Line 8... |
Line 8... |
8 |
|
8 |
|
9 |
|
9 |
|
10 |
# COMMONLY ADJUSTED SETTINGS:
|
10 |
# COMMONLY ADJUSTED SETTINGS:
|
11 |
|
11 |
|
12 |
# @bypass_virus_checks_maps = (1); # controls running of anti-virus code
|
12 |
# @bypass_virus_checks_maps = (1); # controls running of anti-virus code
|
13 |
@bypass_spam_checks_maps = (1); # controls running of anti-spam code
|
13 |
# @bypass_spam_checks_maps = (1); # controls running of anti-spam code
|
14 |
# $bypass_decode_parts = 1; # controls running of decoders&dearchivers
|
14 |
# $bypass_decode_parts = 1; # controls running of decoders&dearchivers
|
15 |
|
15 |
|
16 |
# $myprogram_name = $0; # set to 'amavisd' or similar to avoid process name
|
16 |
# $myprogram_name = $0; # set to 'amavisd' or similar to avoid process name
|
17 |
# truncation in /proc/<pid>/stat and ps -e output
|
17 |
# truncation in /proc/<pid>/stat and ps -e output
|
18 |
|
18 |
|
Line 33... |
Line 33... |
33 |
|
33 |
|
34 |
# $daemon_chroot_dir = $MYHOME; # chroot directory or undef, -R
|
34 |
# $daemon_chroot_dir = $MYHOME; # chroot directory or undef, -R
|
35 |
|
35 |
|
36 |
$db_home = "$MYHOME/db"; # dir for bdb nanny/cache/snmp databases, -D
|
36 |
$db_home = "$MYHOME/db"; # dir for bdb nanny/cache/snmp databases, -D
|
37 |
# $helpers_home = "$MYHOME/var"; # working directory for SpamAssassin, -S
|
37 |
# $helpers_home = "$MYHOME/var"; # working directory for SpamAssassin, -S
|
38 |
$lock_file = "/var/run/amavisd/amavisd.lock"; # -L
|
38 |
$lock_file = "/run/amavisd/amavisd.lock"; # -L
|
39 |
$pid_file = "/var/run/amavisd/amavisd.pid"; # -P
|
39 |
$pid_file = "/run/amavisd/amavisd.pid"; # -P
|
40 |
#NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually
|
40 |
#NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually
|
41 |
|
41 |
|
42 |
$log_level = 0; # verbosity 0..5, -d
|
42 |
$log_level = 0; # verbosity 0..5, -d
|
43 |
$log_recip_templ = undef; # disable by-recipient level-0 log entries
|
43 |
$log_recip_templ = undef; # disable by-recipient level-0 log entries
|
44 |
$do_syslog = 1; # log via syslogd (preferred)
|
44 |
$do_syslog = 1; # log via syslogd (preferred)
|
Line 49... |
Line 49... |
49 |
# $enable_zmq = 1; # enable use of ZeroMQ (SNMP and nanny)
|
49 |
# $enable_zmq = 1; # enable use of ZeroMQ (SNMP and nanny)
|
50 |
$nanny_details_level = 2; # nanny verbosity: 1: traditional, 2: detailed
|
50 |
$nanny_details_level = 2; # nanny verbosity: 1: traditional, 2: detailed
|
51 |
$enable_dkim_verification = 1; # enable DKIM signatures verification
|
51 |
$enable_dkim_verification = 1; # enable DKIM signatures verification
|
52 |
$enable_dkim_signing = 1; # load DKIM signing code, keys defined by dkim_key
|
52 |
$enable_dkim_signing = 1; # load DKIM signing code, keys defined by dkim_key
|
53 |
|
53 |
|
54 |
@local_domains_maps = ( [".$mydomain"] ); # list of all local domains
|
54 |
#@local_domains_maps = ( [".$mydomain"] ); # list of all local domains
|
- |
|
55 |
@local_domains_maps = ( ["."] ); # list of all local domains
|
55 |
|
56 |
|
56 |
@mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
|
57 |
@mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
|
57 |
10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 10.192.25.0/24 );
|
58 |
10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 10.192.25.0/24 );
|
58 |
|
59 |
|
59 |
$unix_socketname = "/var/run/amavisd/amavisd.sock"; # amavisd-release or amavis-milter
|
60 |
$unix_socketname = "/run/amavisd/amavisd.sock"; # amavisd-release or amavis-milter
|
60 |
# option(s) -p overrides $inet_socket_port and $unix_socketname
|
61 |
# option(s) -p overrides $inet_socket_port and $unix_socketname
|
61 |
|
62 |
|
62 |
# The default receiving port in the Fedora and RHEL SELinux policy is 10024.
|
63 |
# The default receiving port in the Fedora and RHEL SELinux policy is 10024.
|
63 |
# To allow additional ports you need to label them as 'amavisd_recv_port_t'
|
64 |
# To allow additional ports you need to label them as 'amavisd_recv_port_t'
|
64 |
# For example: semanage port -a -t amavisd_recv_port_t -p tcp 10022
|
65 |
# For example: semanage port -a -t amavisd_recv_port_t -p tcp 10022
|
Line 373... |
Line 374... |
373 |
|
374 |
|
374 |
@av_scanners = (
|
375 |
@av_scanners = (
|
375 |
|
376 |
|
376 |
# ### http://www.sophos.com/
|
377 |
# ### http://www.sophos.com/
|
377 |
# ['Sophos-SSSP', # SAV Dynamic Interface
|
378 |
# ['Sophos-SSSP', # SAV Dynamic Interface
|
378 |
# \&ask_daemon, ["{}", 'sssp:/var/run/savdi/sssp.sock'],
|
379 |
# \&ask_daemon, ["{}", 'sssp:/run/savdi/sssp.sock'],
|
379 |
# # or: ["{}", 'sssp:[127.0.0.1]:4010'],
|
380 |
# # or: ["{}", 'sssp:[127.0.0.1]:4010'],
|
380 |
# qr/^DONE OK\b/m, qr/^VIRUS\b/m, qr/^VIRUS\s*(\S*)/m ],
|
381 |
# qr/^DONE OK\b/m, qr/^VIRUS\b/m, qr/^VIRUS\s*(\S*)/m ],
|
381 |
|
382 |
|
382 |
# ### http://www.clanfield.info/sophie/ (http://www.vanja.com/tools/sophie/)
|
383 |
# ### http://www.clanfield.info/sophie/ (http://www.vanja.com/tools/sophie/)
|
383 |
# ['Sophie',
|
384 |
# ['Sophie',
|
384 |
# \&ask_daemon, ["{}/\n", 'sophie:/var/run/sophie'],
|
385 |
# \&ask_daemon, ["{}/\n", 'sophie:/run/sophie'],
|
385 |
# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/, qr/(?x)^ 1 ( : | [\000\r\n]* $)/,
|
386 |
# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/, qr/(?x)^ 1 ( : | [\000\r\n]* $)/,
|
386 |
# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
|
387 |
# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
|
387 |
|
388 |
|
388 |
# ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
|
389 |
# ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/
|
389 |
# ['Sophos SAVI', \&ask_daemon, ['{}','savi-perl:'] ],
|
390 |
# ['Sophos SAVI', \&ask_daemon, ['{}','savi-perl:'] ],
|
Line 394... |
Line 395... |
394 |
# qr/^(?:310|420)[,\s]*(?:.* <<< )?(.+?)(?: ; |$)/m ],
|
395 |
# qr/^(?:310|420)[,\s]*(?:.* <<< )?(.+?)(?: ; |$)/m ],
|
395 |
# settings for the SAVAPI3.conf: ArchiveScan=1, HeurLevel=2, MailboxScan=1
|
396 |
# settings for the SAVAPI3.conf: ArchiveScan=1, HeurLevel=2, MailboxScan=1
|
396 |
|
397 |
|
397 |
### http://www.clamav.net/
|
398 |
### http://www.clamav.net/
|
398 |
['ClamAV-clamd',
|
399 |
['ClamAV-clamd',
|
399 |
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.sock"],
|
400 |
\&ask_daemon, ["CONTSCAN {}\n", "/run/clamd.amavisd/clamd.sock"],
|
400 |
qr/\bOK$/m, qr/\bFOUND$/m,
|
401 |
qr/\bOK$/m, qr/\bFOUND$/m,
|
401 |
qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
402 |
qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
402 |
# NOTE: run clamd under the same user as amavisd - or run it under its own
|
403 |
# NOTE: run clamd under the same user as amavisd - or run it under its own
|
403 |
# uid such as clamav, add user clamav to the amavis group, and then add
|
404 |
# uid such as clamav, add user clamav to the amavis group, and then add
|
404 |
# AllowSupplementaryGroups to clamd.conf;
|
405 |
# AllowSupplementaryGroups to clamd.conf;
|
Line 415... |
Line 416... |
415 |
# \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
|
416 |
# \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'],
|
416 |
# qr/^OK/m, qr/^FOUND: /m, qr/^FOUND: (.+)/m ],
|
417 |
# qr/^OK/m, qr/^FOUND: /m, qr/^FOUND: (.+)/m ],
|
417 |
|
418 |
|
418 |
# ### http://www.vanja.com/tools/trophie/
|
419 |
# ### http://www.vanja.com/tools/trophie/
|
419 |
# ['Trophie',
|
420 |
# ['Trophie',
|
420 |
# \&ask_daemon, ["{}/\n", 'trophie:/var/run/trophie'],
|
421 |
# \&ask_daemon, ["{}/\n", 'trophie:/run/trophie'],
|
421 |
# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
|
422 |
# qr/(?x)^ 0+ ( : | [\000\r\n]* $)/m, qr/(?x)^ 1 ( : | [\000\r\n]* $)/m,
|
422 |
# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
|
423 |
# qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/m ],
|
423 |
|
424 |
|
424 |
# ### http://www.grisoft.com/
|
425 |
# ### http://www.grisoft.com/
|
425 |
# ['AVG Anti-Virus',
|
426 |
# ['AVG Anti-Virus',
|
Line 452... |
Line 453... |
452 |
# length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
|
453 |
# length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/pxxx")).
|
453 |
# '{}/*'. # path
|
454 |
# '{}/*'. # path
|
454 |
# pack('N',0). # content size
|
455 |
# pack('N',0). # content size
|
455 |
# pack('N',0),
|
456 |
# pack('N',0),
|
456 |
# '/var/drweb/run/drwebd.sock',
|
457 |
# '/var/drweb/run/drwebd.sock',
|
457 |
# # '/var/amavis/var/run/drwebd.sock', # suitable for chroot
|
458 |
# # '/var/amavis/run/drwebd.sock', # suitable for chroot
|
458 |
# # '/usr/local/drweb/run/drwebd.sock', # FreeBSD drweb ports default
|
459 |
# # '/usr/local/drweb/run/drwebd.sock', # FreeBSD drweb ports default
|
459 |
# # '127.0.0.1:3000', # or over an inet socket
|
460 |
# # '127.0.0.1:3000', # or over an inet socket
|
460 |
# ],
|
461 |
# ],
|
461 |
# qr/\A\x00[\x10\x11][\x00\x10]\x00/sm, # IS_CLEAN,EVAL_KEY; SKIPPED
|
462 |
# qr/\A\x00[\x10\x11][\x00\x10]\x00/sm, # IS_CLEAN,EVAL_KEY; SKIPPED
|
462 |
# qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/sm,# KNOWN_V,UNKNOWN_V,V._MODIF
|
463 |
# qr/\A\x00[\x00\x01][\x00\x10][\x20\x40\x80]/sm,# KNOWN_V,UNKNOWN_V,V._MODIF
|
Line 467... |
Line 468... |
467 |
|
468 |
|
468 |
### http://www.kaspersky.com/ (kav4mailservers)
|
469 |
### http://www.kaspersky.com/ (kav4mailservers)
|
469 |
['KasperskyLab AVP - aveclient',
|
470 |
['KasperskyLab AVP - aveclient',
|
470 |
['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
|
471 |
['/usr/local/kav/bin/aveclient','/usr/local/share/kav/bin/aveclient',
|
471 |
'/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
|
472 |
'/opt/kav/5.5/kav4mailservers/bin/aveclient','aveclient'],
|
472 |
'-p /var/run/aveserver -s {}/*',
|
473 |
'-p /run/aveserver -s {}/*',
|
473 |
[0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
|
474 |
[0,3,6,8], qr/\b(INFECTED|SUSPICION|SUSPICIOUS)\b/m,
|
474 |
qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
|
475 |
qr/(?:INFECTED|WARNING|SUSPICION|SUSPICIOUS) (.+)/m,
|
475 |
],
|
476 |
],
|
476 |
# NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
|
477 |
# NOTE: one may prefer [0],[2,3,4,5], depending on how suspicious,
|
477 |
# currupted or protected archives are to be handled
|
478 |
# currupted or protected archives are to be handled
|
Line 570... |
Line 571... |
570 |
# to prevent fsav from exiting with status 9 on broken archives
|
571 |
# to prevent fsav from exiting with status 9 on broken archives
|
571 |
|
572 |
|
572 |
# ### http://www.avast.com/
|
573 |
# ### http://www.avast.com/
|
573 |
# ['avast! Antivirus daemon',
|
574 |
# ['avast! Antivirus daemon',
|
574 |
# \&ask_daemon, # greets with 220, terminate with QUIT
|
575 |
# \&ask_daemon, # greets with 220, terminate with QUIT
|
575 |
# ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'],
|
576 |
# ["SCAN {}\015\012QUIT\015\012", '/run/avast4/mailscanner.sock'],
|
576 |
# qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t[0-9]+\s+([^[ \t\015\012]+)/m ],
|
577 |
# qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t[0-9]+\s+([^[ \t\015\012]+)/m ],
|
577 |
|
578 |
|
578 |
# ### http://www.avast.com/
|
579 |
# ### http://www.avast.com/
|
579 |
# ['avast! Antivirus - Client/Server Version', 'avastlite',
|
580 |
# ['avast! Antivirus - Client/Server Version', 'avastlite',
|
580 |
# '-a /var/run/avast4/mailscanner.sock -n {}', [0], [1],
|
581 |
# '-a /run/avast4/mailscanner.sock -n {}', [0], [1],
|
581 |
# qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
|
582 |
# qr/\t\[L\]\t([^[ \t\015\012]+)/m ],
|
582 |
|
583 |
|
583 |
['CAI InoculateIT', 'inocucmd', # retired product
|
584 |
['CAI InoculateIT', 'inocucmd', # retired product
|
584 |
'-sec -nex {}', [0], [100],
|
585 |
'-sec -nex {}', [0], [100],
|
585 |
qr/was infected by virus (.+)/m ],
|
586 |
qr/was infected by virus (.+)/m ],
|
Line 773... |
Line 774... |
773 |
# ['ClamAV-clamdscan', 'clamdscan',
|
774 |
# ['ClamAV-clamdscan', 'clamdscan',
|
774 |
# "--stdout --no-summary --config-file=/etc/clamd-client.conf {}",
|
775 |
# "--stdout --no-summary --config-file=/etc/clamd-client.conf {}",
|
775 |
# [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
776 |
# [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
776 |
|
777 |
|
777 |
# ['ClamAV-clamd-stream',
|
778 |
# ['ClamAV-clamd-stream',
|
778 |
# \&ask_daemon, ["*", 'clamd:/var/run/clamav/clamd.sock'],
|
779 |
# \&ask_daemon, ["*", 'clamd:/run/clamav/clamd.sock'],
|
779 |
# qr/\bOK$/m, qr/\bFOUND$/m,
|
780 |
# qr/\bOK$/m, qr/\bFOUND$/m,
|
780 |
# qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
781 |
# qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
|
781 |
|
782 |
|
782 |
### http://www.f-prot.com/ - backs up F-Prot Daemon, V6
|
783 |
### http://www.f-prot.com/ - backs up F-Prot Daemon, V6
|
783 |
['F-PROT Antivirus for UNIX', ['fpscan'],
|
784 |
['F-PROT Antivirus for UNIX', ['fpscan'],
|