Alternative Methods Of Content Filtering; Scanning E-Mail Messages Using Amavis; Amavis - ESET NOD32 ANTIVIRUS - FOR LINUX-BSD MAIL SERVER Installation Manual

To accomplish the whole procedure, one has to restart the MTA Qmail.

4.4. Alternative methods of content filtering

Although mechanisms described in previous sections are concerned to be the basic mechanisms of the e-mail
messages scanning, there exists yet other possibilities that are all described in this section.

4.4.1. Scanning e-mail messages using AMaViS

AMaViS - A Mail Virus Scanner is a tool that interfaces your MTA and several anti-virus scanners. It supports Sendmail,
QMail, Postfix, Exim and comes in three branches:

amavis

for low/medium mail volume
amavisd
for higher mail volume, daemonized version of amavis
amavisd-new
for higher mail volume, Anti-Spam, ISP features, ...
Amavis cooperates with the anti-virus by using its command line interface nod32cli (see the nod32cli(1) manual
page for details). Yet before we go into detailed explanation of the Amavis configurations, we would like to discuss the
impact of the method on the anti-virus software functionality.
First, note that Amavis does not allow modification of the body of scanned e-mail messages directly by anti-virus
software. Particularly, no infected e-mail message processed and delivered to the final recipient will be cleaned directly
by anti-virus software. Second consequence is that no NOD32 footnote will be written into the e-mail body. Another
feature of the described method is that the modification of e-mail header is indirect from the point of view of the
antivirus software. Particularly, status dependent, header modification directly by the anti-virus is disabled. Taking into
account the above statements we recommend the use of Amavis configuration (described in the next sections) only in
case the above discussed features of the product are not requested by the user.
4.4.1.1. amavis
Configuration of Amavis is performed during the process of Amavis installation. For installation, first unpack the
source amavis-0.x.y.tgz and overwrite the file amavis/av/nod32cli with this contents:
#
# ESET Software NOD32 Command Line Interface, Version 2.52
#
if ($nod32cli) {
do_log(2,"Using $nod32cli");
chop($output = '$nod32cli --subdir $TEMPDIR/parts');
$errval = retcode($?);
do_log(2,$output);
if ($errval == 0) { # no errors, no viruses found
$scanner_errors = 0;
} elsif ($errval == 1 || $errval == 2) {
# no errors, viruses discovered
$scanner_errors = 0;
chapter 4 / Integration with E-mail Messaging System
7