Mailing List Archive

[clamav-users] clamav-milter and "whitelist"
clamav-milter 0.102.1
FreeBSD 11.3-p5

Either I am not understanding how the "WHITELIST" works with
clamav-milter, or it is not working as I thought it would.

# This option specifies a file which contains a list of basic POSIX regular
# expressions. Addresses (sent to or from - see below) matching these regexes
# will not be scanned. Optionally each line can start with the string "From:"
# or "To:" (note: no whitespace after the colon) indicating if it is,
# respectively, the sender or recipient that is to be whitelisted.
# If the field is missing, "To:" is assumed.
# Lines starting with #, : or ! are ignored.
#
# Default unset (no exclusion applied)
Whitelist /usr/local/etc/whitelisted_addresses.txt

I have this line in that file:

From:marketing@snopes.com

However, that file is being blocked with this message in the
clamav-milter.log file:

Fri Dec 20 20:12:00 2019 -> Message from <snopescom-cdyjlit1jrhddlljg1j@cmail20.com> to <<gerard_seibert@seibercom.net>> infected by SecuriteInfo.com.Spam-50327.UNOFFICIAL

These are the two pertinent headers from that message:

Return-Path: <Snopescom-cdyjyn1jrhddlljg1j@cmail20.com>
From: "Snopes.com" <marketing@snopes.com>

I figure I am either entering the info in the file incorrectly, or I am
entering the wrong info. I cannot reliably use the "Return-Path:",
because it is not a constant.

I would appreciate it if someone could explain to me what I am dong wrong.

Thanks!

--
Jerry
Re: [clamav-users] clamav-milter and "whitelist" [ In reply to ]
On Sun 22/Dec/2019 12:26:04 +0100 Gerard E. Seibert via clamav-users wrote:
> I have this line in that file:
>
> From:marketing@snopes.com
>
> However, that file is being blocked with this message in the
> clamav-milter.log file:
>
> Fri Dec 20 20:12:00 2019 -> Message from <snopescom-cdyjlit1jrhddlljg1j@cmail20.com> to <<gerard_seibert@seibercom.net>> infected by SecuriteInfo.com.Spam-50327.UNOFFICIAL


Obviously, that's the from they mean.


> I figure I am either entering the info in the file incorrectly, or I am
> entering the wrong info. I cannot reliably use the "Return-Path:",
> because it is not a constant.


Perhaps you could try and match From:snopescom-.*@cmail20.com?

I don't use the milter, but if I were I'd look for an option to whitelist only
'Spam' or 'Heuristic' from authenticated reliable senders. To whitelist
everything after a fuzzy regex that anybody can impersonate looks quite dangerous.


Best
Ale
--











_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] clamav-milter and "whitelist" [ In reply to ]
On Mon, 23 Dec 2019 08:04:13 +0100, Alessandro Vesely via clamav-users
stated:
>Perhaps you could try and match From:snopescom-.*@cmail20.com?

Actually, it is the "@cmail20.com" part changes also.

<Snopescom-cdrdrik1jrhddlljg1j@cmail19.com>

--
Jerry

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] clamav-milter and "whitelist" [ In reply to ]
Gerard E. Seibert via clamav-users wrote:
> On Mon, 23 Dec 2019 08:04:13 +0100, Alessandro Vesely via clamav-users
> stated:
>> Perhaps you could try and match From:snopescom-.*@cmail20.com?
>
> Actually, it is the "@cmail20.com" part changes also.
>
> <Snopescom-cdrdrik1jrhddlljg1j@cmail19.com>

I've also got cmail1 and cmail2 in my ham collection, and I expect the
rest of the range gets used in various mail flows as well.

I really wish ESPs wouldn't do this, it makes it even more difficult to
properly whitelist senders using their services.

-kgd

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml