Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

From: amavis-user-bounces@lists.sourceforge.net
>
> Giampaolo,
>
> > What if I put PASS as the final destiny of banned
> > content? Is the banned content checked against SA *and*
> > defanged (in this order) before delivery?
>
> > My setup specifies defanging for banned content. So, instead of using
> > banned_file_lover setting, I should put D_PASS in the banned ccat and I
> > would get banneds defanged AND delivered to the the folder in the user
> > mailbox they belong according to their spam score, right?
>
> With 2.5.0 yes.

I want it. No, I need it! :)

Oh, by the way. Is it a per-user config, right?


> With 2.4.* the defanging does notice and act on all flagged content types,
> but the catch is the SA is not called when content is known to be banned
> or infected, so defanging does not know that it should encapsulate message
> and attach a spam report.

Ah, that's why!


> With 2.5.0, SA will still be called even if banned file is detected, so
> defanging would reliably mark such banned+spam mail with a banned+spam
> report.
> Note however that I'm reluctant to call SA when mail is known to be
> infected (for security reasons), so even in 2.5.0 when recipient is a
> virus lover, and mail is also spam, it would not be known to be spam
> and flagged as such. Enabling this is just a matter of commenting out
> some lines, but I believe I won't do this in a released code.

Well, I don't see any problem about this with known viri. However, one may occasionally get some unknown viri too, which may behave as bad as the firsts. So, avoiding SA on viri maybe limits the risk, but doesn't avoid it. Why not spawn a new child to run SA only on the specific message in which a virus or a banned had been detected? Would it reduce the risk?

One more question. The defang message is a bit crude and I would like to personalize it. 2.5.x supports a defang message template?

Also about templating in general. Two or three years ago I tried to do an html template, but amavisd refused to work correctly with it. At the epoch, I was said that custom templating was restricted to a single text/plain mime part. Is 2.5.x finally overcaming this limitations?

Thanks,

Giampaolo


> Mark


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?p...rge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/...fo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/