#import psyco #psyco.log() #psyco.profile() #psyco.full() # Debugging level, 0=errors only, 1=return status, init messages, # 2=smtp server communication, 3=detailed smtp server communication, # 4=tracebacks, 5=smtp client communication # Do not use debug level higher than 9! DEBUG_LEVEL=4 LANG=['sk_SK'] LOCALE_DIR='/tmp/sagator/usr/local/share/locale' # Where is new root path. For example '/var/spool/vscan' CHROOT='/var/spool/vscan' #CHROOT='/' # Logfile (use logfile in chroot to allow rotating) LOGFILE=CHROOT+'/var/log/sagator/sagator.log' # User and group, under which this program runs. USER,GROUP='vscan','vscan' # SMTP server host and port. You must define this smtp server # in postfix without filtering. SMTP_SERVER=('127.0.0.1', 26) # Scanners and services from scanners import * from srv import * from avlib import ascanner,mail,is_infected import re DB_ENGINE=db.MySQLdb(host='127.0.0.1',port=3306,dbname='sagator', dbuser='sagator',dbpasswd='sagator') #DB_ENGINE = db.sqlite(dbname='/var/lib/sagator/sqlitedb') #DB_ENGINE=db.sqlite() #DB_TXT='/var/lib/sagator/antivir.conf' CLAMAV=libclam( #options=libclam.CL_SCAN_STDOPT|libclam.CL_SCAN_BLOCKENCRYPTED, #limits={'maxratio':250}, #db_options=libclam.CL_DB_PHISHING, datadir='/var/lib/clamav', #datadir='/tmp/clamav', #solib='/home/ondrejj/c/CVS/clamav/clamav-devel/libclamav/.libs/libclamav.so.6' ) class ssleep(ascanner): def scanbuffer(self,buffer,args={}): debug.echo(0, "SLEEPING...") time.sleep(300) return 0.0, '', [] class spamassassind2(spamassassind): socket_timeout = 5 class bf_and_sa(match_all): name="bf_and_sa()" def __init__(self, bf, sa): self.scanners = [bf, sa] def scanbuffer(self, buffer, args={}): self.scanners[0].scanbuffer(buffer, args) xbuffer = 'X-Bogosity: %s\r\n%s' % ( mail.xhdra.get('X-Bogosity'), buffer) return self.scanners[1].scanbuffer(xbuffer, args) # Define scanners SCANNERS=[ #spf_check(), #remove_headers('Received'), #add_header('X-Loop', 'bonehead', const(0.0, 'XXX')), #log_syslog('ip=$SENTBY_IP, name=$SENTBY_NAME, helo=$SENTBY_HELO, recip=$RECIPIENTS, sender=$SENDER', log_sql(DB_ENGINE, log_sql.FORMAT, #log(1,log.SUMMARY_REPORT, status("Virus", # report(['$SENDER'],report.MSG_TMPL, # custom_action('.', 556, # 'E-mail (%(QNAME)s) rejected due spam or virus content', quarantine('/tmp/quarantine/%Y%m','', # drop('.', #s2f(cmd_fprot()), #max_file_size(1500) & # ((const(1.0)-max_file_size(200*1024))) & # const(1.0,'TESTRUS'), # ClamAV #alternatives( #nod2pac(logfile='/var/log/esets/daemon.log'), # check_level( #cache('test', b2f(CLAMAV), #const(1.0, "CONST"), #add_listed(DB_ENGINE,'GA',-1,'greylist',b2f(CLAMAV)), #rcpt_in_sql(DB_ENGINE,'ClamAV') & #(const(1.0)-smtp_comm([['X', '^XFORWARD .* ADDR=127']],re.I|re.M)) & #time_limit(0.3,parsemail(b2f(CLAMAV))), #mimeparse(b2f(CLAMAV)), #parsemail(buffer2file(decompress(CLAMAV))), ##parsemail(b2f(CLAMAV)), #buffer2file(decompress(CLAMAV)), #clamd(['localhost',3310]), #clamd('/var/run/clamav/clamd.sock'), #buffer2mbox(clamscan(['/usr/bin/clamscan','--stdout','--infected','--disable-summary','-r','--mbox'])), #), # Simple scanners #max_file_size(10), #parsemail(file_type({'exe': 'Executable'})), #string_scan(VIR_PATTERNS), #regexp_scan({'virname':['___PATTERN___']}), #mime_ext(mime_ext.EXECUTABLES), # AVG7 for linux #parsemail(b2f(avgd(chroot=CHROOT))), #b2f(avgd(chroot=CHROOT)), #parsemail(b2f(avgd())), # Bitdefender bdc #b2f(bdc(['/opt/bdc/bdc','--log=/tmp/bdc.log','--mail','--all','--arc'])), #b2f(cmd_bdc('/opt/bdc/bdc')), # NOD #scanc(), #buffer2mbox(nod2()), #buffer2mbox(cmd_uvscan('/opt/uvscan/uvscan')), #nod2d('/tmp/dazuko/mb-','/var/log/nod32fac.log'), # Sophie #parsemail(b2f(decompress(sophie('/tmp/sophie',CHROOT)))), # exec any program #b2f(exec_any(['/bin/grep','-q','^TVqQ'],[1],[0])), # Kaspersky kav #buffer2mbox(CLAMAV), #b2f(kavclient('/var/run/aveserver')), #b2f(kav()), # Symantec antivirus scan engine. #savse('localhost',1344), #parsemail(savse('localhost')) # ) ) # ) # ) ), status("Spam", quarantine('/tmp/quarantine','', #check_level( # spamassassind(['127.0.0.1', 783],filter=True,sa_user=USER), # { # (0.0, 1.0): deliver(check_level()), # (1.0, 2.0): deliver( # modify_subject('[SPAM:%L]', # check_level() # ) # ), # (2.0, 99999.0): drop('.', check_level()) # } #), #ssleep(), #drop('.', # drop all spams #dspam('/tmp/dspam'), #dspam() #dspam_classify_spam() #dspam_classify_innocent() # SpamAssassin #alternatives( #(const(1.0)-max_file_size(200*1024)) & #modify_subject('[%V]', rename('SPAM:$LEVEL', #rcpt_in_sql(DB_ENGINE,'AntiSpam') & # spamassassind(['localhost',783], # sa_user=['vscan%d' % i for i in range(1, core_count()+1)] # ), #)), #), #bogofilter(['/usr/bin/bogofilter','-v']), #qsf(['/usr/bin/qsf','-r']), #) ) ) ), #rcpt_no_match('AntiVir') & # buffer2file(CLAMAV), # filter(['/tmp/as/sanitizer.pl']) # forward special emails # forward special emails #deliver_to(['ondrejj@home.salstar.sk'], # smtp_comm({'CRCZ':['MAIL FROM:.*test@tester.salxstar.sk']}) #).onlyif('CRCZ')&const(0.0), #restore('firstpass') ] #try: # SCANNERS=[ # drop('.', # smtp_comm({'SPAM':['^RCPT TO: