1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
#!/usr/bin/perl -w
=head1 NAME
clamdscan
=head1 DESCRIPTION
A qpsmtpd plugin for virus scanning using the ClamAV scan daemon, clamd.
=head1 RESTRICTIONS
The ClamAV scan daemon, clamd, must have at least read access to the
qpsmtpd spool directory in order to sucessfully scan the messages. You can
ensure this by running clamd as the same user as qpsmtpd does (by far the
easiest method) or by doing the following:
=over 4
=item * Change the group ownership of the spool directory to be a group
of which clamav is a member or add clamav to the same group as the qpsmtpd
user.
=item * Enable the "AllowSupplementaryGroups" option in clamd.conf.
=item * Change the permissions of the qpsmtpd spool directory to 0750 (this
will emit a warning when the qpsmtpd service starts up, but can be safely
ignored).
=item * Make sure that all directories above the spool directory (to the
root) are g+x so that the group has directory traversal rights; it is not
necessary for the group to have any read rights except to the spool
directory itself.
=back
It may be helpful to temporary grant the clamav user a shell and test to
make sure you can cd into the spool directory and read files located there.
Remember to remove the shell from the clamav user when you are done
testing.
=head1 INSTALL AND CONFIG
Place this plugin in the plugin/virus directory beneath the standard
qpsmtpd installation. If you installed clamd with the default path, you
can use this plugin with default options (nothing specified):
=over 4
=item B<clamd_socket>
Full path to the clamd socket (the recommended mode); defaults to
/tmp/clamd and is the default method.
=item B<clamd_port>
If present, must be the TCP port where the clamd service is running,
typically 3310; default disabled. If present, overrides the clamd_socket.
=item B<deny_viruses>
Whether the scanner will automatically delete messages which have viruses.
Takes either 'yes' or 'no' (defaults to 'yes'). If set to 'no' it will add
a header to the message with the virus results.
=item B<max_size>
The maximum size, in kilobytes, of messages to scan; defaults to 128k.
=back
=head1 REQUIREMENTS
This module requires the Clamd module, found on CPAN here:
L<http://search.cpan.org/author/MSERGEANT/Clamd-1.04>
=head1 AUTHOR
John Peacock <jpeacock@cpan.org>
=head1 COPYRIGHT AND LICENSE
Copyright (c) 2005 John Peacock
Based heavily on the clamav plugin
This plugin is licensed under the same terms as the qpsmtpd package itself.
Please see the LICENSE file included with qpsmtpd for details.
=cut
use Clamd;
sub register {
my ( $self, $qp, @args ) = @_;
%{ $self->{"_clamd"} } = @args;
# Set some sensible defaults
$self->{"_clamd"}->{"clamd_socket"} ||= "/tmp/clamd";
$self->{"_clamd"}->{"deny_viruses"} ||= "yes";
$self->{"_clamd"}->{"max_size"} ||= 128;
}
sub hook_data_post {
my ( $self, $transaction ) = @_;
$DB::single = 1;
if ( $transaction->data_size > $self->{"_clamd"}->{"max_size"} * 1024 ) {
$self->log( LOGNOTICE, "Declining due to data_size" );
return (DECLINED);
}
# Ignore non-multipart emails
my $content_type = $transaction->header->get('Content-Type');
$content_type =~ s/\s/ /g if defined $content_type;
unless ( $content_type
&& $content_type =~ m!\bmultipart/.*\bboundary="?([^"]+)!i )
{
$self->log( LOGNOTICE, "non-multipart mail - skipping" );
return DECLINED;
}
my $filename = $transaction->body_filename;
unless ($filename) {
$self->log( LOGWARN, "Cannot process due to lack of filename" );
return (DECLINED); # unless $filename;
}
my $mode = ( stat( $self->spool_dir() ) )[2];
if ( $mode & 07077 ) { # must be sharing spool directory with external app
$self->log( LOGWARN,
"Changing permissions on file to permit scanner access" );
chmod $mode, $filename;
}
my $clamd;
if (
(
$self->{"_clamd"}->{"clamd_port"}
and $self->{"_clamd"}->{"clamd_port"} =~ /(\d+)/
)
or ( $self->{"_clamd"}->{"clamd_socket"}
and $self->{"_clamd"}->{"clamd_socket"} =~ /([\w\/.]+)/ )
)
{
my $port = $1;
$clamd = Clamd->new( port => $port );
}
else {
$clamd = Clamd->new(); # default unix domain socket
}
unless ( $clamd->ping() ) {
$self->log( LOGERROR, "Cannot ping clamd server - did you provide the correct clamd port or socket?" );
return DENYSOFT;
}
if ( my %found = $clamd->scan($filename) ) {
my $viruses = join( ",", values(%found) );
$self->log( LOGERROR, "One or more virus(es) found: $viruses" );
if ( lc( $self->{"_clamd"}->{"deny_viruses"} ) eq "yes" ) {
return ( DENY,
"Virus"
. ( $viruses =~ /,/ ? "es " : " " )
. "Found: $viruses" );
}
else {
$transaction->header->add( 'X-Virus-Found', 'Yes' );
$transaction->header->add( 'X-Virus-Details', $viruses );
return (DECLINED);
}
}
$transaction->header->add( 'X-Virus-Checked',
"Checked by ClamAV on " . $self->qp->config("me") );
return (DECLINED);
}
|
