amavis-user February 2012 archive
Main Archive Page > Month Archives  > amavis-user archives
amavis-user: Re: Warn virus recipients only for non spam mail?

Re: Warn virus recipients only for non spam mail?

From: Mark Martinec <Mark.Martinec+amavis_at_nospam>
Date: Thu Feb 09 2012 - 16:09:22 GMT
To: amavis-users@amavis.org

Michael,

> is it possible just to warn recipients of virus mails only if SA score
> is below $sa_kill_level_deflt??
>
> $warnvirusrecip =1 send a notify on all virus mails to recipient.

This isn't possible off-the-shelf, some hack is needed.
Try the attached patch for 2.7.0.

Amavis normally considers infected mail as the top reason to block it.
Spam scanning is not even performed for infected mail, partly to save
resources, and partly to offer some small protection against malware
to spam scanner(s).

So the attached patch needs to overcome the above performance+security
measure, and then disable $warnrecip_maps_by_ccat{&CC_VIRUS}
when CC_SPAM is also detected as a contents category.

This patch will *not* find its way into the next version, as I think
it goes against the purpose of recipient notifications (if these still
have any purpose at all). I think there may be better ways of
dealing with infected spam. Note that a spam scanner often
recognize infected mail as spam, which probably invalidates
the intention of having virus recipient notifications enabled.

Perhaps the reason behind your wish is that some virus scanners
declare spam as infection. There is a better way to deal with this,
by using @virus_name_to_spam_score_maps .

  Mark