[Exim] Exim + virus-scanning

Top Page
Delete this message
Reply to this message
Author: Mike Weller
Date:  
To: exim-users
Subject: [Exim] Exim + virus-scanning
Hi,

I could mail this to the mailman or amavis mailing lists, but exim
seemed more appropriate, since it involves tweaking of the exim.conf
file.

I currently run exim with amavis to scan for viruses. I also use
mailman, a mailing list program. Here's the problem... whenever
someone sends to a mailist list, it checks for viruses for each
individual mailing list recipient. Even if I don't use mailman and I
directly listed the recipients in a single e-mail, it will behave the
same way. I want it to just check ONCE and then bypass the antivirus
checking. I'm trying to figure out the easiest way to do this. Let
me explain my setup.

I have the following transports:

local_delivery
scanmails_pipe
scanmails_remote
address_pipe
address_file
address_directory
address_reply
procmail_pipe
list_transport
list_request_transport
list_admin_transport

My directors order is as follows:

scanmails
real_local
system_aliases
list_owner_director
owner_list_director
list_admin_director
list_request_director
list_director
procmail
userforward
localuser
defaultuser
virtual


The scanmails director looks like:
scanmails:
condition = "${if or {{eq {$received_protocol}{virus-scanned-ok}}} {0}{1}}"
driver = localuser
transport = scanmails_pipe

I assume that if it's not "tagged" with a "virus-scanned-ok", that
it goes to scanmails_pipe, which looks like:

scanmails_pipe:
driver = pipe
bsmtp = domain
batch_max = 32767
command = "/usr/sbin/scanmails -f ${sender_address} -d ${local_part}"
...etc...

/usr/sbin/scanmails scans for the virus and has this line under
the "no virus IF clause":

    /usr/sbin/exim -bS -oMr virus-scanned-ok < ${tmpdir}/receivedmail


So, i assume that it is remailed, and on the 2nd pass through, it
bypasses the scanmails director and proceeds to put it in the user's
mailbox...

I'm not entirely sure where to start. Has anyone done this before?

Let's start with something simple. If I e-mail 3 users: weller, test3
and test4 in the same message, my SYSLOG looks like this. I removed
some unimportant lines and split it up. You can see 3 separate PIDs
for scanmails:

Aug 6 20:07:02 zyvex exim[18758]: 2001-08-06 20:07:02 15TvKo-0004sY-00 <= weller@??? U=weller P=local S=751 from <weller@???> for test3 test4 weller

Aug 6 20:07:02 zyvex scanmails[18762]: No virus found
Aug 6 20:07:02 zyvex exim[18841]: 2001-08-06 20:07:02 15TvKo-0004tt-00 <= weller@??? U=test3 P=virus-scanned-ok S=909 id=E15TvKo-0004sY-00@??? from <weller@???> for test3@???
Aug 6 20:07:02 zyvex exim[18842]: 2001-08-06 20:07:02 15TvKo-0004tt-00 => test3 <test3@???> D=localuser T=local_delivery
Aug 6 20:07:02 zyvex exim[18759]: 2001-08-06 20:07:02 15TvKo-0004sY-00 => test3 <test3@???> D=scanmails T=scanmails_pipe

Aug 6 20:07:02 zyvex scanmails[18850]: No virus found
Aug 6 20:07:02 zyvex exim[18927]: 2001-08-06 20:07:02 15TvKo-0004vH-00 <= weller@??? U=test4 P=virus-scanned-ok S=909 id=E15TvKo-0004sY-00@??? from <weller@???> for test4@???
Aug 6 20:07:02 zyvex exim[18928]: 2001-08-06 20:07:02 15TvKo-0004vH-00 => test4 <test4@???> D=localuser T=local_delivery
Aug 6 20:07:02 zyvex exim[18759]: 2001-08-06 20:07:02 15TvKo-0004sY-00 => test4 <test4@???> D=scanmails T=scanmails_pipe

Aug 6 20:07:03 zyvex scanmails[18935]: No virus found
Aug 6 20:07:03 zyvex exim[19012]: 2001-08-06 20:07:03 15TvKp-0004we-00 <= weller@??? U=weller P=virus-scanned-ok S=911 id=E15TvKo-0004sY-00@??? from <weller@???> for weller@???
Aug 6 20:07:03 zyvex exim[19013]: 2001-08-06 20:07:03 15TvKp-0004we-00 => weller <weller@???> D=localuser T=local_delivery
Aug 6 20:07:03 zyvex exim[18759]: 2001-08-06 20:07:03 15TvKo-0004sY-00 => weller <weller@???> D=scanmails T=scanmails_pipe


Any comments on this? I would love to see it scan ONCE, and then put
it in everyone's mailbox. This will probably indirectly solve the
mailman problem, too, since it probably sends mail out in batches.
Thanks.

-Mike

-- 
Michael J. Weller, M.Sc.               office: (972) 235-7881 x.242
weller@???                         cell: (214) 616-6340
Zyvex Corp., 1321 N Plano           facsimile: (972) 235-7882    
Richardson, TX 75081                      icq: 6180540