Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-19 Thread Henrik K
On Sun, Apr 19, 2009 at 01:16:44AM +0200, Mark Martinec wrote: Henrik, Perhaps a good compromise is to only do MIME decoding but no other archives decoding, and let a virus scanner also see the complete message: @decoders = (); @keep_decoded_original_maps = (new_RE(

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-18 Thread Mark Martinec
Henrik, Perhaps a good compromise is to only do MIME decoding but no other archives decoding, and let a virus scanner also see the complete message: @decoders = (); @keep_decoded_original_maps = (new_RE( qr'^MAIL$' )); It does not work optimally. Even with @decoders empty

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Mark Martinec
Mark, would it be possible to have some option to only do the stuff that bounce killer needs and not write unnecessary parts to disk? Amavisd-New already does this, just set bypass-decode_parts = 1 in your amavisd.conf file, and your good to go (works with amavisd-new 2.5.1-pre1 and

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Michael Scheidell
Perhaps a good compromise is to only do MIME decoding but no other archives decoding, and let a virus scanner also see the complete message: @decoders = (); @keep_decoded_original_maps = (new_RE( qr'^MAIL$' )); So this will work on 2.6.2? Both bounce killer and penpals? --

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Mark Martinec
Michael, Perhaps a good compromise is to only do MIME decoding but no other archives decoding, and let a virus scanner also see the complete message: @decoders = (); @keep_decoded_original_maps = (new_RE( qr'^MAIL$' )); So this will work on 2.6.2? Both bounce killer and penpals? I

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Henrik K
On Sat, Apr 18, 2009 at 01:06:51AM +0200, Mark Martinec wrote: Michael, Perhaps a good compromise is to only do MIME decoding but no other archives decoding, and let a virus scanner also see the complete message: @decoders = (); @keep_decoded_original_maps = (new_RE(

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-09 Thread Michael Scheidell
Mark, would it be possible to have some option to only do the stuff that bounce killer needs and not write unnecessary parts to disk? Amavisd-New already does this, just set bypass-decode_parts = 1 in your amavisd.conf file, and your good to go (works with amavisd-new 2.5.1-pre1 and

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Bill Landry
Michael Scheidell wrote: sanesecurity site: refrences this archived email: says to set bypass_decode_parts=1 in amavisd.conf amavisd says to set it to 0 if you are using bounce_killer or using 'file' to guess the attachment type. (i have it set to 0, using bounce killer and file)

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Michael Scheidell
sanesecurity site: refrences this archived email: says to set bypass_decode_parts=1 in amavisd.conf Like bill says, you need one or the other. Now, looking at readmes' and example. header L_AV_Phish X-Amavis-AV-Status =~ m{\b(Email|HTML)\.Phishing\.}i header L_AV_SS_Phish

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Henrik K
On Wed, Apr 08, 2009 at 02:43:00PM -0700, Bill Landry wrote: Michael Scheidell wrote: and it looks like sane security test #2 and 3 did fail if I don't do this in amavisd.conf: (uncomment out the qr'^MAIL'. so, 'can be slow'. how slow is it? and is bill landry wrong saying I need

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Bill Landry
Henrik K wrote: On Wed, Apr 08, 2009 at 02:43:00PM -0700, Bill Landry wrote: Michael Scheidell wrote: and it looks like sane security test #2 and 3 did fail if I don't do this in amavisd.conf: (uncomment out the qr'^MAIL'. so, 'can be slow'. how slow is it? and is bill landry wrong saying

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Henrik K
On Wed, Apr 08, 2009 at 04:08:35PM -0700, Bill Landry wrote: Henrik K wrote: On Wed, Apr 08, 2009 at 02:43:00PM -0700, Bill Landry wrote: Michael Scheidell wrote: and it looks like sane security test #2 and 3 did fail if I don't do this in amavisd.conf: (uncomment out the qr'^MAIL'.