Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-19 Thread Henrik K
On Sun, Apr 19, 2009 at 01:16:44AM +0200, Mark Martinec wrote: > Henrik, > > > > > > Perhaps a good compromise is to only do MIME decoding but no other > > > > > archives decoding, and let a virus scanner also see the complete > > > > > message: > > > > > @decoders = (); > > > > > @keep_decoded_or

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-18 Thread Mark Martinec
Henrik, > > > > Perhaps a good compromise is to only do MIME decoding but no other > > > > archives decoding, and let a virus scanner also see the complete > > > > message: > > > > @decoders = (); > > > > @keep_decoded_original_maps = (new_RE( qr'^MAIL$' )); > It does not work optimally. Even wit

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Henrik K
On Sat, Apr 18, 2009 at 01:06:51AM +0200, Mark Martinec wrote: > Michael, > > > > Perhaps a good compromise is to only do MIME decoding but no other > > > archives decoding, and let a virus scanner also see the complete > > > message: > > > > > > @decoders = (); > > > @keep_decoded_original_maps =

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Mark Martinec
Michael, > > Perhaps a good compromise is to only do MIME decoding but no other > > archives decoding, and let a virus scanner also see the complete > > message: > > > > @decoders = (); > > @keep_decoded_original_maps = (new_RE( qr'^MAIL$' )); > > So this will work on 2.6.2? Both bounce killer an

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Michael Scheidell
> > Perhaps a good compromise is to only do MIME decoding but no other > archives decoding, and let a virus scanner also see the complete > message: > > @decoders = (); > @keep_decoded_original_maps = (new_RE( qr'^MAIL$' )); > > > So this will work on 2.6.2? Both bounce killer and penpals? -

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-17 Thread Mark Martinec
> > > Mark, would it be possible to have some option to only do the stuff > > > that bounce killer needs and not write unnecessary parts to disk? > > > > Amavisd-New already does this, just set "bypass-decode_parts = 1" in > > your amavisd.conf file, and your good to go (works with amavisd-new > >

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-09 Thread Michael Scheidell
> >> >> Mark, would it be possible to have some option to only do the stuff that >> bounce killer needs and not write unnecessary parts to disk? > > Amavisd-New already does this, just set "bypass-decode_parts = 1" in > your amavisd.conf file, and your good to go (works with amavisd-new > 2.5.1-p

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Henrik K
On Wed, Apr 08, 2009 at 04:08:35PM -0700, Bill Landry wrote: > Henrik K wrote: > > On Wed, Apr 08, 2009 at 02:43:00PM -0700, Bill Landry wrote: > >> Michael Scheidell wrote: > >>> and it looks like sane security test #2 and 3 did fail if I don't do > >>> this in amavisd.conf: > >>> (uncomment out

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Bill Landry
Henrik K wrote: > On Wed, Apr 08, 2009 at 02:43:00PM -0700, Bill Landry wrote: >> Michael Scheidell wrote: >>> and it looks like sane security test #2 and 3 did fail if I don't do >>> this in amavisd.conf: >>> (uncomment out the qr'^MAIL'. >>> >>> so, 'can be slow'. how slow is it? and is bill la

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Henrik K
On Wed, Apr 08, 2009 at 02:43:00PM -0700, Bill Landry wrote: > Michael Scheidell wrote: > > and it looks like sane security test #2 and 3 did fail if I don't do > > this in amavisd.conf: > > (uncomment out the qr'^MAIL'. > > > > so, 'can be slow'. how slow is it? and is bill landry wrong saying

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Michael Scheidell
> sanesecurity site: > refrences this archived email: > says to set bypass_decode_parts=1 in amavisd.conf > Like bill says, you need one or the other. Now, looking at readmes' and example. header L_AV_Phish X-Amavis-AV-Status =~ m{\b(Email|HTML)\.Phishing\.}i header L_AV_SS_Phish X-Amavi

Re: [AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Bill Landry
Michael Scheidell wrote: > sanesecurity site: > refrences this archived email: > says to set bypass_decode_parts=1 in amavisd.conf > > amavisd says to set it to 0 if you are using bounce_killer or using > 'file' to guess the attachment type. > > (i have it set to 0, using bounce killer and file)

[AMaViS-user] sanesecurity sigs and bounce_killer ?

2009-04-08 Thread Michael Scheidell
sanesecurity site: refrences this archived email: says to set bypass_decode_parts=1 in amavisd.conf amavisd says to set it to 0 if you are using bounce_killer or using 'file' to guess the attachment type. (i have it set to 0, using bounce killer and file) (http://marc.info/?t=11795129371&r=