To Jettison Virus– or Trojan Horse– Infected Email Using ClamAV

The following example jettisons all messages found to contain a virus or Trojan horse detected by ClamAV. The verdict string is not used.

1. Create the ClamAV configuration file.

   The name and location of this file is specified in Step 2. A good name is clamav.opt. This file contains the following lines:

   # more /opt/SUNWmsgsr/config/clamav.opt ! ClamAV Settings debug=1 host=127.0.0.1 port=3310 mode=1

   debug=1 turns on debugging in the ClamAV library.

   host and port specify the name of the system where clamd is running and the port on which clamd listens for incoming requests.

   mode=1 specifies that the ClamAV plug-in return the ClamAV result string as the verdict when a virus infected email is detected.

2. Modify the option.dat file.

   Add the following lines to the option.dat file:

   ! ClamAV settings spamfilter2_config_file=/opt/SUNWmsgsr/config/clamav.opt spamfilter2_library=/opt/SUNWmsgsr/lib/libclamav.so spamfilter2_string_action=data:,require ["jettison"]; jettison;

   spamfilter2_config_file specifies the ClamAV configuration file.

   spamfilter2_library specifies the ClamAV shared library.

   spamfilter2_string_action specifies the Sieve action to take for a virus infected email.

3. Specify the messages to be filtered.

   To filter all messages coming into the local message store, change the imta.cnf file by adding the destinationspamfilterXoptin virus keywords on the ims-ms channel:

   ! ! ims-ms ims-ms defragment subdirs 20 notices 1 7 14 21 28 backoff "pt5m" "pt10m" "pt30m" "pt1h" "pt2h" "pt4h" maxjobs 4 pool IMS_POOL fileinto $U+$S@$D destinationspamfilter2optin virus ims-ms-daemon

4. Recompile the configuration and restart the server.

   Only the MTA needs to be restarted. You do not need to execute stop-msg.

   # imsimta cnbuild # imsimta restart

5. Start the clamd daemon.