Re: clamav-milter whitelist
Newcomer01 via clamav-users <[email protected]> Sun, 21 Dec 2025 19:57:35 +0000
| Newsgroups | gmane.comp.security.virus.clamav.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============4795888564673101429== Content-Type: multipart/alternative; boundary="------------vpfZuUyi9J7GbAYJIBcps0HF" Content-Language: en-US, de-DE This is a multi-part message in MIME format. --------------vpfZuUyi9J7GbAYJIBcps0HF Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit it seems the basic POSIX do not support matching groups: https://en.wikibooks.org/wiki/Regular_Expressions/POSIX_Basic_Regular_Expressions so your REGEX From:^(user1|user2|user3)@domain.tld$ will never work Von / From: Daniel Colquitt Via Clamav-Users <mailto:[email protected]> An / To: Newcomer01 <mailto:[email protected]> CC / CC: Daniel Colquitt <mailto:[email protected]> Gesendet / Sent: Sonntag, Dezember 21, 2025 um 20:13 (at 08:13 PM) +0100 Betreff / Subject: Re: [clamav-users] clamav-milter whitelist > From the man page for clamav-milter.conf > <https://linux.die.net/man/5/clamav-milter.conf> > >> Whitelist STRING >> This option specifies a file which contains a list of basic POSIX regular expressions. Addresses (sent to or from - see below) matching these regexes will not be scanned. Optionally each line can start with the string "From:" or "To:" (note: no whitespace after the colon) indicating if it is, respectively, the sender or recipient that is to be whitelisted. If the field is missing, "To:" is assumed. Lines starting with #, : or ! are ignored. > However, with the whitelist set as defined in my original message, > emails [email protected] are still scanned and, indeed, flagged as > infected. I would like messages from emails that match the whitelist to > be excluded from the scan. > > Dan > > On 21/12/2025 18:31, Newcomer01 via clamav-users wrote: >> okay and what is your problem now? Didn't also understand what you want >> to do with your whitelist and what should happen then? >> >> Von / From: Newcomer01 Via Clamav-Users<mailto:clamav- [email protected]> >> An / To: Newcomer01<mailto:[email protected]> >> CC / CC: Newcomer01<mailto:[email protected]> >> Gesendet / Sent: Sonntag, Dezember 21, 2025 um 18:19 (at 06:19 PM) +0100 >> Betreff / Subject: Re: [clamav-users] clamav-milter whitelist >> >> _______________________________________________ >> >> Manage your clamav-users mailing list subscription / unsubscribe: >> https://lists.clamav.net/mailman/listinfo/clamav-users >> >> >> Help us build a comprehensive ClamAV guide: >> https://github.com/Cisco-Talos/clamav-documentation >> >> https://docs.clamav.net/#mailing-lists-and-chat --------------vpfZuUyi9J7GbAYJIBcps0HF Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body text="#000000" bgcolor="#ffffff" smarttemplateinserted="true"> <div id="smartTemplate4-template">it seems the basic POSIX do not support matching groups: <a class="moz-txt-link-freetext" href="https://en.wikibooks.org/wiki/Regular_Expressions/POSIX_Basic_Regular_Expressions">https://en.wikibooks.org/wiki/Regular_Expressions/POSIX_Basic_Regular_Expressions</a><br> so your REGEX <span style="white-space: pre-wrap">From:^(user1|user2|user3)@domain.tld$ will never work</span></div> <div id="smartTemplate4-quoteHeader"><br> <table style="border-collapse: collapse; width: 100%; border-top: 2px solid #808080; font-family: Verdana, Arial, sans-serif; color: #000000; font-size: 13px; background-color: #eeeeee;"> <tbody> <tr style="vertical-align: top;"> <td style="width: 120px; vertical-align: middle;"><span style="color: #cc0000;">Von / From:</span></td> <td style="vertical-align: middle;"><a style="text-decoration: none;" href="mailto:[email protected]">Daniel Colquitt Via Clamav-Users</a></td> </tr> <tr style="vertical-align: top;"> <td style="width: 120px; vertical-align: middle;"><span style="color:#cc0000;">An / To:</span></td> <td style="vertical-align: middle;"><a style="text-decoration: none;" href="mailto:[email protected]">Newcomer01</a></td> </tr> <tr style="vertical-align: top;"> <td style="width: 120px; vertical-align: middle;"><span style="color: #cc0000;">CC / CC:</span></td> <td style="vertical-align: middle;"><a style="text-decoration: none;" href="mailto:[email protected]">Daniel Colquitt</a></td> </tr> <tr style="vertical-align: top;"> <td style="width: 120px; vertical-align: middle;"><span style="color: #cc0000;">Gesendet / Sent:</span></td> <td style="vertical-align: middle;"> Sonntag, Dezember 21, 2025 um 20:13 (at 08:13 PM) +0100</td> </tr> <tr style="vertical-align: top;"> <td style="width: 120px; vertical-align: middle;"><span style="color: #cc0000;">Betreff / Subject:</span></td> <td style="vertical-align: middle;">Re: [clamav-users] clamav-milter whitelist</td> </tr> </tbody> </table> </div> <blockquote type="cite" cite="mid:[email protected]"> <pre wrap="" class="moz-quote-pre"> From the man page for clamav-milter.conf <a class="moz-txt-link-rfc2396E" href="https://linux.die.net/man/5/clamav-milter.conf"><https://linux.die.net/man/5/clamav-milter.conf></a> </pre> <blockquote type="cite"> <pre wrap="" class="moz-quote-pre">Whitelist STRING This option specifies a file which contains a list of basic POSIX regular expressions. Addresses (sent to or from - see below) matching these regexes will not be scanned. Optionally each line can start with the string "From:" or "To:" (note: no whitespace after the colon) indicating if it is, respectively, the sender or recipient that is to be whitelisted. If the field is missing, "To:" is assumed. Lines starting with #, : or ! are ignored. </pre> </blockquote> <pre wrap="" class="moz-quote-pre"> However, with the whitelist set as defined in my original message, emails from <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> are still scanned and, indeed, flagged as infected. I would like messages from emails that match the whitelist to be excluded from the scan. Dan On 21/12/2025 18:31, Newcomer01 via clamav-users wrote: </pre> <blockquote type="cite"> <pre wrap="" class="moz-quote-pre">okay and what is your problem now? Didn't also understand what you want to do with your whitelist and what should happen then? Von / From: Newcomer01 Via Clamav-Users <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><mailto:clamav- [email protected]></a> An / To: Newcomer01 <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><mailto:[email protected]></a> CC / CC: Newcomer01 <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><mailto:[email protected]></a> Gesendet / Sent: Sonntag, Dezember 21, 2025 um 18:19 (at 06:19 PM) +0100 Betreff / Subject: Re: [clamav-users] clamav-milter whitelist </pre> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">_______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: <a class="moz-txt-link-freetext" href="https://lists.clamav.net/mailman/listinfo/clamav-users">https://lists.clamav.net/mailman/listinfo/clamav-users</a> Help us build a comprehensive ClamAV guide: <a class="moz-txt-link-freetext" href="https://github.com/Cisco-Talos/clamav-documentation">https://github.com/Cisco-Talos/clamav-documentation</a> <a class="moz-txt-link-freetext" href="https://docs.clamav.net/#mailing-lists-and-chat">https://docs.clamav.net/#mailing-lists-and-chat</a> </pre> </blockquote> </blockquote> <br> </body> </html> --------------vpfZuUyi9J7GbAYJIBcps0HF-- --===============4795888564673101429== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat --===============4795888564673101429==--