4.43.1 sophossavi testing

[Julian Field]

A new SweepViruses.pm is attached which implements the "Allowed  
Sophos Error Messages" for the SophosSAVI virus scanner. Let me know  
if there is still anything you want to change in this.


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-GZIP  33KB. ]
    [ Unable to print this part. ]


    [ Part 3: "Attached Text" ]


On 2 Jun 2005, at 21:50, Julian Field wrote:

> By the way, you might need to put it on a www server and mail me a  
> url to it.
>
> Also, what happens if you do
> cd wherever-it-is-stored
> /usr/lib/MailScanner/sophos-wrapper /usr/local/sophos -sc -f -all - 
> rec -ss -archive -loopback --no-follow-symlinks --no-reset-atime - 
> TNEF .
> (all that last bit on 1 line, and don't forget the "." on the end)
>
> What is the output? This will help me a lot to track it down.
>
> Julian Field wrote:
>
>
>> The encrypted xls file would really help, then I can actually test  
>> it myself :-)
>> mailscanner at ecs.soton.ac.uk.
>>
>> Jeff A. Earickson wrote:
>>
>>
>>> Julian,
>>>   Nope, same result for 3.  I'll test more in the morning when  
>>> I'm fresh.
>>> Do you need the encrypted xls file?  And what is your off-list email
>>> address?  I fumbled that one and accidently posted to the list.   
>>> Doh.
>>>
>>> Jeff Earickson
>>> Colby College
>>>
>>> On Thu, 2 Jun 2005, Julian Field wrote:
>>>
>>>
>>>> Date: Thu, 2 Jun 2005 21:23:38 +0100
>>>> From: Julian Field <MailScanner at ECS.SOTON.AC.UK>
>>>> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
>>>> To: MAILSCANNER at JISCMAIL.AC.UK
>>>> Subject: Re: 4.43.1 sophossavi testing
>>>>
>>>> Please try the attached patch to see if it helps problem 3. The  
>>>> syslogging should be fixed.
>>>>
>>>> Jeff A. Earickson wrote:
>>>>
>>>>
>>>>> Julian,
>>>>>
>>>>> My testing of the sophossavi tweak:
>>>>>
>>>>> 1) Email encrypted xls file, settings are:
>>>>> Allowed Sophos Error Messages = "File was encrypted"
>>>>> Virus Scanners = sophos clamavmodule
>>>>>
>>>>> Email delivered, no complaints in syslog (OK)
>>>>>
>>>>> 2) Email encrypted xls file, settings are:
>>>>> Allowed Sophos Error Messages = "File was encrypted"
>>>>> Virus Scanners = sophossavi clamavmodule
>>>>>
>>>>> Email delivered, but MailScanner syslogged:
>>>>>
>>>>> SophosSAVI::ERROR:: File was encrypted (530):: ./ 
>>>>> j52JOpu2020635/94237001F.xls
>>>>>
>>>>> I would expect MailScanner to be quiet like the "sophos"
>>>>> setting.  People will think that a bad file had slipped thru.
>>>>>
>>>>> 3) Email encrypted xls file, settings are:
>>>>> Allowed Sophos Error Messages = Virus Scanners = sophos  
>>>>> clamavmodule
>>>>>
>>>>> THE MESSAGE GOT DELIVERED!!  No complaints in syslog,
>>>>> landed in the recipient's mail.  A bad file DID slip thru.
>>>>>
>>>>> 3) Email encrypted xls file, settings are:
>>>>> Allowed Sophos Error Messages = Virus Scanners = sophossavi  
>>>>> clamavmodule
>>>>>
>>>>> Properly blocked, noted in syslog, not delivered (OK).
>>>>>
>>>>> Jeff Earickson
>>>>> Colby College

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!