Re: Exim4 + ClamAV + Some Virii get through

2004-08-04 Thread David Purton
On Wed, Aug 04, 2004 at 09:43:41PM +0930, David Purton wrote: > On Tue, Aug 03, 2004 at 12:04:07PM -0700, Paul Johnson wrote: > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA1 > > > > David Purton <[EMAIL PROTECTED]> writes: > > > > > I have a question about virus scanning at smtp time. Sadly

Re: Exim4 + ClamAV + Some Virii get through

2004-08-04 Thread David Purton
On Tue, Aug 03, 2004 at 12:04:07PM -0700, Paul Johnson wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > David Purton <[EMAIL PROTECTED]> writes: > > > I have a question about virus scanning at smtp time. Sadly I still > > find Exim4 acl stuff a bit of a black art :( > > > > Sometimes

Re: Exim4 + ClamAV + Some Virii get through

2004-08-03 Thread Alan Chandler
On Tuesday 03 August 2004 20:07, Paul Johnson wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Alan Chandler <[EMAIL PROTECTED]> writes: > > Actually you can go further than that here is a sample from my config > > file (I have recombined into a single exim4.conf file) Not only can > >

Re: Exim4 + ClamAV + Some Virii get through

2004-08-03 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alan Chandler <[EMAIL PROTECTED]> writes: > Actually you can go further than that here is a sample from my config > file (I have recombined into a single exim4.conf file) Not only can > you reject malformed mime, you can reject certain attachments and

Re: Exim4 + ClamAV + Some Virii get through

2004-08-03 Thread Paul Johnson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Purton <[EMAIL PROTECTED]> writes: > I have a question about virus scanning at smtp time. Sadly I still > find Exim4 acl stuff a bit of a black art :( > > Sometimes a virus that clamav *does* already know about gets through. That's usually a ne

Re: Exim4 + ClamAV + Some Virii get through

2004-08-03 Thread Alan Chandler
On Tuesday 03 August 2004 08:12, David Purton wrote: > On Tue, Aug 03, 2004 at 07:27:39AM +0100, Alan Chandler wrote: > > On Tuesday 03 August 2004 02:25, David Purton wrote: > > ... > > > > > It offers these lines, which might help in > > > /etc/exim4/conf.d/acl/40_exim4-config_check_data: > > > >

Re: Exim4 + ClamAV + Some Virii get through

2004-08-03 Thread David Purton
On Tue, Aug 03, 2004 at 07:27:39AM +0100, Alan Chandler wrote: > On Tuesday 03 August 2004 02:25, David Purton wrote: > ... > > > > It offers these lines, which might help in > > /etc/exim4/conf.d/acl/40_exim4-config_check_data: > > > > > > deny message = This message contains malformed MIME ($demi

Re: Exim4 + ClamAV + Some Virii get through

2004-08-02 Thread Alan Chandler
On Tuesday 03 August 2004 02:25, David Purton wrote: ... > > It offers these lines, which might help in > /etc/exim4/conf.d/acl/40_exim4-config_check_data: > > > deny message = This message contains malformed MIME ($demime_reason) > demime = * > condition = ${if >{$demime_errorlevel}{2}{1}{0}}

Exim4 + ClamAV + Some Virii get through

2004-08-02 Thread David Purton
Hi, I have a question about virus scanning at smtp time. Sadly I still find Exim4 acl stuff a bit of a black art :( Sometimes a virus that clamav *does* already know about gets through. I notice from my Exim logs that this is often accompanied by this sort of message: 2004-08-03 09:27:31 1Brmg