Re: [Clamav-users] quarantine on specific from address

2008-02-20 Thread G.W. Haywood
Hi there, On Wed, 20 Feb 2008 Gomes, Rich wrote: > This is really cool, but it got me thinking... > > Can this trigger on certain events in the maillog? > > Say: 'User address required' or 'invalid host name' > > Those are errors I am constintly chasing on this box (like I said its an > internal

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Noel Jones
Gomes, Rich wrote: > This is really cool, but it got me thinking... > > Can this trigger on certain events in the maillog? > > Say: 'User address required' or 'invalid host name' > > Those are errors I am constintly chasing on this box (like I said its an > internal relay). > > > Just throwin

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Gomes, Rich
.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gomes, Rich Sent: Tuesday, February 19, 2008 3:42 PM To: ClamAV users ML Subject: Re: [Clamav-users] quarantine on specific from address Scratch that!! It works!!! Now to go back to the developers and

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Gomes, Rich
: Re: [Clamav-users] quarantine on specific from address Ok, here's what I have done: Created a file called customclam1.db in /var/clamav/main.inc The contents of the file are: temp.email.signature=reallylonghexstringminus0a I have saved the file and restarted the clam daemon and clamav-m

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Gomes, Rich
s not getting quarantined. Am I missing something? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of jef moskot Sent: Tuesday, February 19, 2008 3:03 PM To: ClamAV users ML Subject: Re: [Clamav-users] quarantine on specific from address On Tue, 19 Feb

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Gomes, Rich
PM To: ClamAV users ML Subject: Re: [Clamav-users] quarantine on specific from address On Tue, 19 Feb 2008, Gomes, Rich wrote: > How do you run sigtool in interactive mode? Just type "sigtool --hex-dump" (without the quotes) at the command line. Whatever you type in will be converted in

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread jef moskot
On Tue, 19 Feb 2008, Gomes, Rich wrote: > How do you run sigtool in interactive mode? Just type "sigtool --hex-dump" (without the quotes) at the command line. Whatever you type in will be converted into hex on the next line (although, again, it will also convert the linefeed, so strip off the las

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Gomes, Rich
When I run these, it just seems to hang. How do you run sigtool in interactive mode? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of jef moskot Sent: Tuesday, February 19, 2008 2:51 PM To: ClamAV users ML Subject: Re: [Clamav-users] quarantine on

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread jef moskot
On Tue, 19 Feb 2008, Brandon Perry wrote: > sigtool --hex-dump [EMAIL PROTECTED] | tee ~/mycustomsignature.db That didn't do anything for me either, and it doesn't address the issue of naming the signature in the database. Sometimes a good old-fashioned cut-and-paste is simpler than fun-with-pipe

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Brandon Perry
If sigtool --hex-dump [EMAIL PROTECTED] > mycustomsignature.db doesn't work, try sigtool --hex-dump [EMAIL PROTECTED] | tee ~/mycustomsignature.db On Tue, 2008-02-19 at 14:30 -0500, jef moskot wrote: > On Tue, 19 Feb 2008, Gomes, Rich wrote: > > So if I am going to trigger on one address (i.e. [

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread jef moskot
On Tue, 19 Feb 2008, Gomes, Rich wrote: > So if I am going to trigger on one address (i.e. [EMAIL PROTECTED]) > my syntax will be: > > sigtool --hex-dump [EMAIL PROTECTED] > mycustomsignature.db That mght work, but the proper format is to have a name for the signature, so Clam knows what to ca

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread Gomes, Rich
19, 2008 12:41 PM To: ClamAV users ML Subject: Re: [Clamav-users] quarantine on specific from address On Tue, 19 Feb 2008, Gomes, Rich wrote: > I have a specific need to quarantine emails coming from a particular > email address. A quick hack would be to make a signature that includes the add

Re: [Clamav-users] quarantine on specific from address

2008-02-19 Thread jef moskot
On Tue, 19 Feb 2008, Gomes, Rich wrote: > I have a specific need to quarantine emails coming from a particular > email address. A quick hack would be to make a signature that includes the address, and some other identifying information from a mail header. Everything you need to know is here, alth