silently discarding infected messages

Andrew Gay <[email protected]>
Newsgroups gmane.mail.exim.exiscan.user
Message-ID <E1Bx0Uh-0007d7-00@nero>
Hi all

I'm trying to use exim's 'discard' ACL verb to silently reject messages
containing virusses.  Up to now I have used 'deny' which has the unwanted
effect of causing a bounce message to be generated by the upstream MTA.

Here's my complete data ACL:

check_message:

  # Skip anti-virus and spam checking if sending host is local
  accept  hosts = +relay_hosts
  accept  authenticated = *

  deny    message = This message contains malformed MIME
          log_message = R=<$recipients> malformed MIME ($demime_reason)
          demime = *
          condition = ${if >{$demime_errorlevel}{2}{1}{0}}

  # Use discard instead of deny to silently accept virusses and delete them.
  # The defer_ok causes the message to get through in case scanner is down.
  discard log_message = R=<$recipients> contains virus ($malware_name)
          demime = *
          malware = */defer_ok

  deny    message = This message contains an attachment we do not permit (.$foun
d_extension)
          log_message = R=<$recipients> contains attachment (.$found_extension)
          demime = bat:com:exe:pif:scr:vbs

  warn    message = X-Spam-Score: $spam_score
          condition = ${if <{$message_size}{80k}{1}{0}}
          spam = exim:true

  warn    message = X-Spam-Report: $spam_report
          condition = ${if <{$message_size}{80k}{1}{0}}
          spam = exim:true

  # Add new subject header if spam score exceeds spamd's threshold.
  # This header is temporary and is rewritten as the subject header in
  # the system filter.
  warn    message = X-New-Subject: [SPAM?] $header_Subject:
          condition = ${if <{$message_size}{80k}{1}{0}}
          spam = exim/defer_ok

  accept

The problem is that the log_message clause appears to be ignored.  When an
infected message arrives, the exim_mainlog shows

2004-08-17 10:03:08 1Bwzs3-0004A4-63 => blackhole (DATA ACL discarded 
recipients)

I'd like to be able to log the message recipient(s) and the name of the virus.
The exim spec seems to indicate that log_message should work with discard, but
it doesn't seem to work for me.

Any ideas?  Is there a better way to achieve what I'm after?

(Using exim-4.34 and the corresponding exiscan-acl).

Andrew Gay
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.