New Server on RH8.0

[Bob McClure Jr]

On Fri, May 14, 2004 at 05:53:34PM -0700, Rick Stevens wrote:
> Karl Perason wrote:
> ><quote who="Rick Stevens">
> >
> ><snip>
> >
> >>Remember that an "mbox" is one file.  clamscan doesn't pull it apart,
> >>purge the infection and put it back together--it deletes the _file_
> >>(which happens to be "mbox").  For the "--remove" to only delete the
> >>infected message, you need to be scanning a MailDir-style mail account.
> >
> >
> >Drat. That's what I'd do. It's really not that hard:
> >
> >Parse the file, find the virus, reverse to the previous "From " and delete
> >that line until the next "From " is found. done.
> 
> Yes, but that's not what it does.  It doesn't know that the file is a
> collection of messages.  It just deletes the file containing the virus.
> Unfortunately, that's your entire inbox.
> 
> If you want to add mbox-filtering capability to it, I'm sure the clamav
> folk would LOVE to have your patches, if there aren't some already
> (check the "contrib" directory of the tarball).

I have a homebrew script hooked into /etc/procmailrc that tears open
suspicious mail, feeds the parts to clam(d)scan, and punts anything
with a virus.  (If I did it over again, I'd use AMaViS (with ClamAV)
instead of my homebrew script.)  Point being it works on a piece of
mail at a time.

> ><snip>
> 
> >Thanks Rick. Glad to see you are still on the list.

Amen.

> I'm an assistant sysop, no less!  I'm like that piece of gum on the
> bottom of your shoe.  No matter how hard you try, bits of me stick!
> ;-)
> ----------------------------------------------------------------------
> - Rick Stevens, Senior Systems Engineer     rstevens at vitalstream.com -
> - VitalStream, Inc.                       http://www.vitalstream.com -

Cheers,
-- 
Bob McClure, Jr.             Bobcat Open Systems, Inc.
robertmcclure at earthlink.net  http://www.bobcatos.com
Spring - God's greeting card.