1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
|
--- ../MailScanner-install-4.40.10.old/docs/man/MailScanner.conf.5.html Fri Apr 1 16:10:19 2005
+++ docs/man/MailScanner.conf.5.html Fri Apr 1 16:10:40 2005
@@ -1,5 +1,5 @@
<!-- Creator : groff version 1.19 -->
-<!-- CreationDate: Mon Jan 17 15:53:41 2005 -->
+<!-- CreationDate: Fri Apr 1 16:08:30 2005 -->
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
@@ -120,13 +120,15 @@
directories within the MailScanner installation and in the
section "RULESETS" later in this manpage.</p>
<!-- INDENTATION -->
-<p>The options are best listed in a few categories. This is
-also the order in which you will find them in the
-MailScanner.conf file. If this list looks very large then
-don’t worry, the supplied MailScanner.conf file (or
-MailScanner.conf.sample) contains sensible defaults for all
-the values. You will probably only need to change a very few
-of them to start with.</p>
+<p>The options are best listed in a few categories. If this
+list looks very large then don’t worry, the supplied
+MailScanner.conf file (or MailScanner.conf.sample) contains
+sensible defaults for all the values. You will probably only
+need to change a very few of them to start with.</p>
+<!-- INDENTATION -->
+<p>Starting with version 4.40.10 of MailScanner you can use
+shell environment variables such as $HOSTNAME or ${HOSTNAME}
+in MailScanner.conf and its relatives.</p>
<!-- INDENTATION -->
<p>You should define the following variables:</p>
</td>
@@ -220,6 +222,54 @@
headers.</p>
</td>
</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>%org−long−name%</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: Your Organisation Name Here</p>
+<!-- INDENTATION -->
+<p>Enter the full name of your organisation below, this is
+used in the signature placed at the bottom of report
+messages sent by MailScanner. It can include pretty much any
+text you like. You can make the result span several lines by
+including "0 sequences in the text. These will be
+replaced by line−breaks.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>%web−site%</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: www.your−organisation.com</p>
+<!-- INDENTATION -->
+<p>Enter the location of your organisation’s web site
+below. This is used in the signature placed at the bottom of
+report messages sent by MailScanner. It should preferably be
+the location of a page that you have written explaining why
+you might have rejected the mail and what the recipient
+and/or sender should do about it.</p>
+</td>
+</table>
<a name="System Settings"></a>
<h2>System Settings</h2>
<!-- INDENTATION -->
@@ -1071,6 +1121,54 @@
<tr valign="top" align="left">
<td width="11%"></td>
<td width="89%">
+<p><b>Unrar Command</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: /usr/bin/unrar</p>
+<!-- INDENTATION -->
+<p>Where the "unrar" command is installed. If you
+haven’t got this command, look at www.rarlab.com. This
+is used for unpacking rar archives so that the contents can
+be checked for banned filenames and filetypes, and also that
+the archive can be tested to see if it is
+password−protected. Virus scanning the contents of rar
+archives is still left to the virus scanner, with one
+exception: If using the clavavmodule virus scanner, this
+adds external RAR checking to that scanner which is needed
+for archives which are RAR version 3.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>Unrar Timeout</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: 50</p>
+<!-- INDENTATION -->
+<p>The maximum length of time the "unrar" command
+is allowed to run for 1 RAR archive (in seconds)</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
<p><b>Block Encrypted Messages</b></p></td>
</table>
<!-- INDENTATION -->
@@ -1638,6 +1736,90 @@
scanner, not the "clamav" scanner setting.</p>
</td>
</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>ClamAVmodule Maximum Recursion Level</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: 5</p>
+<!-- INDENTATION -->
+<p>ClamAVModule only: The maximum recursion level of
+archives. This setting *cannot* be the filename of a
+ruleset, only a simple number.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>ClamAVmodule Maximum Files</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: 100</p>
+<!-- INDENTATION -->
+<p>ClamAVModule only: The maximum number of files per batch.
+This setting *cannot* be the filename of a ruleset, only a
+simple number.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>ClamAVmodule Maximum File Size</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: 10000000</p>
+<!-- INDENTATION -->
+<p>ClamAVModule only: The maximum file of each file (Default
+= 10MB). This setting *cannot* be the filename of a ruleset,
+only a simple number.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p>ClamAVmodule Maximum Compression Ratio</p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: 250</p>
+<!-- INDENTATION -->
+<p>ClamAVModule only: The maximum compression ration of
+archives. This setting *cannot* be the filename of a
+ruleset, only a simple number.</p>
+</td>
+</table>
<a name="Removing/Logging dangerous or potentially offensive content"></a>
<h2>Removing/Logging dangerous or potentially offensive content</h2>
<!-- INDENTATION -->
@@ -1761,6 +1943,33 @@
<tr valign="top" align="left">
<td width="11%"></td>
<td width="89%">
+<p><b>Phishing Safe Sites File</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: %etc−dir%/phishing.safe.sites.conf</p>
+<!-- INDENTATION -->
+<p>There are some companies, such as banks, that insist on
+sending out email messages with links in them that are
+caught by the "Find Phishing Fraud" test described
+above. This is the name of a file which contains a list of
+link destinations which should be ignored in the test. This
+may, for example, contain the known websites of some banks.
+See the file itself for more information. This can only be
+the name of the file containing the list, it *cannot* be the
+filename of a ruleset.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
<p><b>Allow IFrame Tags</b></p></td>
</table>
<!-- INDENTATION -->
@@ -5122,6 +5331,28 @@
<p>Log all occurrences of "Silent Viruses" as
defined above? This can only be a simple yes/no value, not a
ruleset.</p>
+</td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="89%">
+<p><b>Log Dangerous HTML Tags</b></p></td>
+</table>
+<!-- INDENTATION -->
+<table width="100%" border=0 rules="none" frame="void"
+ cols="2" cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="22%"></td>
+<td width="78%">
+<p>Default: no<br>
+Log all occurrences of HTML tags found in messages, that can
+be blocked. This will help you build up your whitelist of
+message sources for which particular HTML tags should be
+allowed, such as mail from newsletters and daily cartoon
+strips. This can also be the filename of a ruleset.</p>
</td>
</table>
<a name="Advanced SpamAssassin Settings"></a>
|
