[clamav-users] ClamAVPlugin

[Rick Cooper]

Joe Acquisto-j4 wrote:
>> Hi there,
>> 
>> On Thu, 18 Feb 2021, Joe Acquisto-j4 wrote:
>> 
>>> Any pointers for using the ClamAVPlugin?
>> 
>> Could you flesh that out a bit?
>> . . .
>> One of the things I do is scan stuff using my own Perl milter, but it
>> never occurred to me that I needed a Perl module to do it with, since
>> the clamd API is very straightforward and you can just send stuff to
>> clamd from Perl by the ordinary IPC means available in Perl.  Before
>> you spend a lot of time on this, perhaps you can tell us more about
>> what you want to achieve.
> 
> Thanks for the reply.
> 
> Sorry I did not think to explain properly.  Using Postfix and
> Spamassassinm on an OpenSuse version of Linux (15.1 or something)
> wanting to add AV scanning to incoming mail.   Started attempting
> Sophos for Linux (savd ?) but they have or soon will abandon the
> product. 
> 
> Decided on ClamAV and after some fumbling had it working through use
> of 
> the ClamAVPlugin.  At lesat an EICAR test email was flagged properly.
> 
> Now, it does not appear to work any longer and am attempting to
> retrace my steps and coming up short.  As usual, I made few written
> notes and am slow to admit my "total recall" may no longer bet
> exactly "total". 
> 
> So basically, just want to tie ClavAV (using clamd) into PF/SA to
> scan and flag incoming email.  In a way that does not require I
> learn, or relearn 
> 
> Aside, I did notice the "security issue" but, thought it minor, in my
> rather isolated environment.  Perhaps you feel it is a serious issue?
> 
> joe a

I don't run postfix and connecting clamd to exim is trivial requiring
nothing but a functioning clamd daemon.
However I did look at options that might be better at connecting to the
clamd daemon and were it me I would look at clamsmtpd for integration. Looks
pretty straight forward to  me:

http://thewalter.net/stef/software/clamsmtp/