Mailing List Archive

exim av_scanner disable scan outgoing email
Hello, i use clamav with exim but I see that outgoing mail is analyzed from local accounts.

## exim configure

av_scanner = clamd:x.x.x.x 3310

deny malware = */defer_ok
message = This message contains a virus ($malware_name).


Can outgoing mail analysis be avoided?

Regards,

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: exim av_scanner disable scan outgoing email [ In reply to ]
On 24/01/2019 12:47, Emanuel Gonzalez via Exim-users wrote:
> deny malware = */defer_ok
> message = This message contains a virus ($malware_name).
>
>
> Can outgoing mail analysis be avoided?

Yes, just put a suitable condition on the verb before the
"malware" condition, to not-select your local accounts.

However, I question that you should. Do you not want to detect
your customers being infected and becoming virus-sources?
--
Cheers,
Jeremy

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: exim av_scanner disable scan outgoing email [ In reply to ]
Hi Harris, thanks for your reply.

in the configuration of clamav, the file limit that I can analyze is 1 MB but in the exim, the limit of the attachment that I can send is 25 MB, as the limit of clamav is exceeded, in the exim I see this error:

malware acl condition: clamd : unable to send file body to socket

The connection is lost because it exceeds the size that can be analyzed by clamav and the mail is not sent. If the attachment is greater than 1 MB, it should not be sent to Clamav, this is possible.????

Regards,

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: exim av_scanner disable scan outgoing email [ In reply to ]
On 24/01/2019 14:19, Emanuel Gonzalez via Exim-users wrote:
> The connection is lost because it exceeds the size that can be analyzed by clamav and the mail is not sent. If the attachment is greater than 1 MB, it should not be sent to Clamav, this is possible.????

Look at the $message_size variable, and the docs chapters on expansions
and on ACLs.
--
Cheers,
Jeremy

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/