[Mimedefang] Milter: data, reject=451 4.7.1 Please try again later

Jason Englander jason at englanders.cc
Tue May 21 17:51:36 EDT 2002


On Tue, 21 May 2002, Lu wrote:

> I have File::scan installed and configure even recognizes it.
>
> However, I do not see anything calling it in mimedefang-filter.
>
> Anyone using this?
>
> If so, please share with us how you are calling it from
> /etc/mail/mimedefang-filter

If you haven't already, check the mimedefang-filter man page.  In there
you'll find info about this one: message_contains_virus_filescan()
and this one: entity_contains_virus_filescan($entity)

At home, where I don't have to answer to anyone else (other than my
girlfriend), I'm doing something like this right now:


filter_begin {
  # other stuff goes here...
  $infected_filescan = message_contains_virus_filescan()
    if $Features{"File::Scan"};
  # other stuff goes here...
  if ($infected_filescan) {
    action_quarantine_entire_message($VirusScannerMessages);
    return action_bounce('Message contains a known virus');
  }
  # other stuff goes here...
}


You'll probably want to get further into it than that though.  (see the
notes in the man page about $code, $category, $action, etc.)  That
very simple example above would reject messages that File::Scan thinks
are 'suspicious' too, which you might not want to do.  ...and you might
not want to reject them like I'm doing at all.  Running
message_contains_virus_filescan in filter_begin and then checking
entity_contains_virus_filescan in filter can set you up so you can
quarantine just an infected attachment, leaving the rest as-is.

Maybe something like this:

filter_begin {
  $infected_filescan = message_contains_virus_filescan();
}

filter {
  my($entity, $fname, $ext, $type) = @_;
  if ($infected_filescan) {
    $VirusScannerMessages = "";
    if (entity_contains_virus_filescan($entity)) {
      action_notify_sender(
        "The attachment $fname was deleted.  It contains a known virus.\n".
        "Here is the output from the virus scanner:\n$VirusScannerMessages"
      );
      return action_quarantine($entity,
        "The attachment $fname contains a known virus.  It has been\n".
        "quarantined.  Here is the output from the virus scanner:\n".
        "$VirusScannerMessages"
      );
    }
  }
}

  Jason

-- 
Jason Englander
jason at englanders.cc






More information about the MIMEDefang mailing list