I came up with something a fair bit leaner I think - seems to work for me.
Now I based this on some code someone else was talking about... and for the
life of me I can't remember where I put the name... so the credit doesn't
belong with me! but irrc, he didn't sign his work... I just made a few
tweaks, but here it is, and fixed some file handle stuff to make it work on
my system.
It runs as a perlfilter, so it's daemonized if I understand right - doesn't
get started and stopped, and is capable of rejecting the mail during the
SMTP process - so the remote server gets an error, and we just drop the
message.
SOURCE:
# $| = 1;
use IO::File;
my $filedesc=shift @ARGV;
my $socket=undef;
my $tempdir = "/tmp/scan-$$";
my ($line, $mailfile, $errmsg);
#open($socket, "+<&$filedesc");
my $socket=new IO::File "+<&$filedesc";
die "$!" unless defined $socket;
while (defined ($line=<$socket>)) {
chomp $line;
last unless($line);
$mailfile = $line unless($mailfile);
# Ignore control files
}
if($mailfile) { $errmsg = viruscheck($mailfile, $tempdir); }
$errmsg = "200 Ok" unless($errmsg);
$errmsg .= "\n" unless $errmsg =~ /\n$/;
print $socket $errmsg;
close($socket);
undef($socket);
##################################################
sub viruscheck() {
my $filename=shift;
my $temproot=shift;
my $tempdir;
$tempdir = newtmpdir($temproot);
system("/usr/local/courier/bin/reformime -x$tempdir/ < $filename");
return "432 internal mime handler failure" if($?);
system("/usr/local/bin/clamscan", '-i', '--quiet',
'--disable-summary',
'-r', '--max-space=20000', '--max-files=1000',
'--max-recursion=5',
'-l', $tempdir.".rep", "--tempdir=$tempdir", $tempdir);
if($?) {
return "432 virus scanner invocation failure" if($? != 256);
my ($fh, $err, $virus_ref);
#return "432 $tempdir.rep";
# open($fh, $tempdir.".rep");
$fh = new IO::File "< $tempdir.rep";
return "432 virus scanner report failure" unless($fh);
while(<$fh>) {
chomp;
if(/^$tempdir\/(.*)/) { $virus_ref = $1; $err =
"ANTIVIRUS ALERT! $virus_ref"; last; }
}
close($fh);
if(-d '/tmp/virus_log/') {
$virus_ref =~ s/[^a-zA-Z0-9.:_ ]/-/g;
my($file, $virus) = split(/ +/, $virus_ref);
chop($file);
system("/bin/cp $filename /tmp/virus_log/$virus");
}
return "432 virus scanner report failure" unless($err);
return "500 $err";
}
cleantmpdir($tempdir);
return "";
}
sub cleantmpdir {
my $tempdir=shift;
system('/bin/rm', '-rf', $tempdir);
unlink($tempdir.".rep");
}
sub newtmpdir {
my $tempdir=shift;
if(-d $tempdir) { cleantmpdir($tempdir); }
mkdir($tempdir, 0700);
return $tempdir;
}
INSTALLING:
cp SOURCE/clamav-fiter.pl /usr/local/courier/share/
chmod 755 /usr/local/courier/share/clamav-fiter.pl
echo "all" >/usr/local/courier/etc/filters/perlfilter-mode
echo "10" >/usr/local/courier/etc/filters/perlfilter-numprocs
echo "/usr/local/courier/share/clamav-fiter.pl"
>/usr/local/courier/etc/filters/perlfilter
/usr/local/courier/sbin/filterctl start perlfilter
/usr/local/courier/sbin/courierfilter start
mkdir /tmp/virus_log
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Flavio
> Stanchina
> Sent: Saturday, February 14, 2004 3:31 AM
> To: [EMAIL PROTECTED]
> Subject: [courier-users] [PATCH] reformime: return exit code of external
> program
>
>
> I see that filtering is all the rage here lately, so I'm proposing this
> small patch to reformime that allowed me to create a simple but
> effective virus filter from maildroprc. The patch is against Debian
> version 0.42.2-10. BTW, Racke, I see you read this list too... do you
> have experimental packages for more recent versions?
>
> Background: I'm administering a couple of mail servers and after the
> MyDoom outbreak I took a deeper look into virus filtering. All my users
> on Windows have local virus scanners, but the more viruses I stop on the
> server, the less support requests I get...
>
> I looked at Amavis and other solutions, but I'm uncomfortable with such
> beasts. I was looking for something easier to set up. I discovered the
> existence of reformime a few days ago, and it looked like the -X option
> was what I needed to call ClamAV safely from maildrop, except that
> there's no easy way to signal that a virus has been found. Here's what
> my patch does: if the external program terminates with a nonzero exit
> status, reformime terminates and returns (program exit status + 20).
>
> This is what I put into /etc/courier/maildroprc:
> # log delivered emails for debugging purposes
> logfile ./maildrop.log
> exception {
> `/usr/bin/reformime -X /usr/bin/clamdscan --disable-summary -`
> if ($RETURNCODE == 21)
> {
> log "Virus found!"
> to "./Maildir/.Virus"
> }
> }
>
> This is the log generated by an infected email:
> courierlocal: id=X,from=<Y>,addr=<Z>: stream: OK
> courierlocal: id=X,from=<Y>,addr=<Z>: stream: Worm.Dumaru.Y.enc FOUND
> courierlocal: id=X,from=<Y>,addr=<Z>: reformime: /usr/bin/clamdscan
> exited with status 1.
> courierlocal: id=X,from=<Y>,addr=<Z>,size=21594,success: Message
> delivered.
>
> Please, apply. If you are uncomfortable with changing the current
> behaviour of the -X option, I would suggesti adding a new option for
> this purpose, let's say -Z.
>
> --
> Ciao,
> Flavio Stanchina
> Trento - Italy
>
>
-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
courier-users mailing list
[EMAIL PROTECTED]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
