Hi S�nke If you run SpamAssassin, I assume, via filters, you pass each e-mail to the SA client/daemon and do something based on SA numerical index. This same model is useful for the AV product F-PROT. Working in our xmail server, F-PROT seems to recognize embedded viri which may or may not be buried in attachments. The home use Linux version is free.
If your filter script parses the F-PROT virus report and finds an embedded virus, it can modify the xmail message header simply and not propagate the virus further so no SA daemon gets bothered later. Why would you want or need to do batch directory scanning later on if you can reject a virus early in the chain? Possibly there is something I am missing? Alan ----- Original Message ----- From: "S�nke Ruempler" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, April 27, 2004 11:49 AM Subject: [xmail] SMTP filter thoughts > Hi everybody, > > I've been thinking about the almost perfect email-AV solution. > > My dream is that, which is now possible, the message is rejected at smtp > level to avoid fooling av messages. Here are two problems: > > 1) I can't use the Special SMTP versions of AV products, that have their own > mailserver and can decode mime themselves etc. I don't want a script that > extracts the mail and then runs the command line scanner on the the > directory. or do you know command line scanners that can read mail formats > and extract them? > > 2) I want domain-based filtering, which is very hard to implement with no > @@RRCPT(s) in the SMTP filters, because i have to get the real rcpt by > myself with ctrl commands and that is very time-expensive, too. > > Davide, maybe there is a possibilty in the SMTP filter to implement the > @RRCPT macro. Afaik XMail has to resolve the RRCPTs at SMTP level to check > if the rxcpt is valid (and local). Any chance? > > The RRCPT is important for SpamAssassin, too, because i have user based > rules (SQL/virtual user support) and need the real users there. > > Maybe you put a "in" and "out" switch in the SMTP filters like the offline > filters. > > I know I am a PITA. ;-) > > > - > To unsubscribe from this list: send the line "unsubscribe xmail" in > the body of a message to [EMAIL PROTECTED] > For general help: send the line "help" in the body of a message to > [EMAIL PROTECTED] > - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]
