procmail
[Top] [All Lists]

Re: attachment scanning

2002-08-13 13:17:00
On Fri, 9 Aug 2002, Gerardo Herzig  [iso-8859-15] -Dirección de Organización y 
Sistemas.  Facultad de Medicina- wrote:

Hi all:

I`m using metamail to save attachments in a temp folder, so i can
"F-PROT"  them. So, i use something like:

        Unfortunately metamail doesn't know the Content type
        "multipart/alternative" you can miss some files.  My solution
        is change the headers of the attachment:

sed '/^Content.*multipart\/alternative/s/\/alternative/\/mixed/'



METAMAIL_TMPDIR="$HOME/attachments"
ATT=`/usr/bin/metamail -w -x -q`

        I use   metamail -r -y -w -q -x


SCAN=`f-prot $HOME/attachments > /dev/null;  echo $?`

        Try  f-prot -archive -dumb -silent ...


:0 r:
* ! $SCAN ?? 0   ### F-PROT return 0 if attachment is clean ###
! antivirus


It seems work fine, but sometimes, i got this message in the log file:

Ignoring unparsable content-type parameter: ''

And the email goes (infected sometimes) stright to the account. I guess is
"flags of metamail" related, but....


        For this reasons and more I wrote simple recipe which call
        to script:

:0 fw
| /etc/local/bin/isvirus

        The isvirus changes the mime headers, calls to metamail,
        run F-prot, save the header for notification to the user,
        log, and and... exit with the "right" status  (:-)  i.e. if
        virus was found then return 0.  If you want I'll send it to you.

        In this days, I try to run F-prot directly (with no extract the
        messages, it works!) but it is still test.   Yet, I do not know,
        does it miss viruses?

Bye,
 Udi

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>