Recent content by hitd

That's not easy. Most important problem is way back in case of false positive. Current version of script stores email within memory in most cases, except a long email ( i.e. appended file ) or sophos, because handling by sophos is check by file. clamav and drweb are able to check files as...

of course there are some perl modules to be installed. Log::Any is perl-Log-Any-0.15-3.el7.noarch.rpm in epel repository for centos 7 debian 10 root@puck983:/usr/local/bin# apt list --installed | grep -i log-any WARNING: apt does not have a stable CLI interface. Use with caution in scripts...

Sorry, i'm unable to reproduce, because sendmail not installed. first: can you post the test-mail with all headers second: i've appended hitd-mailq-check thats intended to check length of mailqueue every about 5-10 min from cron. Both scripts are located usualy in /usr/local/bin However you...

Can you post the part of maillog for this and result of "plesk sbin mail_handlers_control --list | grep -i virus"

Thank you! I will try next days and give a small report.

please do some tests and give a short report. However, if your question from beginning ( how to remove a appended file ) isn't obsolate, take a look at renattach. It is available for ubuntu as renattach 1.2.4-5 (amd64 binary) in ubuntu bionic. renattach is able to delete a attachment. you can...

root@puck983:/usr/local/sbin# systemctl status drwebd ● drwebd.service - Plesk Premium Antivirus Loaded: loaded (/lib/systemd/system/drwebd.service; enabled; vendor preset: enabled) Drop-In: /usr/lib/systemd/system/drwebd.service.d └─respawn.conf Active: active (running) since...

And on the other way: you started with clamav if clamav daemon runs fine, change # PATH must be fixed because perl -T flag, using an usual path throws security exception my $drweb_bin='/usr/bin/drwebdc'; # if empty: do not use DrWeb version 6 ( part of plesk as plesk antivirus ) my...

Thats OK, no panic If you buy a full license of plesk antivir you get drweb32.key This is startup here: Mär 07 07:36:32 puck983 drwebd[1593]: Dr.Web (R) daemon for Linux/Plesk Edition v6.0.2.1 Mär 07 07:36:32 puck983 drwebd[1593]: Copyright (c) Igor Daniloff, 1992-2022 Mär 07 07:36:32...

take a simple mail from mailDir and pipe trough the mailhandler. Increase debug from level 1, wich is default to maybe 4. If you want silently discard simply change following: print STDERR "LOG HITDVIRUS drweb result: REJECT VIRUS $virus_name\n"; print STDERR "REJECT VIRUS...

Maybe Dr.Web internal try 1|root@puck983:~# cat eicar_com.zip | drwebdc -orv - Results: daemon return code 0x20 (known virus is found) ----- Dr.Web found viruses list begin ----- Known virus(es): EICAR Test File (NOT a Virus!) ----- Dr.Web found viruses list end ----- 1|root@puck983:~# to...

root@puck983:/var/spool# ls -l insgesamt 20 drwxr-xr-x 3 root root 4096 Mär 20 2021 cron drwxrwx--- 4 drweb popuser 4096 Mär 20 2021 drweb drwxrwx--- 12 postfix popuser 4096 Mär 16 15:47 hitd-virus-handler lrwxrwxrwx 1 root root 7 Mär 20 2021 mail -> ../mail drwxr-xr-x 22...

tried the commands you wrote root@puck983:/home/p_heirich/hitd_virus_handler/bin# plesk sbin mail_handlers_control --add --priority=45 --name=virushandler --queue=before-queue --type=global --executable=/usr/local/sbin/hitd-virus-handler root@puck983:/home/p_heirich/hitd_virus_handler/bin#...

i think no plesk docu says: # ./mail_handlers_control --add --priority=<number> --name=<handler name> --mailname=<mailname> --queue=<before-local|before-remote|before-queue|before-data>...

Edit: if drweb_bin is empty ( i.e. my $drweb_bin=''; ) drweb 6 ( part of plesk ( current, independend drweb is version 11 ) ) is not used.