[Avcheck] avcheck in postfix

Michael Tokarev mjt at tls.msk.ru
Sat Jan 17 00:52:49 MSK 2004


Piotr KUCHARSKI wrote:
> On Wed, Nov 19, 2003 at 04:02:15AM +0300, Michael Tokarev wrote:
> 
>>Ugh.  That your email was marked "to do" in my inbox.. and still is
>>here.  The problem is that the patch, which is available on my ftp area,
>>does not really works anymore with current stable postfix release (it
>>definitely does not work with snapshots).  That is, virus-infected
>>emails stays in queue instead of being deleted, in active queue, without
>>any recipients.  All the rest works fine - normal delivery, virus
>>notifications/whatever.  And I didn't manage to figure out what's the
>>problem.  The patch workde with initial 2.0 releases.
> 
> What a pity. :-/
> 
> Perhaps you've found the problem?

Nope.  I was very busy lately.. like last 7 or 8 months... ;)
And since i'm blocking executables using postfix (MZxxx in base64),
my virusscanner does not really work (it works but catches exactly
nothing), and hence for me, the stuff "Just Works(tm)" as it is.. ;)

With current smtp proxy in recent postfix snapshots, i'm moving to
this direction.  Avcheck will still be needed to scan mails that
was not scanned at submission time (e.g. due to high system load
or the like), but it will not see 99% of emails, so a patch will
not be needed.

The stuff (smtp proxy that collects messages and contacts local
antivirus daemon, when submits the mail using smtp) is "draft-ready",
that is, i've proof-of-concept code written in about a hour (it
is select-loop-based to save resources).

> 
>>ftp://ftp.corpit.ru/pub/postfix/postfix-2.0.4-content_inspector.diff -
>>it is there since 22nd Feb 2003.
> 
> Btw, DEL_STAT_INSPECTED really should be "0", like DEL_STAT_FINAL?

Hmm... looks so... ;)  But honestly, I don't remember... ;)

/mjt



More information about the Avcheck mailing list