$MYHOME = '/var/amavis'; # (default is '/var/amavis') $mydomain = 'domain.com'; # (no useful default) $daemon_user = 'amavis'; # (no default; customary: vscan or amavis) $daemon_group = 'amavis'; # (no default; customary: vscan or amavis) $TEMPBASE = "$MYHOME/tmp"; # prefer to keep home dir /var/amavis clean? $helpers_home = $MYHOME; # (defaults to $MYHOME) #$daemon_chroot_dir = $MYHOME; # (default is undef, meaning: do not chroot) $pid_file = "$MYHOME/amavisd.pid"; # (default is "$MYHOME/amavisd.pid") $lock_file = "$MYHOME/amavisd.lock"; # (default is "$MYHOME/amavisd.lock") $ENV{TMPDIR} = $TEMPBASE; # wise, but usually not necessary $forward_method = 'smtp:127.0.0.1:10025'; # where to forward checked mail $notify_method = $forward_method; # where to submit notifications $max_servers = 2; # number of pre-forked children (default 2) $max_requests = 10; # retire a child after that many accepts (default 10) $child_timeout=5*60; # abort child if it does not complete each task in n sec # @local_domains_acl = ( ".$mydomain", '.example.com', 'sub.example.net' ); # @local_domains_acl = ( ".$mydomain" ); # $mydomain and its subdomains read_hash(\%local_domains, '/var/amavis/local_domains'); #$relayhost_is_client = 1; # (defaults to false) $insert_received_line = 1; # behave like MTA: insert 'Received:' header $unix_socketname = "$MYHOME/amavisd.sock"; # amavis helper protocol socket $inet_socket_port = 10024; # accept SMTP on this local TCP port $inet_socket_bind = '127.0.0.1'; # limit socket bind to loopback interface @inet_acl = qw( 127.0.0.1 ); # allow SMTP access only from localhost IP # Section III - Logging $DO_SYSLOG = 0; # (defaults to false) $LOGFILE = "$MYHOME/amavis.log"; # (defaults to empty, no log) $log_level = 2; # (defaults to 0, I like 2, up to 5) # log both infected and noninfected messages (default): $log_templ = '[? %#V |[? %#F |[?%#D|Not-Delivered|Passed]|BANNED name/type (%F)]|INFECTED (%V)], # <%o> -> [<%R>|,][? %i ||, quarantine %i], Message-ID: %m, Hits: %c'; # Section IV - Notifications/DSN, BOUNCE/REJECT/DROP/PASS destiny, quarantine # $notify_sender_templ = read_text('/var/amavis/notify_sender.txt'); # $notify_virus_sender_templ= read_text('/var/amavis/notify_virus_sender.txt'); # $notify_virus_admin_templ = read_text('/var/amavis/notify_virus_admin.txt'); # $notify_virus_recips_templ= read_text('/var/amavis/notify_virus_recips.txt'); # $notify_spam_sender_templ = read_text('/var/amavis/notify_spam_sender.txt'); # $notify_spam_admin_templ = read_text('/var/amavis/notify_spam_admin.txt'); $final_virus_destiny = D_REJECT; # (defaults to D_BOUNCE) $final_banned_destiny = D_REJECT; # (defaults to D_BOUNCE) $final_spam_destiny = D_REJECT; # (defaults to D_REJECT) $final_bad_header_destiny = D_REJECT; # (defaults to D_PASS), D_BOUNCE suggested #$warnvirussender = 1; # (defaults to false (undef)) #$warnspamsender = 1; # (defaults to false (undef)) #$warnbannedsender = 1; # (defaults to false (undef)) #$warnbadhsender = 1; # (defaults to false (undef)) #$warnvirusrecip = 1; # (defaults to false (undef)) #$warnbannedrecip = 1; # (defaults to false (undef)) #$warn_offsite = 1; # (defaults to false (undef), i.e. only notify locals) $viruses_that_fake_sender_re = new_RE( qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i, qr'tanatos|lentin|bridex|mimail|trojan\.dropper|dumaru|parite|gibe|swen'i, [qr'^(EICAR\.COM|Joke\.|Junk\.)'i => 0], [qr'^(WM97|OF97|W95/CIH-|JS/Fortnight)'i => 0], # [qr/.*/ => 1], # true by default? ); $virus_admin = "postmaster\@$mydomain"; # $virus_admin = undef; # do not send virus admin notifications (default) # $spam_admin = "spamalert\@$mydomain"; # $spam_admin = undef; # do not send spam admin notifications (default) # $spam_admin = {'not.example.com' => '', '.' => 'spamalert@example.com'}; $mailfrom_notify_admin = "postmaster\@$mydomain"; $mailfrom_notify_recip = "postmaster\@$mydomain"; $mailfrom_notify_spamadmin = "postmaster\@$mydomain"; $hdrfrom_notify_sender = "E-Mail Protection "; $mailfrom_to_quarantine = undef; # original sender if undef, or set explicitly $QUARANTINEDIR = '/var/amavis/quarantine'; #$virus_quarantine_method = "local:virus-%i-%n"; # default #$spam_quarantine_method = "local:spam-%b-%i-%n"; # default $virus_quarantine_to = 'virus-quarantine'; # traditional local quarantine #$spam_quarantine_to = 'spam-quarantine'; # default spam-quarantine #$spam_quarantine_to = 'spam@domain.com'; # email spam-quarantine #$spam_quarantine_to = undef; # no spam-quarantine $spam_lovers{lc('abuse@domain.com')} = 1; $X_HEADER_TAG = 'X-AntiVirus'; # (default: undef) $X_HEADER_LINE = "Clean"; $remove_existing_x_scanned_headers = 0; # leave existing X-Virus-Scanned alone $remove_existing_spam_headers = 0; # leave existing X-Spam* headers alone #$bypass_decode_parts = 1; # (defaults to false) $keep_decoded_original_re = new_RE( qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i, ); $banned_filename_re = new_RE( qr'\.[a-zA-Z][a-zA-Z0-9]{0,3}\.(ade|adp|asd|bas|bat|chm|cmd|com|cpl|crt|dbx|dll|exe|hlp|hta|inf|ins|isp|lnk|js|jse|lnk|ocx|mdb|mde|mdt|mdw|msc|msi|msp|mst|nws|ops|pcd|pi|pif|prf|reg|scf|scr|sct|shb|shm|shs|swf|uue|vb|vbe|vbl|vbs|vbx|vxd|wab|wsc|wsf|wsh)$'ix, # banned extension - long qr'.\.(ade|adp|asd|bas|bat|chm|cmd|com|cpl|crt|dbx|dll|exe|hlp|hta|inf|ins|isp|lnk|js|jse|lnk|ocx|mdb|mde|mdt|mdw|msc|msi|msp|mst|nws|ops|pcd|pi|pif|prf|reg|scf|scr|sct|shb|shm|shs|swf|uue|vb|vbe|vbl|vbs|vbx|vxd|wab|wsc|wsf|wsh)$'ix, # banned extension - long ); # qr'\.[a-zA-Z][a-zA-Z0-9]{0,3}\.(vbs|pif|scr|bat|com|exe|dll)$'i, # double extension # qr'.\.(exe|vbs|pif|scr|bat|com)$'i, # banned extension - basic # qr'.\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js| # jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|shb|vb| # vbe|vbs|wsc|wsf|wsh)$'ix, # banned extension - long # qr'^\.(exe|zip|lha|tnef)$'i, # banned file(1) types # qr'^application/x-msdownload$'i, # banned MIME types # qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 # See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631 # and http://www.cknow.com/vtutor/vtextensions.htm @bypass_spam_checks_acl = qw( domain_not_to_be_filtered.com ); $sql_select_white_black_list = undef; # undef disables SQL white/blacklisting $recipient_delimiter = '+'; # (default is '+') # $replace_existing_extension = 1; # (default is false) $localpart_is_case_sensitive = 0; # (default is false) map { $whitelist_sender{lc($_)}=1 } (qw( message@mail.efax.com cert-advisory-owner@cert.org owner-alert@iss.net slashdot@slashdot.org bugtraq@securityfocus.com NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM security-alerts@linuxsecurity.com amavis-user-admin@lists.sourceforge.net notification-return@lists.sophos.com mailman-announce-admin@python.org owner-postfix-users@postfix.org owner-postfix-announce@postfix.org owner-sendmail-announce@Lists.Sendmail.ORG owner-technews@postel.ACM.ORG lvs-users-admin@LinuxVirtualServer.org ietf-123-owner@loki.ietf.org cvs-commits-list-admin@gnome.org rt-users-admin@lists.fsck.com clp-request@comp.nus.edu.sg surveys-errors@lists.nua.ie emailNews@genomeweb.com owner-textbreakingnews@CNNIMAIL12.CNN.COM spamassassin-talk-admin@lists.sourceforge.net yahoo-dev-null@yahoo-inc.com returns.groups.yahoo.com )); # $smtpd_recipient_limit = 1000; # (default is 1000) $MAXLEVELS = 14; # (default is undef, no limit) $MAXFILES = 1500; # (default is undef, no limit) $MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced) $MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced) $MIN_EXPANSION_FACTOR = 5; # times original mail size (must be specified) $MAX_EXPANSION_FACTOR = 500; # times original mail size (must be specified) # Section VII - External programs, virus scanners $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin'; $file = 'file'; # file(1) utility; use 3.41 or later to avoid vulnerability $gzip = 'gzip'; $bzip2 = 'bzip2'; $lzop = 'lzop'; $uncompress = ['uncompress', 'gzip -d', 'zcat']; $unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat']; $arc = ['nomarch', 'arc']; $unarj = ['arj', 'unarj']; # both can extract, same options $unrar = ['rar', 'unrar']; # both can extract, same options $zoo = 'zoo'; $lha = 'lha'; $cpio = 'cpio'; # comment out if cpio does not support GNU options # SpamAssassin settings #$sa_local_tests_only = 1; # (default: false) $sa_auto_whitelist = 1; # turn on AWL (default: false) $sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail is larger $sa_tag_level_deflt = 0.0; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 6.0; # add 'spam detected' headers at that level $sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions #$sa_spam_subject_tag = 'PROBABLE_SPAM: '; # (defaults to undef, disables) $sa_spam_modifies_subj = 0; # may be a ref to a lookup table, default is true @av_scanners = ( # ### http://www.vanja.com/tools/sophie/ # ['Sophie', # \&ask_daemon, ["{}/\n", '/var/run/sophie'], # qr/(?x)^ 0+ ( : | [\000\r\n]* $)/, qr/(?x)^ 1 ( : | [\000\r\n]* $)/, # qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/ ], # ### http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/ # ['Sophos SAVI', \&sophos_savi ], ### http://clamav.elektrapro.com/ ['Clam Antivirus-clamd', \&ask_daemon, ["CONTSCAN {}\n", '/var/run/clamav/clamd.sock'], qr/\bOK$/, qr/\bFOUND$/, qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ], # NOTE: run clamd under the same user as amavisd, # match the socket name in clamav.conf to the socket name in this entry # ### http://www.openantivirus.org/ # ['OpenAntiVirus ScannerDaemon (OAV)', # \&ask_daemon, ["SCAN {}\n", '127.0.0.1:8127'], # qr/^OK/, qr/^FOUND: /, qr/^FOUND: (.+)/ ], # ### http://www.vanja.com/tools/trophie/ # ['Trophie', # \&ask_daemon, ["{}/\n", '/var/run/trophie'], # qr/(?x)^ 0+ ( : | [\000\r\n]* $)/, qr/(?x)^ 1 ( : | [\000\r\n]* $)/, # qr/(?x)^ [-+]? \d+ : (.*?) [\000\r\n]* $/ ], ### http://www.f-prot.com/ # ['FRISK F-Prot Daemon', # \&ask_daemon, # ["GET {}/*?-dumb%20-archive%20-packed HTTP/1.0\r\n\r\n", # ['127.0.0.1:10200','127.0.0.1:10201','127.0.0.1:10202', # '127.0.0.1:10203','127.0.0.1:10204'] ], # qr/(?i)]*>clean<\/summary>/, # qr/(?i)]*>infected<\/summary>/, # qr/(?i)(.+)<\/name>/ ], # # ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp','kavscanner'], # '-* -P -B -Y -O- {}', [0,3,8], [2,4], # any use for -A -K ? # qr/infected: (.+)/, # sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"}, # sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"}, # ], # NOTE: not sure which entry suits which kavscanner version # ['KasperskyLab kavscanner 4.5', ['/opt/kav/bin/kavscanner','kavscanner'], # '-i1 -xp {}', [0], [5,20,21,25], # qr/(?:CURED|INFECTED|CUREFAILED|WARNING|SUSPICION) (.*)/ , # sub {chdir('/opt/kav/bin') or die "Can't chdir to kav: $!"}, # sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"}, # ], # # # NOTE: the kavdaemon has been removed from Kasperky products # ['KasperskyLab AVPDaemonClient', # [ '/opt/AVP/kavdaemon', 'kavdaemon', # '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient', # '/opt/AVP/AvpTeamDream', 'AvpTeamDream', # '/opt/AVP/avpdc', 'avpdc' ], # "-f=$TEMPBASE {}", [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/ ], # change the startup-script in /etc/init.d/kavd to: # DPARMS="-* -Y -dl -f=/var/amavis /var/amavis" # (or perhaps: DPARMS="-I0 -Y -* /var/amavis" ) # adjusting /var/amavis above to match your $TEMPBASE. # The '-f=/var/amavis' is needed if not running it as root, so it # can find, read, and write its pid file, etc., see 'man kavdaemon'. # defUnix.prf: there must be an entry "*/var/amavis" (or whatever # directory $TEMPBASE specifies) in the 'Names=' section. # cd /opt/AVP/DaemonClients; configure; cd Sample; make # cp AvpDaemonClient /opt/AVP/ # su - vscan -c "${PREFIX}/kavdaemon ${DPARMS}" ### http://www.hbedv.com/ # ['H+BEDV AntiVir Antivirus', # ['antivir'], # '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/, # qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) | # (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/ ], # # NOTE: remove the -z if you only have a demo version ### http://www.centralcommand.com/ ['CentralCommand Vexira Antivirus', ['/usr/bin/vexira'], '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/, qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) | (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/ ], # NOTE: remove the -z if you only have a demo version # ### http://www.commandsoftware.com/ # ['Command AntiVirus for Linux', 'csav', # '-all -archive -packed {}', [50], [51,52,53], # qr/Infection: (.+)/ ], # ### http://www.symantec.com/ # ['Symantec CarrierScan via Symantec CommandLineScanner', # 'cscmdline', '-a scan -i 1 -v -s 127.0.0.1:7777 {}', # qr/^Files Infected:\s+0$/, qr/^Infected\b/, # qr/^(?:Info|Virus Name):\s+(.+)/ ], # ### http://www.symantec.com/ # ['Symantec AntiVirus Scan Engine', # 'savsecls', '-server 127.0.0.1:7777 -mode scanrepair -details -verbose {}', # [0], qr/^Infected\b/, # qr/^(?:Info|Virus Name):\s+(.+)/ ], # # NOTE: check options and patterns to see which entry better applies # ### http://drweb.imshop.de/ # ['Dr.Web Antivirus for Linux/FreeBSD/Solaris', 'drweb', # '-al -ar -fm -go -ha -ml -ot -sd -up {}', # [0], [1], sub {('no-name')} ], # ['Dr.Web Daemon', \&ask_daemon, # [pack('N',1). # DRWEBD_SCAN_CMD - 1 # pack('N',1). # DRWEBD_RETURN_VIRUSES # pack('N', # path length # length("$TEMPBASE/amavis-yyyymmddTHHMMSS-xxxxx/parts/part-xxxxx")). # '{}/*'. # path # pack('N',0) . pack('N',0), # '/usr/local/drweb/run/drwebd.sock'], # qr/^\x00\x01\x00\x00/, # qr/^\x00\x01\x00(\x20|\x40|\x80)/, # qr/infected with ([^\x00]+)\x00\z/ # ], ### http://www.f-secure.com/products/anti-virus/ ['F-Secure Antivirus', 'fsav', '--dumb --archive {}', [0], [3,8], qr/(?:infection|Infected): (.+)/ ], # ['CAI InoculateIT', 'inocucmd', # '-sec -nex {}', [0], [100], # qr/was infected by virus (.+)/ ], # ['MkS_Vir for Linux (beta)', ['mks32','mks'], # '-s {}/*', [0], [1,2], # qr/--[ \t]*(.+)/ ], # ['MkS_Vir daemon', # 'mksscan', '-s -q {}', [0], [1..7], # qr/^... (\S+)/ ], # ### http://www.nod32.com/ # ['ESET Software NOD32', 'nod32', # '-all -subdir+ {}', [0], [1,2], # qr/^.+? - (.+?)\s*(?:backdoor|joke|trojan|virus|worm)/ ], # ### http://www.nod32.com/ # ['ESET Software NOD32 - Client/Server Version', 'nod32cli', # '-a -r -d recurse --heur standard {}', [0], [10,11], # qr/^\S+\s+infected:\s+(.+)/ ], # ### http://www.norman.com/products_nvc.shtml # ['Norman Virus Control v5 / Linux', 'nvccmd', # '-c -l:0 -s -u {}', [0], [1], # qr/(?i).* virus in .* -> \'(.+)\'/ ], # ### http://www.pandasoftware.com/ # ['Panda Antivirus for Linux', ['pavcl'], # '-aut -aex -heu -cmp -nbr -nor -nso -eng {}', # qr/Number of files infected[ \.]*: 0(?!\d)/, # qr/Number of files infected[ \.]*: 0*[1-9]/, # qr/Found virus :\s*(\S+)/ ], # GeCAD AV technology is acquired by Microsoft; RAV has been discontinued. # Check your RAV license terms before fiddling with the following two lines! # ['GeCAD RAV AntiVirus 8', '/opt/rav/bin/ravav', # '--all --archive --mail {}', [1], [2,3,4,5], qr/Infected: (.+)/ ], # # NOTE: the command line switches changed with scan engine 8.5 ! # # (btw, assigning stdin to /dev/null causes RAV to fail) # ### http://www.nai.com/ # ['NAI McAfee AntiVirus (uvscan)', 'uvscan', # '--secure -rv --summary --noboot {}', [0], [13], # qr/(?x) Found (?: # \ the\ (.+)\ (?:virus|trojan) | # \ (?:virus|trojan)\ or\ variant\ ([^ ]+) | # :\ (.+)\ NOT\ a\ virus)/, # sub {$ENV{LD_PRELOAD}='/lib/libc.so.6'}, # sub {delete $ENV{LD_PRELOAD}}, # ], # NOTE with RH9: force the dynamic linker to look at /lib/libc.so.6 before # anything else by setting environment variable LD_PRELOAD=/lib/libc.so.6 # and then clear it when finished to avoid confusing anything else ### http://www.virusbuster.hu/en/ # ['VirusBuster', ['vbuster', 'vbengcl'], # # VirusBuster Ltd. does not support the daemon version for the workstation # # engine (vbuster-eng-1.12-linux-i386-libc6.tgz) any longer. The names of # # binaries, some parameters AND return codes (from 3 to 1) changed. # "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1], # qr/: '(.*)' - Virus/ ], # ### http://www.virusbuster.hu/en/ # ['VirusBuster (Client + Daemon)', 'vbengd', # # HINT: for an infected file it returns always 3, # # although the man-page tells a different story # '-f -log scandir {}', [0], [3], # qr/Virus found = (.*);/ ], # ### http://www.cyber.com/ # ['CyberSoft VFind', 'vfind', # '--vexit {}/*', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/, # # sub {$ENV{VSTK_HOME}='/usr/lib/vstk'}, # ], # ### http://www.ikarus-software.com/ # ['Ikarus AntiVirus for Linux', 'ikarus', # '{}', [0], [40], qr/Signature (.+) found/ ], ### http://www.bitdefender.com/ ['BitDefender', 'bdc', '--all --arc {}', qr/^Infected files *:0(?!\d)/, qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/, qr/(?:suspected|infected): (.*)\033/ ], ### http://clamav.elektrapro.com/ ['Clam Antivirus - clamscan', 'clamscan', '--stdout --disable-summary -r {}', [0], [1], qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ], ### http://www.f-prot.com/ ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'], '-dumb -archive -packed {}', [0,8], [3,6], qr/Infection: (.+)/ ], # ### http://www.trendmicro.com/ # ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'], # '-a {}', [0], qr/Found virus/, qr/Found virus (.+) in/ ], ); # If no virus scanners from the @av_scanners list produce 'clean' nor # 'infected' status (e.g. they all fail to run or the list is empty), # then _all_ scanners from the @av_scanners_backup list are tried. # When there are both daemonized and command-line scanners available, # it is customary to place slower command-line scanners in the # @av_scanners_backup list. The default choice is somewhat arbitrary, # move entries from one list to another as desired. @av_scanners_backup = ( # Commented out because the name 'sweep' clashes with the Debian package of # the same name. Make sure the correct sweep is found in the path when enabling # # ### http://www.sophos.com/ # ['Sophos Anti Virus (sweep)', 'sweep', # '-nb -f -all -rec -ss -sc -archive {}', # [0,2], qr/Virus .*? found/, # qr/^>>> Virus(?:(?: fragment)? '?(.+?)'? found)/, # # sub {$ENV{SAV_IDE}='/usr/local/sav'}, # ], ); # # Section VIII - Debugging # # The most useful debugging tool is to run amavisd-new non-detached # from a terminal window: # amavisd debug # Some more refined approaches: # If sender matches ACL, turn debugging fully up, just for this one message #@debug_sender_acl = ( "test-sender\@$mydomain" ); #@debug_sender_acl = qw( debug@example.com ); # May be useful along with @debug_sender_acl: # Prevent all decoded originals being deleted (replaced by decoded part) #$keep_decoded_original_re = new_RE( qr/.*/ ); # Turn on SpamAssassin debugging (output to STDERR, use with 'amavisd debug') #$sa_debug = 1; # defaults to false #------------- 1; # insure a defined return