source: npl/mailserver/amavisd-new/amavisd.conf

Last change on this file was 929bb42, checked in by Edwin Eefting <edwin@datux.nl>, 3 years ago

trying kernel 5.14
  • Property mode set to 100755
File size: 24.2 KB
RevLine 
[c5c522c]1use strict;
2$ENV{PATH}='';
3# a minimalistic configuration file for amavisd-new with all necessary settings
4#
5#   see amavisd.conf-default for a list of all variables with their defaults;
6#   see amavisd.conf-sample for a traditional-style commented file;
7#   for more details see documentation in INSTALL, README_FILES/*
8#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
9
10
11# COMMONLY ADJUSTED SETTINGS:
12
13# @bypass_virus_checks_maps = (1);  # uncomment to DISABLE anti-virus code
14 @bypass_spam_checks_maps  = (1);  # uncomment to DISABLE anti-spam code
15
16$max_servers = 5;            # number of pre-forked children (2..15 is common)
17$daemon_user  = 'amavis';     # (no default;  customary: vscan or amavis)
18$daemon_group = 'amavis';     # (no default;  customary: vscan or amavis)
19
20$mydomain = `/bin/hostname -f`;   # a convenient default for other settings
21chomp($mydomain);
22
23$MYHOME   = '/home/system/amavis';   # a convenient default for other settings
24$TEMPBASE = "$MYHOME";   # working directory, needs to be created manually
25$ENV{TMPDIR} = $TEMPBASE;    # environment variable TMPDIR
26$QUARANTINEDIR = '/home/system/amavis/virusmails';
27
28# $daemon_chroot_dir = $MYHOME;   # chroot directory or undef
29
30# $db_home   = "$MYHOME/db";
31# $helpers_home = "$MYHOME/var";  # prefer $MYHOME clean and owned by root?
32# $pid_file  = "$MYHOME/var/amavisd.pid";
33# $lock_file = "$MYHOME/var/amavisd.lock";
34#NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually
35
36
37
38
39read_hash(\%local_domains, '/var/qmail/control/rcpthosts');
40#@local_domains_maps =  read_hash(\%local_domains, '/var/qmail/control/rcpthosts');
41#print $local_domains_maps;
42# @mynetworks = qw( 127.0.0.0/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );
43
44$log_level = 2;              # verbosity 0..5
45$log_recip_templ = undef;    # disable by-recipient level-0 log entries
46$DO_SYSLOG = 1;              # log via syslogd (preferred)
47$SYSLOG_LEVEL = 'mail.debug';
48
49$enable_db = 0;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
50$enable_global_cache = 0;    # enable use of libdb-based cache if $enable_db=1
51
52$protocol = 'QMQPqq';        # suggested protocol to use on all input sockets
53$inet_socket_port = 628;   # accept connections on this local TCP port(s)
54
55# $unix_socketname = "$MYHOME/amavisd.sock";  # when using sendmail milter
56
57$sa_tag_level_deflt  = 2.0;  # add spam info headers if at, or above that level
58$sa_tag2_level_deflt = 6.31; # add 'spam detected' headers at that level
59$sa_kill_level_deflt = 6.31; # triggers spam evasive actions
60$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
61
62$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
63$sa_local_tests_only = 0;    # only tests which do not require internet access?
64$sa_auto_whitelist = 1;      # turn on AWL in SA 2.63 or older (irrelevant
65                             # for SA 3.0, cf option is 'use_auto_whitelist')
66
67# @lookup_sql_dsn =
68#   ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'],
69#     ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'] );
70
71#$virus_admin = "virusalert\@$mydomain";  # notifications recip.
72#$pname = "virusalert";
73
74$mailfrom_notify_sender = "virusalert\@$mydomain";  # notifications sender
75#$mailfrom_notify_admin = "virusalert\@$mydomain";  # notifications sender
76$mailfrom_notify_recip = "virusalert\@$mydomain";  # notifications sender
77$mailfrom_notify_spamadmin = "spam.police\@$mydomain"; # notifications sender
78$mailfrom_to_quarantine = ''; # null return path; uses original sender if undef
79
80@addr_extension_virus_maps      = ('virus');
81@addr_extension_spam_maps       = ('spam');
82@addr_extension_banned_maps     = ('banned');
83@addr_extension_bad_header_maps = ('badh');
84# $recipient_delimiter = '+';  # undef disables address extensions altogether
85# when enabling addr extensions do also Postfix/main.cf: recipient_delimiter=+
86
87$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
88$file   = 'file';   # file(1) utility; use recent versions
89$gzip   = 'gzip';
90$bzip2  = 'bzip2';
91$lzop   = 'lzop';
92$rpm2cpio   = ['rpm2cpio.pl','rpm2cpio'];
93$cabextract = 'cabextract';
94$uncompress = ['uncompress', 'gzip -d', 'zcat'];
95$unfreeze   = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
96$arc        = ['nomarch', 'arc'];
97$unarj      = ['arj', 'unarj'];
98$unrar      = ['rar', 'unrar'];
99$zoo    = 'zoo';
100$lha    = 'lha';
101$pax    = 'pax';
102$cpio   = ['gcpio','cpio'];
103$ar     = 'ar';
104$ripole = 'ripole';
105$dspam  = 'dspam';
106
107$MAXLEVELS = 14;
108$MAXFILES = 1500;
109$MIN_EXPANSION_QUOTA =      100*1024;  # bytes  (default undef, not enforced)
110$MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes  (default undef, not enforced)
111
112$sa_spam_subject_tag = '***SPAM*** ';
113$defang_virus  = 1;  # MIME-wrap passed infected mail
114$defang_banned = 1;  # MIME-wrap passed mail containing banned name
115
116
117# OTHER MORE COMMON SETTINGS (defaults may suffice):
118
119# $myhostname = 'host.example.com';  # must be a fully-qualified domain name!
120$notify_method  = 'pipe:/var/qmail/bin/qmail-inject -f ${sender} ${recipient} ';
121$forward_method = "$notify_method";
122
123 $final_virus_destiny      = D_REJECT;
124 $final_banned_destiny     = D_REJECT;
125 $final_spam_destiny       = D_PASS;
126 $final_bad_header_destiny = D_PASS;
127
128
129# SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all)
130
131
132# Notify virus (or banned files) RECIPIENT?
133#  (not very useful, but some policies demand it)
134$warnvirusrecip = 1;    # (defaults to false (undef))
135$warnbannedrecip = 0;   # (defaults to false (undef))
136$warnbadhrecip = 1;
137$warnvirussender = 0;
138$warnbannedsender = 0;
139
140# Notify also non-local virus/banned recipients if $warn*recip is true?
141#  (including those not matching local_domains*)
142$warn_offsite = 0;      # (defaults to false (undef), i.e. only notify locals)
143
144
145
146#, $warnbannedrecip, $warnbadhrecip, (or @warn*recip_maps)
147#
148# @bypass_virus_checks_maps, @bypass_spam_checks_maps,
149# @bypass_banned_checks_maps, @bypass_header_checks_maps,
150#
151# @virus_lovers_maps, @spam_lovers_maps,
152# @banned_files_lovers_maps, @bad_header_lovers_maps,
153#
154# @blacklist_sender_maps, @score_sender_maps,
155#
156# $virus_quarantine_to, $banned_quarantine_to,
157# $bad_header_quarantine_to, $spam_quarantine_to,
158#
159# $defang_bad_header, $defang_undecipherable, $defang_spam
160
161
162# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
163
164@viruses_that_fake_sender_maps = (new_RE(
165 [qr'\bEICAR\b'i => 0],            # av test pattern name
166# [qr'^(WM97|OF97|Joke\.)'i => 0],  # adjust names to match your AV scanner
167  [qr/.*/ => 1],  # true for everything else
168));
169
170@keep_decoded_original_maps = (new_RE(
171# qr'^MAIL$',   # retain full original message for virus checking (can be slow)
172  qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
173  qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
174# qr'^Zip archive data',     # don't trust Archive::Zip
175));
176
177
178# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample
179
180$banned_filename_re = new_RE(
181  qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
182
183  # block certain double extensions anywhere in the base name
184  qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
185
186  qr'[{}]',      # curly braces in names (serve as Class ID extensions - CLSID)
187
188  qr'^application/x-msdownload$'i,                  # block these MIME types
189  qr'^application/x-msdos-program$'i,
190  qr'^application/hta$'i,
191
192 qr'^message/partial$'i, qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
193
194# [ qr'^\.(Z|gz|bz2)$'           => 0 ],  # allow any in Unix-compressed
195  [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives
196# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within such archives
197
[929bb42]198  qr'.\.(js|vbs|pif|scr|bat|cmd|com|cpl|xlsm)$'i, # banned extension - basic
[c5c522c]199# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
200#        inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
201#        ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
202#        wmf|wsc|wsf|wsh)$'ix,  # banned ext - long
203
204# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.
205
206  qr'^\.(exe-ms)$',                       # banned file(1) types
207# qr'^\.(exe|lha|tnef|cab|dll)$',         # banned file(1) types
208);
209# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
210# and http://www.cknow.com/vtutor/vtextensions.htm
211
212
213# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
214
215@score_sender_maps = ({ # a by-recipient hash lookup table,
216                        # results from all matching recipient tables are summed
217
218# ## per-recipient personal tables  (NOTE: positive: black, negative: white)
219# 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],
220# 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],
221# 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,
222#                           '.cleargreen.com'           => -5.0}],
223
224  ## site-wide opinions about senders (the '.' matches any recipient)
225  '.' => [  # the _first_ matching sender determines the score boost
226
227   new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
228    [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
229    [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
230    [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
231    [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
232    [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
233    [qr'^(your_friend|greatoffers)@'i                                => 5.0],
234    [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
235   ),
236
237#  read_hash("/var/amavis/sender_scores_sitewide"),
238
239   { # a hash-type lookup table (associative array)
240     'nobody@cert.org'                        => -3.0,
241     'cert-advisory@us-cert.gov'              => -3.0,
242     'owner-alert@iss.net'                    => -3.0,
243     'slashdot@slashdot.org'                  => -3.0,
244     'bugtraq@securityfocus.com'              => -3.0,
245     'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,
246     'security-alerts@linuxsecurity.com'      => -3.0,
247     'mailman-announce-admin@python.org'      => -3.0,
248     'amavis-user-admin@lists.sourceforge.net'=> -3.0,
249     'notification-return@lists.sophos.com'   => -3.0,
250     'owner-postfix-users@postfix.org'        => -3.0,
251     'owner-postfix-announce@postfix.org'     => -3.0,
252     'owner-sendmail-announce@lists.sendmail.org'   => -3.0,
253     'sendmail-announce-request@lists.sendmail.org' => -3.0,
254     'donotreply@sendmail.org'                => -3.0,
255     'ca+envelope@sendmail.org'               => -3.0,
256     'noreply@freshmeat.net'                  => -3.0,
257     'owner-technews@postel.acm.org'          => -3.0,
258     'ietf-123-owner@loki.ietf.org'           => -3.0,
259     'cvs-commits-list-admin@gnome.org'       => -3.0,
260     'rt-users-admin@lists.fsck.com'          => -3.0,
261     'clp-request@comp.nus.edu.sg'            => -3.0,
262     'surveys-errors@lists.nua.ie'            => -3.0,
263     'emailnews@genomeweb.com'                => -5.0,
264     'yahoo-dev-null@yahoo-inc.com'           => -3.0,
265     'returns.groups.yahoo.com'               => -3.0,
266     'clusternews@linuxnetworx.com'           => -3.0,
267     lc('lvs-users-admin@LinuxVirtualServer.org')    => -3.0,
268     lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,
269
270     # soft-blacklisting (positive score)
271     'sender@example.net'                     =>  3.0,
272     '.example.net'                           =>  1.0,
273
274   },
275  ],  # end of site-wide tables
276});
277
278
279@av_scanners = (
280
281# ### http://www.vanja.com/tools/sophie/
282# ['Sophie',
283#   \&ask_daemon, ["{}/\n", '/var/run/sophie'],
284#   qr/(?x)^ 0+ ( : | [\000\r\n]* $)/,  qr/(?x)^ 1 ( : | [\000\r\n]* $)/,
285#   qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/ ],
286
287# ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
288# ['Sophos SAVI', \&sophos_savi ],
289
290# ### http://www.clamav.net/
291 ['ClamAV-clamd',
292   \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd"],
293   qr/\bOK$/, qr/\bFOUND$/,
294   qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
295 # NOTE: the easiest is to run clamd under the same user as amavisd; match the
296 # socket name (LocalSocket) in clamav.conf to the socket name in this entry
297 # When running chrooted one may prefer: ["CONTSCAN {}\n","$MYHOME/clamd"],
298
299# ### http://www.clamav.net/ and CPAN  (memory-hungry! clamd is preferred)
300# ['Mail::ClamAV', \&ask_clamav, "*", [0], [1], qr/^INFECTED: (.+)/],
301
302# ### http://www.openantivirus.org/
303# ['OpenAntiVirus ScannerDaemon (OAV)',
304#   \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
305#   qr/^OK/, qr/^FOUND: /, qr/^FOUND: (.+)/ ],
306
307# ### http://www.vanja.com/tools/trophie/
308# ['Trophie',
309#   \&ask_daemon, ["{}/\n", '/var/run/trophie'],
310#   qr/(?x)^ 0+ ( : | [\000\r\n]* $)/,  qr/(?x)^ 1 ( : | [\000\r\n]* $)/,
311#   qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/ ],
312
313# ### http://www.grisoft.com/
314# ['AVG Anti-Virus',
315#   \&ask_daemon, ["SCAN {}\n", '127.0.0.1:55555'],
316#   qr/^200/, qr/^403/, qr/^403 .*?: ([^\r\n]+)/ ],
317
318# ### http://www.f-prot.com/
319# ['FRISK F-Prot Daemon',
320#   \&ask_daemon,
321#   ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n",
322#     ['127.0.0.1:10200','127.0.0.1:10201','127.0.0.1:10202',
323#      '127.0.0.1:10203','127.0.0.1:10204'] ],
324#   qr/(?i)<summary[^>]*>clean<\/summary>/,
325#   qr/(?i)<summary[^>]*>infected<\/summary>/,
326#   qr/(?i)<name>(.+)<\/name>/ ],
327
328# ### http://www.sald.com/, http://www.dials.ru/english/, http://www.drweb.ru/
329# ['DrWebD', \&ask_daemon,   # DrWebD 4.31 or later
330#   [pack('N',1).  # DRWEBD_SCAN_CMD
331#    pack('N',0x00280001).   # DONT_CHANGEMAIL, IS_MAIL, RETURN_VIRUSES
332#    pack('N',     # path length
333#      length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
334#    '{}/*'.       # path
335#    pack('N',0).  # content size
336#    pack('N',0),
337#    '/var/drweb/run/drwebd.sock',
338#  # '/var/amavis/var/run/drwebd.sock',   # suitable for chroot
339#  # '/usr/local/drweb/run/drwebd.sock',  # FreeBSD drweb ports default
340#  # '127.0.0.1:3000',                    # or over an inet socket
341#   ],
342#   qr/\A\x00[\x10\x11][\x00\x10]\x00/s,         # IS_CLEAN,EVAL_KEY; SKIPPED
343#   qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/s, # KNOWN_V,UNKNOWN_V,V._MODIF
344#   qr/\A.{12}(?:infected with )?([^\x00]+)\x00/s,
345# ],
346# # NOTE: If using amavis-milter, change length to:
347# # length("$TEMPBASE/amavis-milter-xxxxxxxxxxxxxx/parts/pxxx").
348
349  ### http://www.kaspersky.com/  (in the 'file server version')
350  ['KasperskyLab AVP - aveclient',
351    ['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
352     '/opt/kav/bin/aveclient','aveclient'],
353    '-p /var/run/aveserver -s {}/*', [0,3,6,8], qr/\b(INFECTED|SUSPICION)\b/,
354    qr/(?:INFECTED|SUSPICION) (.+)/,
355  ],
356
357  ### http://www.kaspersky.com/
358  ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp'],
359    '-* -P -B -Y -O- {}', [0,3,6,8], [2,4],    # any use for -A -K   ?
360    qr/infected: (.+)/,
361    sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
362    sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
363  ],
364
365  ### The kavdaemon and AVPDaemonClient have been removed from Kasperky
366  ### products and replaced by aveserver and aveclient
367  ['KasperskyLab AVPDaemonClient',
368    [ '/opt/AVP/kavdaemon',       'kavdaemon',
369      '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
370      '/opt/AVP/AvpTeamDream',    'AvpTeamDream',
371      '/opt/AVP/avpdc', 'avpdc' ],
372    "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/ ],
373    # change the startup-script in /etc/init.d/kavd to:
374    #   DPARMS="-* -Y -dl -f=/var/amavis /var/amavis"
375    #   (or perhaps:   DPARMS="-I0 -Y -* /var/amavis" )
376    # adjusting /var/amavis above to match your $TEMPBASE.
377    # The '-f=/var/amavis' is needed if not running it as root, so it
378    # can find, read, and write its pid file, etc., see 'man kavdaemon'.
379    # defUnix.prf: there must be an entry "*/var/amavis" (or whatever
380    #   directory $TEMPBASE specifies) in the 'Names=' section.
381    # cd /opt/AVP/DaemonClients; configure; cd Sample; make
382    # cp AvpDaemonClient /opt/AVP/
383    # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}"
384
385  ### http://www.hbedv.com/ or http://www.centralcommand.com/
386  ['H+BEDV AntiVir or CentralCommand Vexira Antivirus',
387    ['antivir','vexira'],
388    '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/,
389    qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
390         (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/ ],
391    # NOTE: if you only have a demo version, remove -z and add 214, as in:
392    #  '--allfiles -noboot -nombr -rs -s {}', [0,214], qr/ALERT:|VIRUS:/,
393    # According to the documentations, the new version of Vexira has
394    # reasonable defaults, one may consider: "--timeout=60 --temp=$TEMPBASE {}"
395
396  ### http://www.commandsoftware.com/
397  ['Command AntiVirus for Linux', 'csav',
398    '-all -archive -packed {}', [50], [51,52,53],
399    qr/Infection: (.+)/ ],
400
401  ### http://www.symantec.com/
402  ['Symantec CarrierScan via Symantec CommandLineScanner',
403    'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
404    qr/^Files Infected:\s+0$/, qr/^Infected\b/,
405    qr/^(?:Info|Virus Name):\s+(.+)/ ],
406
407  ### http://www.symantec.com/
408  ['Symantec AntiVirus Scan Engine',
409    'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}',
410    [0], qr/^Infected\b/,
411    qr/^(?:Info|Virus Name):\s+(.+)/ ],
412    # NOTE: check options and patterns to see which entry better applies
413
414  ### http://www.f-secure.com/products/anti-virus/
415  ['F-Secure Antivirus', 'fsav',
416    '--dumb --mime --archive {}', [0], [3,8],
417    qr/(?:infection|Infected|Suspected): (.+)/ ],
418
419  ['CAI InoculateIT', 'inocucmd',  # retired product
420    '-sec -nex {}', [0], [100],
421    qr/was infected by virus (.+)/ ],
422  # see: http://www.flatmtn.com/computer/Linux-Antivirus_CAI.html
423
424  ### http://www3.ca.com/Solutions/Product.asp?ID=156  (ex InoculateIT)
425  ['CAI eTrust Antivirus', 'etrust-wrapper',
426    '-arc -nex -spm h {}', [0], [101],
427    qr/is infected by virus: (.+)/ ],
428    # NOTE: requires suid wrapper around inocmd32; consider flag: -mod reviewer
429    # see http://marc.theaimsgroup.com/?l=amavis-user&m=109229779912783
430
431  ### http://mks.com.pl/english.html
432  ['MkS_Vir for Linux (beta)', ['mks32','mks'],
433    '-s {}/*', [0], [1,2],
434    qr/--[ \t]*(.+)/ ],
435
436  ### http://mks.com.pl/english.html
437  ['MkS_Vir daemon', 'mksscan',
438    '-s -q {}', [0], [1..7],
439    qr/^... (\S+)/ ],
440
441  ### http://www.nod32.com/
442  ['ESET Software NOD32', 'nod32',
443    '--arch --mail {}', [0], [1,10], qr/^object=.*, virus="(.*?)",/ ],
444  # with old versions use:
445  #   '-all -subdir+ {}', [0], [1,2],
446  #   qr/^.+? - (.+?)\s*(?:backdoor|joke|trojan|virus|worm)/ ],
447
448  ### http://www.nod32.com/
449  ['ESET Software NOD32 - Client/Server Version', 'nod32cli',
450    '-a -r -d recurse --heur standard {}', [0], [10,11],
451    qr/^\S+\s+infected:\s+(.+)/ ],
452
453# Experimental, based on posting from Rado Dibarbora (Dibo) on 2002-05-31
454# ['ESET Software NOD32 Client/Server (NOD32SS)',
455#   \&ask_daemon2,    # greets with 200, persistent, terminate with QUIT
456#   ["SCAN {}/*\r\n", '127.0.0.1:8448' ],
457#   qr/^200 File OK/, qr/^201 /, qr/^201 (.+)/ ],
458
459  ### http://www.norman.com/products_nvc.shtml
460  ['Norman Virus Control v5 / Linux', 'nvcc',
461    '-c -l:0 -s -u -temp:$TEMPBASE {}', [0,10,11], [1,2,14],
462    qr/(?i).* virus in .* -> \'(.+)\'/ ],
463
464  ### http://www.pandasoftware.com/
465  ['Panda Antivirus for Linux', ['pavcl'],
466    '-aut -aex -heu -cmp -nbr -nor -nso -eng {}',
467    qr/Number of files infected[ .]*: 0+(?!\d)/,
468    qr/Number of files infected[ .]*: 0*[1-9]/,
469    qr/Found virus :\s*(\S+)/ ],
470
471# ### http://www.pandasoftware.com/
472# ['Panda Antivirus for Linux', ['pavcl'],
473#   '-TSR -aut -aex -heu -cmp -nbr -nor -nso -eng {}',
474#   [0], [0x10, 0x30, 0x50, 0x70, 0x90, 0xB0, 0xD0, 0xF0],
475#   qr/Found virus :\s*(\S+)/ ],
476
477# GeCAD AV technology is acquired by Microsoft; RAV has been discontinued.
478# Check your RAV license terms before fiddling with the following two lines!
479# ['GeCAD RAV AntiVirus 8', 'ravav',
480#   '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/ ],
481# # NOTE: the command line switches changed with scan engine 8.5 !
482# # (btw, assigning stdin to /dev/null causes RAV to fail)
483
484  ### http://www.nai.com/
485  ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
486    '--secure -rv --mime --summary --noboot - {}', [0], [13],
487    qr/(?x) Found (?:
488        \ the\ (.+)\ (?:virus|trojan)  |
489        \ (?:virus|trojan)\ or\ variant\ ([^ ]+)  |
490        :\ (.+)\ NOT\ a\ virus)/,
491  # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'},
492  # sub {delete $ENV{LD_PRELOAD}},
493  ],
494  # NOTE1: with RH9: force the dynamic linker to look at /lib/libc.so.6 before
495  # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6
496  # and then clear it when finished to avoid confusing anything else.
497  # NOTE2: to treat encrypted files as viruses replace the [13] with:
498  #  qr/^\s{5,}(Found|is password-protected|.*(virus|trojan))/
499
500  ### http://www.virusbuster.hu/en/
501  ['VirusBuster', ['vbuster', 'vbengcl'],
502    # VirusBuster Ltd. does not support the daemon version for the workstation
503    # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of
504    # binaries, some parameters AND return codes have changed (from 3 to 1).
505    "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
506    qr/: '(.*)' - Virus/ ],
507
508# ### http://www.virusbuster.hu/en/
509# ['VirusBuster (Client + Daemon)', 'vbengd',
510#   # HINT: for an infected file it always returns 3,
511#   # although the man-page tells a different story
512#   '-f -log scandir {}', [0], [3],
513#   qr/Virus found = (.*);/ ],
514
515  ### http://www.cyber.com/
516  ['CyberSoft VFind', 'vfind',
517    '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/,
518  # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'},
519  ],
520
521  ### http://www.ikarus-software.com/
522  ['Ikarus AntiVirus for Linux', 'ikarus',
523    '{}', [0], [40], qr/Signature (.+) found/ ],
524
525  ### http://www.bitdefender.com/
526  ['BitDefender', 'bdc',
527    '--all --arc --mail {}', qr/^Infected files *:0+(?!\d)/,
528    qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/,
529    qr/(?:suspected|infected): (.*)(?:\033|$)/ ],
530
531# ['File::Scan', sub {Amavis::AV::ask_av(sub{
532#   use File::Scan; my($fn)=@_;
533#   my($f)=File::Scan->new(max_txt_size=>0, max_bin_size=>0);
534#   my($vname) = $f->scan($fn);
535#   $f->error ? (2,"Error: ".$f->error)
536#   : ($vname ne '') ? (1,"$vname FOUND") : (0,"Clean")}, @_) },
537#   ["{}/*"], [0], [1], qr/^(.*) FOUND$/ ],
538
539# ### example: fully-fledged checker for JPEG marker segments of invalid length
540# ['check-jpeg',
541#   sub { use JpegTester (); Amavis::AV::ask_av(\&JpegTester::test_jpeg, @_) },
542#   ["{}/*"], undef, [1], qr/^(bad jpeg: .*)$/ ],
543# # NOTE: place file JpegTester.pm somewhere where Perl can find it,
544# #       for example in /usr/local/lib/perl5/site_perl
545
546);
547
548
549@av_scanners_backup = (
550
551  ### http://www.clamav.net/   - backs up clamd or Mail::ClamAV
552  ['ClamAV-clamscan', 'clamscan',
553    "--stdout --disable-summary -r --tempdir=$TEMPBASE {}", [0], [1],
554    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
555
556  ### http://www.f-prot.com/   - backs up F-Prot Daemon
557  ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
558    '-dumb -archive -packed {}', [0,8], [3,6],
559    qr/Infection: (.+)/ ],
560
561  ### http://www.trendmicro.com/   - backs up Trophie
562  ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
563    '-za -a {}', [0], qr/Found virus/, qr/Found virus (.+) in/ ],
564
565  ### http://www.sald.com/, http://drweb.imshop.de/   - backs up DrWebD
566  ['drweb - DrWeb Antivirus',
567    ['/usr/local/drweb/drweb', '/opt/drweb/drweb', 'drweb'],
568    '-path={} -al -go -ot -cn -upn -ok-',
569    [0,32], [1,9,33], qr' infected (?:with|by)(?: virus)? (.*)$'],
570
571  ['KasperskyLab kavscanner', ['/opt/kav/bin/kavscanner','kavscanner'],
572    '-i1 -xp {}', [0,10,15], [5,20,21,25],
573    qr/(?:CURED|INFECTED|CUREFAILED|WARNING|SUSPICION) (.*)/ ,
574    sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"},
575    sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
576  ],
577
578# Commented out because the name 'sweep' clashes with Debian and FreeBSD
579# package/port of an audio editor. Make sure the correct 'sweep' is found
580# in the path when enabling.
581#
582# ### http://www.sophos.com/   - backs up Sophie or SAVI-Perl
583# ['Sophos Anti Virus (sweep)', 'sweep',
584#   '-nb -f -all -rec -ss -sc -archive -cab -tnef --no-reset-atime {}',
585#   [0,2], qr/Virus .*? found/,
586#   qr/^>>> Virus(?: fragment)? '?(.*?)'? found/,
587# ],
588# # other options to consider: -mime -oe -idedir=/usr/local/sav
589
590# always succeeds (uncomment to consider mail clean if all other scanners fail)
591# ['always-clean', sub {0}],
592
593);
594
595
5961;  # insure a defined return
Note: See TracBrowser for help on using the repository browser.