Charles Swiger wrote:
> On Jul 19, 2016, at 10:39 AM, Kris Deugau <kdeu...@vianet.ca> wrote:
>> ClamAV hits on any of the Heuristics.* tests get flagged instead of
>> treated the same as the signature-based hits, and that flag either
>> causes an an adjustment in the SpamAssassin results returned directly to
>> MIMEDefang later on, or a header is added which I check for in
>> SpamAssassin on mail delivery.
>
> Are you using LMTP, or did SpamAssassin grow a local delivery agent
> capability?
Wearing my ISP sysadmin hat, for inbound mail we have a custom delivery
agent that calls both ClamAV and SA, along with doing a number of other
tasks. We don't currently handle Heuristics.* hits differently,
something I'd like to change. On our outbound servers they're flagged
and added to the SA results.
On my personal server, which happens to still be on sendmail, I use
procmail for local delivery. My new server in (very slow) progress will
run Postfix, but I'll still use procmail for local delivery. For all
that it's not the friendliest tool it does its job quite well and I'm
the only user who has any need of complex delivery rules. I'd switch to
something using sieve but I don't like the limitation on not calling
external programs - it makes it much harder to write a set of delivery
rules like this:
if (sender is newsletter A)
deliver to folder news
if (sender is newsletter B)
deliver to folder news
call a lightweight content filter
if the filter says "Spam"
deliver to folder spam
if (received from a mailing list that allows nonsubscriber posts)
deliver to folder spammynews
call a process-expensive content filter
if the filter says "Spam"
deliver to folder spam
deliver to the Inbox
Which about sums up my .procmailrc, although the live one is much longer.
-kgd
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
