[Mimedefang] Milter: data, reject=451 4.7.1 Please try again later
Jason Englander
jason at englanders.cc
Tue May 21 17:51:36 EDT 2002
On Tue, 21 May 2002, Lu wrote:
> I have File::scan installed and configure even recognizes it.
>
> However, I do not see anything calling it in mimedefang-filter.
>
> Anyone using this?
>
> If so, please share with us how you are calling it from
> /etc/mail/mimedefang-filter
If you haven't already, check the mimedefang-filter man page. In there
you'll find info about this one: message_contains_virus_filescan()
and this one: entity_contains_virus_filescan($entity)
At home, where I don't have to answer to anyone else (other than my
girlfriend), I'm doing something like this right now:
filter_begin {
# other stuff goes here...
$infected_filescan = message_contains_virus_filescan()
if $Features{"File::Scan"};
# other stuff goes here...
if ($infected_filescan) {
action_quarantine_entire_message($VirusScannerMessages);
return action_bounce('Message contains a known virus');
}
# other stuff goes here...
}
You'll probably want to get further into it than that though. (see the
notes in the man page about $code, $category, $action, etc.) That
very simple example above would reject messages that File::Scan thinks
are 'suspicious' too, which you might not want to do. ...and you might
not want to reject them like I'm doing at all. Running
message_contains_virus_filescan in filter_begin and then checking
entity_contains_virus_filescan in filter can set you up so you can
quarantine just an infected attachment, leaving the rest as-is.
Maybe something like this:
filter_begin {
$infected_filescan = message_contains_virus_filescan();
}
filter {
my($entity, $fname, $ext, $type) = @_;
if ($infected_filescan) {
$VirusScannerMessages = "";
if (entity_contains_virus_filescan($entity)) {
action_notify_sender(
"The attachment $fname was deleted. It contains a known virus.\n".
"Here is the output from the virus scanner:\n$VirusScannerMessages"
);
return action_quarantine($entity,
"The attachment $fname contains a known virus. It has been\n".
"quarantined. Here is the output from the virus scanner:\n".
"$VirusScannerMessages"
);
}
}
}
Jason
--
Jason Englander
jason at englanders.cc
More information about the MIMEDefang
mailing list