Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Bill Landry
> On Wed, 20 May 2009 06:45:43 -0700 > Bill Landry wrote: > >> I wish ClamAV had instead opted to whitelist based on the actual >> hexadecimal signature instead of the signature file:line:name, as that >> would make keeping the .ign files up-to-date for a script a much easier >> process. >> >> Cla

[Clamav-users] clamav-milter 0.95.1 quarantine

2009-05-20 Thread Steven Stern
in earlier versions, we used --quarantine-dir=/var/spool/clamav in /etc/sysconfig/clamav-milter to quarantine messages in that directory. It now seems that they go into a sendmail quarantine queue. (mailq -qQ). How do I get them back into the clamav directory? man clamav-milter seems to be lack

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Tomasz Kojm
On Wed, 20 May 2009 12:54:04 -0400 "Jason Bertoch" wrote: > Would there be any harm in having the hash as another parameter in the .ign > file? It seems like a minor adjustment in parsing for the clam code would > allow more flexibility and automation on the admin side. Alternatively, > since .

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Jason Bertoch
> -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clamav.net] On Behalf Of Tomasz Kojm > Sent: Wednesday, May 20, 2009 12:39 PM > To: clamav-users@lists.clamav.net > Subject: Re: [Clamav-users] Deletion of local.ign > > the .ign databa

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Tomasz Kojm
On Wed, 20 May 2009 06:45:43 -0700 Bill Landry wrote: > I wish ClamAV had instead opted to whitelist based on the actual > hexadecimal signature instead of the signature file:line:name, as that > would make keeping the .ign files up-to-date for a script a much easier > process. > > ClamAV, pleas

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Dennis Peterson
Bill Landry wrote: > > So, the problem with checking to see if the .ign entry still resides in > the database file or not has a flaw. As a signature writer, if I have a > signature that, for example is called: > >Spam.Email.123:25:26f757073 > > and someone reports this as a false positive

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Jason Bertoch
> -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clamav.net] On Behalf Of Bill Landry > Sent: Wednesday, May 20, 2009 9:46 AM > To: ClamAV users ML; sanesecur...@freelists.org > Subject: Re: [Clamav-users] Deletion of local.ign > > >

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Bill Landry
Jason Bertoch wrote: >> -Original Message- >> From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- >> boun...@lists.clamav.net] On Behalf Of Bill Landry >> Sent: Wednesday, May 20, 2009 8:27 AM >> To: sanesecur...@freelists.org; clamav-users@lists.clamav.net >> Subject: Re: [Cl

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Jason Bertoch
> -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clamav.net] On Behalf Of Bill Landry > Sent: Wednesday, May 20, 2009 8:27 AM > To: sanesecur...@freelists.org; clamav-users@lists.clamav.net > Subject: Re: [Clamav-users] Deletion of loc

Re: [Clamav-users] Deletion of local.ign

2009-05-20 Thread Bill Landry
Hi Folks, I just got the following question off-list, which I would like to respond to on-list for everyones benefit: > I just got this on the last update using 3.3: > > File 'local.ign' timestamp is older than 24 hours - file deleted > > That local.ign I need (it's the whitelist of signatures