silently discarding infected messages
Andrew Gay <[email protected]>
| Newsgroups | gmane.mail.exim.exiscan.user |
|---|---|
| Message-ID | <E1Bx0Uh-0007d7-00@nero> |
Hi all
I'm trying to use exim's 'discard' ACL verb to silently reject messages
containing virusses. Up to now I have used 'deny' which has the unwanted
effect of causing a bounce message to be generated by the upstream MTA.
Here's my complete data ACL:
check_message:
# Skip anti-virus and spam checking if sending host is local
accept hosts = +relay_hosts
accept authenticated = *
deny message = This message contains malformed MIME
log_message = R=<$recipients> malformed MIME ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
# Use discard instead of deny to silently accept virusses and delete them.
# The defer_ok causes the message to get through in case scanner is down.
discard log_message = R=<$recipients> contains virus ($malware_name)
demime = *
malware = */defer_ok
deny message = This message contains an attachment we do not permit (.$foun
d_extension)
log_message = R=<$recipients> contains attachment (.$found_extension)
demime = bat:com:exe:pif:scr:vbs
warn message = X-Spam-Score: $spam_score
condition = ${if <{$message_size}{80k}{1}{0}}
spam = exim:true
warn message = X-Spam-Report: $spam_report
condition = ${if <{$message_size}{80k}{1}{0}}
spam = exim:true
# Add new subject header if spam score exceeds spamd's threshold.
# This header is temporary and is rewritten as the subject header in
# the system filter.
warn message = X-New-Subject: [SPAM?] $header_Subject:
condition = ${if <{$message_size}{80k}{1}{0}}
spam = exim/defer_ok
accept
The problem is that the log_message clause appears to be ignored. When an
infected message arrives, the exim_mainlog shows
2004-08-17 10:03:08 1Bwzs3-0004A4-63 => blackhole (DATA ACL discarded
recipients)
I'd like to be able to log the message recipient(s) and the name of the virus.
The exim spec seems to indicate that log_message should work with discard, but
it doesn't seem to work for me.
Any ideas? Is there a better way to achieve what I'm after?
(Using exim-4.34 and the corresponding exiscan-acl).
Andrew Gay