Re: [exim] detect, if malware scanner is unreachable

Góra strony
Delete this message
Reply to this message
Autor: mouse
Data:  
Dla: Exim-users
Stare tematy: [exim] detect, if malware scanner is unreachable
Temat: Re: [exim] detect, if malware scanner is unreachable
On 2020-06-11 10:04, Niki W. Waibel wrote:
>    hi,

>
>
>
>    is sthg like this possible with the malware scanner(s)?

>
>
>
>    hope i was clear enough, as i am quite new to exim.

>
>    thank you in advance, niki

>

Assuming that AV scanner returns an error to Exim (that is non-zero exit
code):

###
warn
      set acl_m9 = not_scanned
      malware = *
      logwrite = This message was detected as possible malware 
($malware_name).
      set acl_m9 = scanned
###


Initially acl_m9 is set to "not_scanned". If AV scanner failed then
"malware = *" condition is not met, so acl_m9 is not set to "scanned".
Later you can use acl_m9 and malware_name values in another ACL
statements to deny/defer/accept message.

PS. Tested on Exim 4.94.2