Topic: Block virussenders with clamav and guardian.

[Appesteijn]

Hi,

I'm using clamav 0.80 on my e-smith 5.6U6. I've used the  install script of sme.swerts-knudsen.dk
Now I was wondering where the script (that sends the admin a e-mail that a virus was intercepted) is located.

I'm also using Guardian/Snort and I would like to block the virus-senders ip for a certain period of time. I could then add 'guardian_block ip_of_sender eth1' to the script. Anybody who knows this?

[funkusmunkus]

check raymitchell's howto on that.
here it is http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/Spam%20blocking%20HOWTO%20using%20smtpfront-qmail%20for%20sme%20server.htm


hope that helps
cheers

[Appesteijn]

Hi,

thanks but that wasn't what I was looking for. I'm already using SpamAssassin with some RBL.
I want to know where the script is located that sends the admin an e-mail when a virus is found. I would then try if it's possible to filter out the ip-adres of the virussender and block this sender in my firewall (for a week or so).  So, in a sense, create my own blacklist. Not that I really need it, but more to figure out if it should work.

[raem]

Again not the answer you were wanting, but this HOWTO will permanently block approx 90 - 99% of all virus infected email messages.

http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/Virus%20and%20file%20blocking%20HOWTO%20using%20smtpfront-qmail%20for%20sme%20server.htm