## Sagator SCANNER configuration example. ## (c) 2003-2004 Jan ONDREJ (SAL) ## This example is used to test sagator. ## It is too complex and not commented. Please see other examples ## for comments. # Define scanners SCANNERS=[ #remove_headers('Received'), # log_syslog('ip=$SENTBY_IP, name=$SENTBY_NAME, helo=$SENTBY_HELO, recip=$RECIPIENTS, sender=$SENDER', # log_mysql('127.0.0.1',3306,'sagator','root',None,log_mysql.FORMAT, #log_sqlite('/tmp/sagator.sqlite',log_sqlite.FORMAT, status("Virus", # report(['ondrejj@salstar.sk'],report.MSG_TMPL, # quarantine('/tmp/quarantine/%Y%m','', # drop('.', # ClamAV #alternatives( stream2mbox(libclam(limits={'maxratio':1000})), # parsemail(s2f(libclam())), # mimeparse(s2f(libclam())), #parsemail(stream2file(decompress(libclam()))), #clamd(['localhost',3310]), # clamd('/var/run/clamav/clamd.sock'), #stream2mbox(clamscan(['/usr/bin/clamscan','--stdout','--infected','--disable-summary','-r','--mbox'])), #), # Simple scanners #max_file_size(10), #parsemail(file_type({'exe': 'Executable'})), #string_scan(VIR_PATTERNS), #regexp_scan({'virname':['___PATTERN___']}), #mime_ext(mime_ext.EXECUTABLES), # AVG7 for linux #parsemail(s2f(avgd(chroot=CHROOT))), # parsemail(s2f(avgd())), # Bitdefender bdc # s2f(bdc(['/opt/bdc/bdc','--log=/tmp/bdc.log','--mail','--all','--arc'])), # NOD #parsemail(stream2file(decompress(nodold(['localhost',8448])))), #stream2mbox(nod2()), # stream2mbox(cmd_uvscan('/opt/uvscan/uvscan')), #nod2d('/tmp/dazuko/mb-','/var/log/nod32fac.log'), # Sophie #parsemail(s2f(decompress(sophie('/tmp/sophie',CHROOT)))), # exec any program #s2f(exec_any(['/bin/grep','-q','^TVqQ'],[1],[0])), # Kaspersky kav # stream2mbox(libclam()), # s2f(kavclient('/var/run/aveserver')), # s2f(kav()), # Symantec antivirus scan engine. # savse('localhost',1344), # parsemail(savse('localhost')) # ) # ) # ) ), status("Spam", # quarantine('/tmp/quarantine','', # drop('.', # drop all spams # dspam() #dspam_classify_spam() #dspam_classify_innocent() # SpamAssassin #alternatives( #(const(1.0)-max_file_size(200*1024)) & #modify_subject('[%V]', rename('SPAM:$LEVEL', # spamassassind(['localhost',783]), #)), # spamassassin(['/usr/bin/spamassassin','-e']) #), # bogofilter(['/usr/bin/bogofilter','-v']), #qsf(['/usr/bin/qsf','-r']), # ) # ) ) # filter(['/tmp/as/sanitizer.pl']) ]