Re: Multiple malware scanners

Chris Wakelin <[email protected]> wrote:
> You can do this with a custom command line running a script, but that
> misses out Exiscan's native support for various daemons.

..and means that if I want to make multiple references to the scan result
in ACLs I have to remember the results myself, rather than relying on
Exiscan's result caching.

(Well, not exactly myself, but you know what I mean...)

> I like the idea of specifying which scanner in the ACL entry, as you
> could deal with the known viruses in your favourite scanner first,
> and deal with suspect attachments that get past that with backup
> scanner(s).
>
> Something like:-
>
> acl_check_mime:
> ..
> warn  set acl_m1  = ${extract{-1}{.}{${lc:$mime_filename}}}
> warn log_message = Executable Attachment ($acl_m1) - $mime_filename
>      condition   = ${if \
>
match{$acl_m1}{\N^(vbs|vbe|wsf|wsh|js|jse|exe|com|cmd|shs|hta|bat|scr|lnk|pi
f)$\N}{1}{0}}
>      set acl_m3  = $acl_m1
>
> acl_check_content:
> ..
>
> deny message = This contains $malware_name
>   log_message = stopped $malware_name
>   malware = * : sophie
>
> deny message = This contains $malware_name
>   log_message = $malware_name got past Sophie!
>   condition = ${if !eq{$acl_m3}{} {1}{0}}
>   malware = * : clamav
>
> deny message = This contains a potentially executable ($acl_m3)
>   attachment condition = ${if !eq{$acl_m3}{} {1}{0}}

Yes, that's exactly the sort of thing I have in mind.

Tom, are you there?

Peter