NS8 Clamav found virus, rejected

NethServer Version: NS8
Module: rspamd, fetchmail

Hello,

I’m setting up a new installation of Nethserver 8. Its main purpose is to serve as a local mail server (I was previously using NS7). To retrieve emails from the external provider, I’m using the fetchmail module and have configured it according to the instructions from mrmarkuz. Everything is working fine. Now I’ve received an email containing a virus; fetchmail retrieves this email every 5 minutes (according to the cron schedule) and rejects it. How can I break this endless loop? The message needs to be marked as seen… or something else?

….
fetchmail: SMTP< 250-PIPELINING
fetchmail: SMTP< 250-SIZE 100000000
fetchmail: SMTP< 250-VRFY
fetchmail: SMTP< 250-ETRN
fetchmail: SMTP< 250-STARTTLS
fetchmail: SMTP< 250-ENHANCEDSTATUSCODES
fetchmail: SMTP< 250-8BITMIME
fetchmail: SMTP< 250-DSN
fetchmail: SMTP< 250 CHUNKING
fetchmail: SMTP> MAIL FROM:xxxx BODY=8BITMIME SIZE=459376
fetchmail: SMTP< 250 2.1.0 Ok
fetchmail: SMTP> RCPT TO:xxxx
fetchmail: SMTP< 250 2.1.5 Ok
fetchmail: SMTP> DATA
fetchmail: SMTP< 354 End data with .
fetchmail: SMTP>. (EOM)
fetchmail: SMTP< 554 5.7.1 clamav: virus found: “Sanesecurity.Malware.29176.LZHHeur.Com.UNOFFICIAL”
fetchmail: SMTP> RSET
fetchmail: SMTP< 250 2.0.0 Ok
not flushed
fetchmail: POP3> QUIT
fetchmail: POP3< +OK Logging out.
fetchmail: SMTP> QUIT
fetchmail: SMTP< 221 2.0.0 Bye

I assume fetchmail is configured using the “keep” option to keep mails on the server of the external provider.
You could mark the mail as seen or delete it from the external provider server by using a web(mail) client.

Sorry, fetchmail ist configured without “keep” option…

poll <ext_provider> proto pop3 uidl auth password port 995 timeout 60 interval 5 user “xxxx” password “yyyy” ssl is <Mail_address> here smtphost <Neth_IP>

But can I get a notification if a virus is detected? It would be great if that could be automated…

Is there a way (perhaps in the rspamd module) to remove the attachment or mark the email instead of rejecting it?

I think the best option is to “set no softbounce” in the fetchmailrc file, see Fetchmail Manual

This way undeliverable mail should be deleted.

From Fetchmail Manual :

set no softbounce
Delete permanently undeliverable mail. It is recommended to use this option if the configuration has been thoroughly tested.

–nosoftbounce
(since v6.3.10, Keyword: set no softbounce, since v6.3.10)
Hard bounce mode. All permanent delivery errors cause messages to be deleted from the upstream server, see “no softbounce” below.

OK, I have set the “set no softbounce” option. Now the message is deleted and the loop has stopped.
But I don’t receive any notification or email telling me what happened… That’s still missing for me.

Thanks anyway for the help. This blog provides quick and helpful support, which I really appreciate. That’s why I recommend NethServer to others :wink:

fetchmail: SMTP< 554 5.7.1 clamav: virus found: “Sanesecurity.Malware.29176.LZHHeur.Com.UNOFFICIAL”
fetchmail: SMTP> RSET
fetchmail: SMTP< 250 2.0.0 Ok
flushed
fetchmail: POP3> DELE 1
fetchmail: POP3< +OK Marked to be deleted.
fetchmail: POP3> QUIT
fetchmail: POP3< +OK Logging out, messages deleted.
fetchmail: SMTP> QUIT
fetchmail: SMTP< 221 2.0.0 Bye

1 Like

I guess the Rspamd metadata exporter could do the job but I couldn’t make it work yet…