Re: Archive function ignoring SA and CLAMAV checks

Jason Haar <[email protected]>
Newsgroups gmane.mail.qmail.scanner
Organization Trimble Navigation Ltd.
Message-ID <[email protected]>
Facundo Barrera - GMail wrote:
> Hi list:
>         i'm having some issues with the archive function, it work just
> fine, but it bypass clamav and sa checks, so i receive tons of spam
> and viruses, any idea? also i receive messages from no users that have
> same caracters of the real address, let's say:
>
> [email protected] , the archive function backup mails from [email protected] also.
>
> Anyone know how to solute this?
>
> Thanks in advance.
>   
At first I thought you meant that enabling archive DISABLED all AV and
SA checks. But now I look at it again, I think you mean that the
archiving function is archiving viruses and spam as well as the "normal"
stuff?

That certainly shouldn't happen. If a message is "quarantinable", then
it is. Only at the end - after such decisions are made by Q-S - is the
"$archiveit" variable checked and the message archived. So that should
only contain non-quarantined messages. However that does mean that spam
that scored 8/5 would be archived. After all, if it's delivered to a
user - then it should be archived.

Also, header details associated with each archived message is appended
to each message in the archive. I think you'll find the messages that
you think were mis-classified actually did match correctly.


-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.