Zimbra offers Open Source email server software and shared calendar for Linux and the Mac
Go Back   Zimbra :: Forums > Zimbra Collaboration Suite > Administrators

Welcome to the Zimbra :: Forums!
Welcome, if you would like to post a comment please register. We also encourage you to explore all things Zimbra with our team and members of the community.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #21 (permalink)  
Old 01-09-2010, 07:08 AM
Member
 
Posts: 9
Default

Awesome, now I won't have to worry about it getting overwritten. Unfortunatly since I caught it later due to complaints I had to just find a fix and do limited testing. Now I probably should upgrade all of my zimbra machines.
Reply With Quote
  #22 (permalink)  
Old 01-09-2010, 07:09 AM
Project Contributor
 
Posts: 50
Default it works!

yes ,it works!

clamvd has updated the db file!

everything is ok , thanks!
Reply With Quote
  #23 (permalink)  
Old 01-09-2010, 12:20 PM
raj raj is offline
Moderator
 
Posts: 768
Default

looks like here was a FALSE POSITIVE in the camavdb

ClamAV database version "10276 released on 09 Jan 2010" has this problem fixed.
if your db version is older than "10276" or not yet updated then you can do that by running the following command

Quote:
su - zimbra
/opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf
zmantivirusctl stop
zmantivirusctl start
zmcontrol status
above taken from wiki:
ClamAV - Reset Defs DB - Zimbra :: Wiki

Raj
__________________
i2k2 Networks
Dedicated & Shared Zimbra Hosting Provider
Reply With Quote
  #24 (permalink)  
Old 01-09-2010, 01:53 PM
Active Member
 
Posts: 32
Default

I wrote the following script to handle forwarding the quarantined messages in /opt/zimbra/amavisd-new-2.5.2/quarantine/ that weren't obvious spam .

Code:
#!/usr/bin/perl -w
#
# send_quarantine.pl
#
# Script to send message caught by Amavis quarantine. Feed the raw message
# into STDIN: ./send_quarantine.pl < virus-EHzL3YEPv56N
#
# Assumptions:
#
#   Amavis has added an X-Envelope-From header listing original From address.
#     Use it as the From in the SMTP call.
#
#   Amavis has added an X-Envelope-To header that breaks out the original To,
#      Cc, Bcc, etc. Use it as the To in the SMTP call.
#
#   The first Received header marks the beginning of the good RFC822 message
#      that will be fed into the SMTP call.
#
#   Script is NOT responsible for removing the quarantined message. It just
#      feeds it to and SMTP handler, that's it.
#
# Inspired by infect script at http://www.amavis.org/contrib/furio.infect
#
# Jay MacDonald - ThinkTek Solutions
#
# Licensing information: do whatever you want with this script.
# There is no warranty.  The author brings no responsibility for
# any problem or damage related with the use of this script.
#

use Net::SMTP;

my $mailhost = "localhost";
my $port = 25;

my $inTo=0;
my $inFrom=0;
my $inMsg=0;
my $From='';
my $ToList='';
my $Subject='';

while ( <> ) {
  if ( $inFrom && /^\S/ ) {
    # No longer reading an X-Envelope-From header
    $inFrom=0;
  }
  if ( $inTo && /^\S/ ) {
    # No longer reading an X-Envelope-To header
    $inTo=0;
  }

  if ( /^X-Envelope-From:\s*(.*)\s*$/ ) {
    # Found X-Envelope-From header, start building $From
    $inFrom=1;
    $From=$1;
  }
  elsif ( $inFrom && /^\s/ ) {
    # Still in X-Envelope-From, keep building $From
    s/\s//g;
    $From .= $_;
  }
  elsif ( /^X-Envelope-To:\s*(.*)\s*$/ ) {
    # Found X-Envelope-To header, start building $ToList
    $inTo=1;
    ($ToList=$1) =~ s/\s//g;
  }
  elsif ( $inTo && /^\s/ ) {
    # Still in X-Envelope-To, keep building $ToList
    s/\s//g;
    $ToList .= $_;
  }
  elsif ( /^Received:\s/ ) {
    # Assuming first Received header is where we start the real message
    # Start building $msg
    $msg=$_;
    $inMsg=1;
  }
  elsif ( $inMsg ) {
    if ( /^Subject:\s/ ) {
      # A nice to have. Note: doesn't capture multi line header
      $Subject = $_;
      chomp ($Subject);
    }
    $msg .= $_;
  }
}

if ( $From && $ToList ) {
  print "===> From = $From\n";
  print "===> ToList = $ToList\n";
  print "===> Subject = $Subject\n";
  print "\n";

  print "===> Sending message:";

  # Split the recipients into a list for passing to recipient function
  @recipients = split(/,/, $ToList);

  # Define the smtp object, build it out and send the message
  $smtp = Net::SMTP->new($mailhost, Port => $port);
  $smtp->mail($From);
  $smtp->recipient(@recipients, { SkipBad => 1 });
  $smtp->data();
  $smtp->datasend($msg);
  $smtp->dataend();
  $smtp->quit;

  # I never had anything fail, so not sure what would happen. Just send OK.
  print " OK\n";
} else {
  print "Error: From and ToList not set. Check the message and edit if required\n";
}
Reply With Quote
  #25 (permalink)  
Old 01-09-2010, 02:02 PM
Moderator
 
Posts: 6,237
Default

Thanks for the updated script Cheakamus.

Besides [SOLVED] Releasing quarantined emails wanted to point out there's a tool shaping up over in [SOLVED] qview.php - php script to handle quarantined emails (needs to get release functionality added).

RFE's:
Bug 11061 - amavisd virus quarantine should be to a mailbox
Bug 8454 - Quarantined email management functions
Reply With Quote
  #26 (permalink)  
Old 01-09-2010, 02:10 PM
Moderator
 
Posts: 6,237
Default

Could also write one specifically for this based on X-Amavis-Alert: INFECTED, message contains virus: Exploit.PDF-9669
Reply With Quote
  #27 (permalink)  
Old 01-09-2010, 02:14 PM
Moderator
 
Posts: 6,237
Default

Quote:
Originally Posted by Cheakamus View Post
I wrote the following script to handle forwarding the quarantined messages in /opt/zimbra/amavisd-new-2.5.2/quarantine/ that weren't obvious spam .
Ok one more, should also mention that becomes /opt/zimbra/data/amavisd/quarantine on later releases.
Reply With Quote
  #28 (permalink)  
Old 01-09-2010, 02:26 PM
Moderator
 
Posts: 6,237
Default

In other clamav news, as I see some of you in this thread are using older ZCS 5.x, come May: End of Life Announcement: ClamAV 0.94.x

We included 0.95 as of ZCS 5.0.18 - there's also ClamAV - Updating Version - Zimbra :: Wiki for manual directions.
Reply With Quote
  #29 (permalink)  
Old 01-12-2010, 12:24 AM
New Member
 
Posts: 4
Smile Clam AV

My testing is successful.
the latest update form CALMAV has fixed this isuue.

Thanks to every one.

Thanks!
Sankar N.
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Similar Threads

Why Join?

Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.

blog.zimbra.com




 

SEO by vBSEO ©2011, Crawlability, Inc.