendmicro.com/">http://www.trendmicro.com/</A> - backs up Trophie
+ ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
+ '-za -a {}', [0], qr/Found virus/m, qr/Found virus (.+) in/m ],
+
+ ### <A HREF="http://www.sald.com/,">http://www.sald.com/,</A> <A HREF="http://drweb.imshop.de/">http://drweb.imshop.de/</A> - backs up DrWebD
+ ['drweb - DrWeb Antivirus', # security LHA hole in Dr.Web 4.33 and earlier
+ ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
+ '-path={} -al -go -ot -cn -upn -ok-',
+ [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'m ],
+
+ ### <A HREF="http://www.kaspersky.com/">http://www.kaspersky.com/</A>
+ ['Kaspersky Antivirus v5.5',
+ ['/opt/kaspersky/kav4fs/bin/kav4fs-kavscanner',
+ '/opt/kav/5.5/kav4unix/bin/kavscanner',
+ '/opt/kav/5.5/kav4mailservers/bin/kavscanner', 'kavscanner'],
+ '-i0 -xn -xp -mn -R -ePASBME {}/*', [0,10,15], [5,20,21,25],
+ qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.*)/m,
+# sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"},
+# sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
+ ],
+
+# Commented out because the name 'sweep' clashes with Debian and FreeBSD
+# package/port of an audio editor. Make sure the correct 'sweep' is found
+# in the path when enabling.
+#
+# ### <A HREF="http://www.sophos.com/">http://www.sophos.com/</A> - backs up Sophie or SAVI-Perl
+# ['Sophos Anti Virus (sweep)', 'sweep',
+# '-nb -f -all -rec -ss -sc -archive -cab -mime -oe -tnef '.
+# '--no-reset-atime {}',
+# [0,2], qr/Virus .*? found/m,
+# qr/^>>> Virus(?: fragment)? '?(.*?)'? found/m,
+# ],
+# # other options to consider: -idedir=/usr/local/sav
+
+# Always succeeds and considers mail clean.
+# Potentially useful when all other scanners fail and it is desirable
+# to let mail continue to flow with no virus checking (when uncommented).
+# ['always-clean', sub {0}],
+
+);
+
+
+1; # insure a defined return value
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/mageia-sysadm/attachments/20101123/05af655e/attachment-0001.html>
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="000834.html">[Mageia-sysadm] [412] - it is IMHO cleaner and logical to have apache:: vhost_other_app directly requiring apache:: base rather than letting every people adding it when using the class
</A></li>
<LI>Next message: <A HREF="000810.html">[Mageia-sysadm] [414] - add spamassassin module
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#814">[ date ]</a>
<a href="thread.html#814">[ thread ]</a>
<a href="subject.html#814">[ subject ]</a>
<a href="author.html#814">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-sysadm">More information about the Mageia-sysadm
mailing list</a><br>
</body></html>
|
