Re: AW: Exiscan: notifications?

On Dec 20, 2004, at 10:32 AM, Steffen Heil wrote:

> And you should never accept a virus, you should deny it.

Please do not put a "deny" in your Exim configuration.  That will 
produce a bounce to the impersonated sender.

You must accept viruses because the sender is forged.  Otherwise, you 
will be bouncing them back to an innocent party.

Instead, use "warn" to tag the message. Then, use a router to deliver 
the message into quarantine. For example:

warn    message = X-Virus-Found: $malware_name
              malware = *

virus_router:
         driver = redirect
         directory_transport = virus_transport
         data = /var/exim/Viruses/
         user = exim
         condition = "${if def:h_x-virus-found:}"

virus_transport:
         driver = appendfile
         maildir_format = true

Last but not least, write a simple script to delete messages from your 
quarantine,

Rich Sandberg
[email protected]
Whidbey Telecom Network Operations