Thanks - but this doesn't quite answer my need. This would still be a
manual add operation - I'm simply adding the signature to ASSP to
override it instead of removing it from the ClamAV detection database.
The result either way may be the same - but still a manual admin
operation that end-users can't possibly implement.
Is there presently any hook where an external program can be called via
the email interface?
Daniel
On 9/13/2019 2:49 AM, Thomas Eckardt wrote:
use SuspiciousVirus
Thomas
Von: "Daniel Miller via Assp-test" <assp-test@lists.sourceforge.net>
An: "ASSP development mailing list" <assp-test@lists.sourceforge.net>
Kopie: "Daniel Miller" <dmil...@amfes.com>
Datum: 12.09.2019 19:38
Betreff: [Assp-test] Run external script on report
------------------------------------------------------------------------
I use the unofficial clamav signature update script from:
https://github.com/extremeshok/clamav-unofficial-sigs
And the resulting databases have been catching a few more spams.
However, recently I had an issue with false positives. Using the
block-report feature I'm able to allow individual mails to get to
recipients - but the sender continues to be flagged by ClamAV.
The script has a whitelist feature. Calling it with the "-w" flag and
the signature name - which is known to ASSP - allows for an override
whitelist to be created (for ClamAV) for that signature. But this is a
manual operation.
Is there an existing feature in ASSP where upon a re-send request,
whitelist add, or other appropriate time I can specify an external
script to be called with the appropriate parameters? Based on my
settings the signature is shown in the subject of the virus-flagged mail as:
"Warning - virus detected: 'MBL_<numbers here>.UNOFFICIAL'"
or shown in the block-report as:
"<date> [TLS-in] [SSL-out] <ip> <sender @> [spam found] virus detected:
'MBL_<numbers here>.UNOFFICIAL' [<original subject>]
--
Daniel
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential,
legally privileged and protected in law and are intended solely for the
use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
