[Mimedefang] Virus notification to virus administrator

jan hugo prins jhp at jhprins.org
Thu Jan 7 10:31:12 EST 2016


On 01/07/2016 01:28 PM, Juergen Kleff wrote:
> Hej,
> what about action_quarantine_entire_message(), which also sends a mail 
> to the mimedefang-admin, and action_notify_administrator()? And there 
> is add_recipient() and delete_recipient(), which might be useful in 
> your case.

Adding the action_quarantine_entire_message() and enabling
send_quarantine_notifications() in filter_end results indeed
in a message being put in Quarantine and a notification of
this message to the administrator.

I'm also able to get the virus name into the quarantine message.
But it seems that the variable $VirusScannerMessages stays empty.

In mimedefang.pl I have found the options that are being used
when scanning files and I tested them against an EICAR test file
and this gives the following result:

[root at mailserver /]# clamscan -r --stdout --no-summary --infected
/home/jprins/eicarcom2.zip: Eicar-Test-Signature FOUND

[root at mailserver /]# fpscan --report --archive=5  --scanlevel=4
--heurlevel=3  ~jprins/eicarcom2.zip

F-PROT Antivirus version (built: 2008-04-28T16-56-20)
FRISK Software International (C) Copyright 1989-2007

Engine version:
Virus signatures: 2016010706416ffdec6f95d46145bb42aebd7efc8a31

[Found virus] <EICAR_Test_File (exact, not disinfectable)>     
[Contains infected objects]     /home/jprins/eicarcom2.zip


Files: 1
Skipped files: 0
MBR/boot sectors checked: 0
Objects scanned: 3
Infected objects: 1
Files with errors: 0
Disinfected: 0

Running time: 00:01

I would have expected to see this output in $VirusScannerMessages.

Jan Hugo Prins

More information about the MIMEDefang mailing list