<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Le 28/04/2020 à 19:46, Andreas Metzler a écrit :<br>
<blockquote type="cite"
cite="mid:20200428174617.GA1475@argenau.bebt.de">
<pre class="moz-quote-pre" wrap="">On 2020-04-28 brunoc68 <a class="moz-txt-link-rfc2396E" href="mailto:bugs01@abcreseau.com"><bugs01@abcreseau.com></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Package: exim4-daemon-heavy
Version: 4.92-8+deb10u3
Severity: normal
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Dear Maintainer,
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> * What led up to the situation?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Installation of exim4-daemon-heavy with av_scanner = clamd
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> * What exactly did you do (or not do) that was effective (or
ineffective)?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">1. include EICAR virus signature in .txt or .zip attachment
2. include EICAR virus signature in message body
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> * What was the outcome of this action?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">1. mail refused at ACL time
2. mail accepted : message found as clean in clamd log
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap=""> * What outcome did you expect instead?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">1. outcome ok
2. mail refused at ACL time
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Hello,
You will also need to run the av scanner in the DATA acl.
cu Andreas
</pre>
</blockquote>
Dear Andreas, that was done :<br>
<br>
<font face="Courier New, Courier, monospace"> vi
acl/40_exim4-config_check_data :<br>
...<br>
deny<br>
message = This message was detected as possible malware
($malware_name).<br>
malware = *<br>
...<br>
</font><br>
Actually the virus filtering works, but only with the attachments.
The issue is the body of the email that goes through with the eicar
signature ; so I expect any html virus in the body can go through...<br>
<br>
</body>
</html>