#!/usr/bin/suidperl -T
#
# File: qmail-scanner-queue.pl
# Version:
1.21
#
# Author: Jason L. Haar <[EMAIL PROTECTED]>
#
# This file was auto-generated by:
#
# ./configure --spooldir
/var/spool/qmailscan --qmaildir /var/qmail --bindir /var/qmail/bin
--qmail-queue-binary /var/qmail/bin/qmail-queue --admin root --domain
ns.domain.com --notify psender,nmlvadm --local-domains ns.domain.com
--silent-viruses auto --lang en_GB --debug 1 --unzip 0 --add-dscr-hdrs 0
--archive 0 --redundant no --log-details 0 --log-crypto 0 --fix-mime 2
--ignore-eol-check 0 --scanners "auto" --install 1
#
# Description:
This is a replacement/add-on for Qmail 1.0.3's qmail-queue.
# It can call
several blocking programs - such as virus scanners - on every
#
SMTP-received Email message, checking for viruses and blocked filenames,
#
only allowing the message to continue if it passes the
tests.
#
# Copyright (C) 1999,2000,2001 the people mentioned
above
#
# This program is free software; you can
redistribute it and/or modify
# it under the terms of the GNU
General Public License as published by
# the Free Software
Foundation; either version 1, or (at your option)
# any later
version. See <URL:http://www.gnu.org/copyleft/gpl.html>
#
for a copy.
#
# This program is distributed in the hope
that it will be useful,
# but WITHOUT ANY WARRANTY; without
even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE. See the
# GNU General Public License
for more details.
#
# The software is provided as is. Please
bear in mind that we have
# done this in my spare time. While
it is as accurate as we could
# make it there is a reasonable
chance that there are mistakes
# somewhere in here. If you
email me and tell me about them, I will
# be happy to fix them
but I can't take responsibility for your system.
# Basically
use this at your own risk.
#
#####################################################################
#####################################################################
##
##
Required Packages
##
## Qmail-1.03
## Perl 5.005_03+
##
Maildrop-0.73
## Bruce Guenter's QMAILQUEUE patch <URL:http://www.qmail.org/qmailqueue-patch>
##
Perl module Time::HiRes and DB_File
##
##
## So-far tested Virus
scanners:
## Trend's Virus scanner for
Linux
## MacAfee's (NAI's) virus scanner for
Linux
## Sophos's virus scanner for
Linux
## H+BEDV's antivir scanner for
Linux
## F-Secure's fsav scanner for
Linux
## P-Prot for
Linux
## Sophie (daemonized Sophos
scanner)
## Trophie (daemonized Trend
scanner)
##
#####################################################################
#####################################################################
##
##
Site-specific
config
##
#####################################################################
delete @ENV{qw(IFS CDPATH ENV BASH_ENV QMAILMFTFILE QMAILINJECT)};
use strict 'vars', 'subs';
use Sys::Syslog qw(:DEFAULT setlogsock);
setlogsock('unix');
my $VERSION="1.21";
#Mail header to add to each scanned message to report stuff
in...
#Default is to not generate them ($descriptive_hdrs = 0) - as
that
#info is also in the Received: headers...
my
$descriptive_hdrs=0;
my
$V_HEADER="X-Qmail-Scanner";
my($qsmsgid);
$qsmsgid=tolower("$V_HEADER-message-id");
#From: line information used when making reports
my $V_FROM='[EMAIL PROTECTED]';
my
$V_FROMNAME='System Anti-Virus Administrator';
# Address carbon-copied on any virus reports
my $QUARANTINE_CC='[EMAIL PROTECTED]';
#Array of local domains that are checked against for
#deciding whether
or not to send recipient alerts to
my
@local_domains_array=('ns.domain.com');
# Array of virus that we don't want to inform the sender of.
my
@silent_viruses_array=('klez','bugbear','hybris','yaha','braid','nimda','tanatos','sobig','winevar','palyh','fizzer','gibe','cailont','lovelorn','swen','dumaru','sober','hawawi','holar-i','mimail','poffer','bagle','worm.galil','mydoom','worm.sco','tanx','novarg','');
#Array of virus scanners used must point to subroutines
my
@scanner_array=("clamdscan_scanner");
#Addresses that should be alerted of any quarantined Email
my
$NOTIFY_ADDRS='psender,nmlvadm';
#Try to fix bad MIME messages before passing to MIME unpacker
my
$BAD_MIME_CHECKS='2';
#Block password protected zip files
my
$BLOCK_PASSWORD_PROTECTED_ARCHIVES='0';
#Disable just the EOL char check instead of all of BAD_MIME_CHECKS
my
$IGNORE_EOL_CHECK='0';
# The full path to qmail programs we'll need.
my $qmailinject =
'/var/qmail/bin/qmail-inject';
my $qmailqueue =
'/var/qmail/bin/qmail-queue';
# What directory to use for storing temporary files.
my $scandir =
'/var/spool/qmailscan';
#What maildir folder to store working files in
my
$wmaildir='working';
#What maildir folder to store failed messages in (for cronjob scan)
my
$fmaildir='failed';
#What maildir folder to store quarantine in
my
$vmaildir='quarantine';
#What maildir folder to archive received Email in instead of
deleting
my $archiveit='0';
my $archivedir='archives';
#Name of file in $scandir where debugging output goes
my
$debuglog="qmail-queue.log";
#Name of file where quarantine reports go (for long-term storage)
my
$quarantinelog="quarantine.log";
#Generate nice random filename
my ($sysname, $hostname, $release,
$version, $machine) = uname();
#my $hostname='ns.domain.com'; #could get
via call I suppose...
#If you trust the virus scanners handling of mbox format itself
#you may
want to let it have a go at the "raw" message, and original
#zip files if
present
my $redundant_scanning='0';
#If you want to log via file/syslog information of all Email
# that
passes through your system (from/to/subj/size/attachments)
my
$log_details="0";
#If you'd like Q-S to report which messages are PGP or S/MIME,
#turn
this on
my $log_crypto="0";
#Full path to file in which virus-scanner versioning info is kept
my
$versionfile="$scandir/qmail-scanner-queue-version.txt";
#DB file (without extension) where bad filenames are kept.
# You edit
$db_filename.txt, and "qmail-scanner-queue.pl -g" generates
$db_filename.db
my $db_filename="$scandir/quarantine-attachments";
#What locale is used on this system
#$sys_locale="LOCALE";
#Full paths to binaries used within this script follow - small
performance
#improvement :-)
my $mimeunpacker_binary='/usr/local/bin/reformime ';
my
$unzip_binary='/usr/bin/unzip';
my $unzip_options='-Pxxxxx';
my
$tnef_binary='/usr/bin/tnef';
my $rm_binary='/bin/rm';
my
$grep_binary='/bin/grep';
my $find_binary='/usr/bin/find';
my
$uudecode_binary='/usr/bin/uudecode';
my $uudecode_pipe='-o -';
my $uvscan_binary='';
my $csav_binary='';
my
$sweep_binary='';
my $sophie_binary='';
my $trophie_binary='';
my
$iscan_binary='';
my $hbedv_binary='';
my $hbedv_options='';
my
$avp_binary='';
my $avpdaemon_binary='';
my
$fprot_binary='/usr/local/bin/f-prot';
my $fsecure_binary='';
my
$inocucmd_binary='';
my $ravlin_binary='';
my $vexira_binary='';
my
$clamscan_binary='/usr/local/bin/clamscan';
my $clamscan_options="-r
--disable-summary --max-recursion=10 --max-space=100000";
my
$clamdscan_binary='/usr/local/bin/clamdscan';
my $clamdscan_options="-r
--disable-summary --max-recursion=10 --max-space=1000000";
my
$spamc_binary='';
my $spamc_options='';
my $spamc_subject='';
my
$spamassassin_binary='';
my ($sa_comment,$sa_level);
my
$sa_symbol='+';
my ($tag_score)="";
my
$SNEAKY_WINDOWS_EXTENSIONS="exe|com|pps|w[pm][szd]|vcf|nws|cmd|bat|pif|sc[rt]|dll|ocx|do[ct]|xl[swt]|p[po]t|rtf|vb[se]?|hta|p[lm]|sh[bs]|hlp|chm|eml|ws[cfh]|ad[ep]|jse?|md[abew]|ms[ip]|reg|as[dfx]|cil";
my
$VALID_WINDOWS_EXTENSIONS="sav|htm|html|pst|ost|txt|gif|jpeg|mpeg|jpg|png|mny|wav|tif|$SNEAKY_WINDOWS_EXTENSIONS";
$ENV{'PATH'}='/bin:/usr/bin';
my $SCANINFO='';
my $MAX_FILE_LENGTH=100;
my $MAX_NUM_HDRS=140;
my $QE_LEN=20;
#Maximum amount of time we allow Q-S to run before returning
# a temp
failure. This is so remote SMTP servers don't get confused
# over whether
or not they have delivered to a SMTP server
# that's refused to say "OK"
for over an hour...
# We'll default to 20 minutes. If the scanner loop
takes more than 20
# minutes to scan the message, then something *must* be
wrong with the
# scanner.
my $MAXTIME=20*60;
#Finally, are you sure your virus scanners can unpack zip files?
#McAfee's doesn't!
my $force_unzip=0;
#Descriptive string to use in generated Email
my
$destring="virus";
