Pkg exim4 users - Jun 2005 - Easiest way to install antivirus and antispam on Exim 4.5 and debian

Hi,

I''ve just installed Exim 4.5 on debian, I''d like to know what
it''s the
easiest way to install antivirus and antispam, and which packages are the
most used.

Thanks to any light.

Jesus Gutierrez

* Jose de Jesus Gutierrez Ramirez (jgtez@previtep.com.mx) [050610
20:20]:
> I''ve just installed Exim 4.5 on debian, I''d like to know
what it''s the
> easiest way to install antivirus and antispam, and which packages are the
> most used.
exim4-daemon-heavy includes the exiscan extensions for filtering.

I use something like
   deny message   = This message contains malformed MIME ($demime_reason)
        demime    = *
        condition = ${if >{$demime_errorlevel}{2}{1}{0}}

   deny message   = This message contains an attachment of a type we
don''t accept (.$found_extension)
        demime    = bat:com:pif:prf:scr:vbs

.ifdef MALWARE_SCANNING
   deny message   = This message contains a virus or other harmful content
($malware_name)
        demime    = *
        malware   = *
.endif

in my acl_check_data (together with an installed clamav and
av_scanner = clamd:/var/run/clamav/clamd.ctl
MALWARE_SCANNING in the main sections, and it works well. Spamassassin can be
integrated
similar.


Cheers,
Andi

Hi Andreas,

Thanks, I''ve installed clamav and exim4-daemon-heavy packages, but I
have a
question, clamd must be running as a daemon? I don''t see the file
/var/run/clamav/clamd.ctl, or it doesn''t matter and exim start the
process
each time he needs it?

TIA

Jesus Gutierrez

-----Mensaje original-----
De: pkg-exim4-users-admin@lists.alioth.debian.org
[mailto:pkg-exim4-users-admin@lists.alioth.debian.org]En nombre de
Andreas Barth
Enviado el: Viernes, 10 de Junio de 2005 01:45 p.m.
Para: Jose de Jesus Gutierrez Ramirez
CC: pkg-exim4-users@lists.alioth.debian.org
Asunto: Re: [Pkg-exim4-users] Easiest way to install antivirus and
antispam on Exim 4.5 and debian


* Jose de Jesus Gutierrez Ramirez (jgtez@previtep.com.mx) [050610
20:20]:
> I''ve just installed Exim 4.5 on debian, I''d like to know
what it''s the
> easiest way to install antivirus and antispam, and which packages are the
> most used.
exim4-daemon-heavy includes the exiscan extensions for filtering.

I use something like
   deny message   = This message contains malformed MIME ($demime_reason)
        demime    = *
        condition = ${if >{$demime_errorlevel}{2}{1}{0}}

   deny message   = This message contains an attachment of a type we
don''t
accept (.$found_extension)
        demime    = bat:com:pif:prf:scr:vbs

.ifdef MALWARE_SCANNING
   deny message   = This message contains a virus or other harmful content
($malware_name)
        demime    = *
        malware   = *
.endif

in my acl_check_data (together with an installed clamav and
av_scanner = clamd:/var/run/clamav/clamd.ctl
MALWARE_SCANNING in the main sections, and it works well. Spamassassin can be
integrated
similar.


Cheers,
Andi

_______________________________________________
Pkg-exim4-users mailing list
Pkg-exim4-users@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users

On Fri, Jun 10, 2005 at 04:28:11PM -0500, Jose de Jesus Gutierrez Ramirez
wrote:
> X-SA-Exim-Connect-IP: 127.0.0.1
> 
> Hi Andreas,
> 
> Thanks, I''ve installed clamav and exim4-daemon-heavy packages, but
I have a
> question, clamd must be running as a daemon? I don''t see the file
> /var/run/clamav/clamd.ctl, or it doesn''t matter and exim start the
process
> each time he needs it?
> 
> TIA
> 
You need to edit /etc/default/spamassassin and make:

ENABLED=1

to enable spamd.

Steven.
-- 
 .''''`.
: :''  :
`. `''`
  `-

* Jose de Jesus Gutierrez Ramirez (jgtez@previtep.com.mx) [050610
23:29]:
> Hi Andreas,
> 
> Thanks, I''ve installed clamav and exim4-daemon-heavy packages, but
I have a
> question, clamd must be running as a daemon? I don''t see the file
> /var/run/clamav/clamd.ctl, or it doesn''t matter and exim start the
process
> each time he needs it?
You need to start the daemon; also, there is
/usr/share/doc/clamav/README.Debian.gz - please read it it has important
bits about integration with exim4.


Cheers,
Andi

Thanks again,

I put the clamav-daemon and now I can see the /var/run/clamav/clamd.ctl
file. But I made the eicar.com virus test file and send it trough Exim and
it wasn''t detected.

I read /usr/share/doc/clamav/README.Debian.gz and I got no clue what could
be wrong.

Any Idea?

Jesus Gutierrez

-----Mensaje original-----
De: pkg-exim4-users-admin@lists.alioth.debian.org
[mailto:pkg-exim4-users-admin@lists.alioth.debian.org]En nombre de
Andreas Barth
Enviado el: Viernes, 10 de Junio de 2005 04:59 p.m.
Para: Jose de Jesus Gutierrez Ramirez
CC: pkg-exim4-users@lists.alioth.debian.org
Asunto: Re: [Pkg-exim4-users] Easiest way to install antivirus and
antispam on Exim 4.5 and debian


* Jose de Jesus Gutierrez Ramirez (jgtez@previtep.com.mx) [050610
23:29]:
> Hi Andreas,
>
> Thanks, I''ve installed clamav and exim4-daemon-heavy packages, but
I have
a
> question, clamd must be running as a daemon? I don''t see the file
> /var/run/clamav/clamd.ctl, or it doesn''t matter and exim start the
process
> each time he needs it?
You need to start the daemon; also, there is
/usr/share/doc/clamav/README.Debian.gz - please read it it has important
bits about integration with exim4.


Cheers,
Andi

_______________________________________________
Pkg-exim4-users mailing list
Pkg-exim4-users@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users

Hi, After adding the suggested lines,

I receive the next messagge error...

2005-06-14 12:01:24 1DiEmy-00063f-7k malware acl condition: clamd: ClamAV
return
ed /var/spool/exim4/scan/1DiEmy-00063f-7k: Access denied. ERROR

I think it''s a permissions problem, so I checked the priveleges of this
directory

#ls -l /var/spool/exim4/

drwxr-x---  2 Debian-exim Debian-exim 4096 2005-06-14 12:11 scan

the user runinng clamd is clamav

# ps -ef|grep clamd
clamav   10941     1  0 Jun10 ?        00:01:01 /usr/sbin/clamd
clamav   13480 10941  0 Jun11 ?        00:00:00 /usr/sbin/clamd

clamav is member of the Debian-exim group

I''ve changed the privileges of the /var/spool/exim4/scan directory to
have
the group write permissions.

# chmod 770 /var/spool/exim4/scan

# ls -l /var/spool/exim4/

drwxrwx---  2 Debian-exim Debian-exim 4096 2005-06-14 12:15 scan


But the problem still happening. What can be wrong?

Aprecciate any suggestions.

TIA

Jesus Gutierrez


-----Mensaje original-----
De: pkg-exim4-users-admin@lists.alioth.debian.org
[mailto:pkg-exim4-users-admin@lists.alioth.debian.org]En nombre de
Andreas Barth
Enviado el: Viernes, 10 de Junio de 2005 01:45 p.m.
Para: Jose de Jesus Gutierrez Ramirez
CC: pkg-exim4-users@lists.alioth.debian.org
Asunto: Re: [Pkg-exim4-users] Easiest way to install antivirus and
antispam on Exim 4.5 and debian


* Jose de Jesus Gutierrez Ramirez (jgtez@previtep.com.mx) [050610
20:20]:
> I''ve just installed Exim 4.5 on debian, I''d like to know
what it''s the
> easiest way to install antivirus and antispam, and which packages are the
> most used.
exim4-daemon-heavy includes the exiscan extensions for filtering.

I use something like
   deny message   = This message contains malformed MIME ($demime_reason)
        demime    = *
        condition = ${if >{$demime_errorlevel}{2}{1}{0}}

   deny message   = This message contains an attachment of a type we
don''t
accept (.$found_extension)
        demime    = bat:com:pif:prf:scr:vbs

.ifdef MALWARE_SCANNING
   deny message   = This message contains a virus or other harmful content
($malware_name)
        demime    = *
        malware   = *
.endif

in my acl_check_data (together with an installed clamav and
av_scanner = clamd:/var/run/clamav/clamd.ctl
MALWARE_SCANNING in the main sections, and it works well. Spamassassin can be
integrated
similar.


Cheers,
Andi

_______________________________________________
Pkg-exim4-users mailing list
Pkg-exim4-users@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/pkg-exim4-users

* Jose de Jesus Gutierrez Ramirez (jgtez@previtep.com.mx) [050614
19:18]:
> the user runinng clamd is clamav
> 
> # ps -ef|grep clamd
> clamav   10941     1  0 Jun10 ?        00:01:01 /usr/sbin/clamd
> clamav   13480 10941  0 Jun11 ?        00:00:00 /usr/sbin/clamd
> 
> clamav is member of the Debian-exim group
Did you reastart the daemon after adding the user? Otherwise, that
doesn''t have any effect.


Cheers,
Andi