List Info

Thread: mysql based attachment filtering




mysql based attachment filtering
country flaguser name
United States
2008-03-20 08:09:23
It seems that amavisd-new is checking a message for virus,
then spam,
and then lastly for banned attachments.  Was this by design
and is it
configurable in what order to check the email?  If I receive
a banned
attachment, there is no need to do a spam check, I just want
to
quarantine or discard it.  TIA

 

Wazir A. Shpoon

Senior Application Engineer
>|SECNAP Network Security

Winner - Hot Companies of 2008
Office: 561-999-5000 x 1256
Direct: 561-939-7256

 


____________________________________________________________
_____________
This email has been scanned and certified safe by
SpammerTrap(tm). 
For Information please see http://www.spammertrap.com

____________________________________________________________
_____________

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Re: mysql based attachment filtering
country flaguser name
Slovenia
2008-03-21 12:14:54
Wazir,

> It seems that amavisd-new is checking a message for
virus, then spam,
> and then lastly for banned attachments.  Was this by
design and is it
> configurable in what order to check the email?

It is not configurable.

> If I receive a banned attachment, there is no need to
do a spam check,
> I just want to quarantine or discard it.

See http://www.ijs.si/software/amavisd/amavisd-new-docs.html

 -> performing mail checks
 -> acting on mail checks results

But you are right, the spam checking is done (in current
versions)
despite a message bening banned for all recipients (note the
two
commented-out statements - preceeded by a '#'):

    # consider doing spam scanning
    if (!$extra_code_antispam) {
      do_log(5, "no anti-spam code loaded, skipping
spam_scan");
    } elsif (virusname) {
      do_log(5, "infected contents, skipping
spam_scan");
  # } elsif ($banned_filename_all) {
  #   do_log(5, "banned contents, skipping
spam_scan");
    } elsif (!grep {!$_->bypass_spam_checks} {$msginfo->per_recip_data}) {
      do_log(5, "bypassing of spam checks requested for
all recips");
    } else {

You may uncomment these two statements to get the behaviour
you want.

I'm not exactly sure why I decided it was better to still do
the
spam checking despite having a banned message. I believe the
reason
is that it is valuable to know (when checking the logs and
quarantine)
whether a message can *also* be regarded as spam, so there
is no need
to double-guess wheter a messages was perhaps a banned
false-positive
and whether it is worth checking it and releasing it.

  Mark

------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

[1-2]

about | contact  Other archives ( Real Estate discussion Medical topics )