[clamav-users] whitelist with clamav-milter

[Ted Hatfield]

On Thu, 27 Sep 2018, Reindl Harald wrote:
>
>
> Am 27.09.18 um 11:04 schrieb Arnaud Jacques:
>>> I then restarted the milter. Unfortunately, the email is still marked as
>>> Spam. I thought that clamav-milter would simply ignore the file.
>>>
>>> X-Virus-Status: Infected (SecuriteInfo.com.Spam-4701.UNOFFICIAL)
>>
>> You can whitelist the signature this way :
>> https://www.securiteinfo.com/services/anti-spam-anti-virus/whitelisting_clamav_signatures.shtml
>
> clamav-milter has exactly one whitelist which prevents clamd scanning
> the message as a whole - that's it
>
> if you use some middleware to configure your stuff consult the docs of
> that middleware
>
> clamilt      928  0.0  0.0 991272  5028 ?        SNsl Sep14   1:36
> /usr/sbin/clamav-milter -c /etc/mail/clamav-milter.conf
>
> [root at mail-gw:~]$ cat /etc/mail/clamav-milter.conf | grep whitelist
> Whitelist /etc/mail/clamav-milter-whitelist.conf
>
> [root at mail-gw:~]$ cat /etc/mail/clamav-milter-whitelist.conf
> To:4dba8486.6080402 at thelounge.net
> To:4fb1369f.2030906 at thelounge.net
> To:5290082c.4070905 at thelounge.net
> To:52b075ab.3070803 at thelounge.net
> To:52c17637.9080600 at thelounge.net
> From:seclists.org
> From:securityfocus.com
> From:spamassassin.apache.org
>
> (the strange from where seen in maillogs and created as honeypots to
> catch bayes-trainings-corpus....)
>

Thanks for the clarification.  Very helpful.

Ted Hatfield