Re: [clamav-users] reject/flag files based on extension
On 6/4/2024 9:27 AM, Micah Snyder (micasnyd) via clamav-users wrote: I don't think there is any mechanism in clamav-milter or clamd to alert/convinct/block attachments scans based on file extension. Perhaps there is an option in Sendmail? MIMEDefang and MailMunge do this. They're milters usable with sendmail, postfix, and other MTAs that support the milter protocol. (MIMEDefang was forked by the original author and rewritten with new Perl features to create MailMunge.) The example Perl-based filter has a list of extensions in a simple Perl regex that are blocked. It then invokes Clam and SpamAssassin to check the contents of attachments. ___ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
Re: [clamav-users] reject/flag files based on extension
I don't think there is any mechanism in clamav-milter or clamd to alert/convinct/block attachments scans based on file extension. Perhaps there is an option in Sendmail? Micah Snyder (they/them) ClamAV Development Talos Cisco Systems, Inc. From: clamav-users on behalf of Marc via clamav-users Sent: Monday, May 20, 2024 5:00 AM To: ClamAV users ML Cc: Marc Subject: Re: [clamav-users] reject/flag files based on extension > > Is it possible to configure clamav, so it rejects or marks files as virus > just based on their file extension? > When it processes data from milter. Maybe someone has experience with this? I have the impression from these pages that somewhere filenames are available within clamav, so I guess rules on extensions should be possible, not? https://docs.clamav.net/manual/Signatures/FileTypeMagic.html https://docs.clamav.net/manual/Signatures/PhishSigs.html#wdb-format ___ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat ___ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
Re: [clamav-users] reject/flag files based on extension
> > Is it possible to configure clamav, so it rejects or marks files as virus > just based on their file extension? > When it processes data from milter. Maybe someone has experience with this? I have the impression from these pages that somewhere filenames are available within clamav, so I guess rules on extensions should be possible, not? https://docs.clamav.net/manual/Signatures/FileTypeMagic.html https://docs.clamav.net/manual/Signatures/PhishSigs.html#wdb-format ___ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
[clamav-users] reject/flag files based on extension
Is it possible to configure clamav, so it rejects or marks files as virus just based on their file extension? ___ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
