1 Topic by sergiocesar (edited by sergiocesar 2020-06-04 21:37:23)

  • sergiocesar
  • Member
  • Offline
  • Registered: 2014-04-28
  • Posts: 94

Topic: Virus filter disabled??

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
iRedMail version (check /etc/iredmail-release): 1.2.1
- Deployed with iRedMail Easy or the downloadable installer? installer
- Linux/BSD distribution name and version: centos 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Web server (Apache or Nginx): nginx
- Manage mail accounts with iRedAdmin-Pro? yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Long time in operation but yet not a single virus has been sent to quarantine.
I cant believe with over 500 users not a single one came to the system.
Yes the box is checked to quarantine viruses.

How do I check and make sure it is working?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by MuPp3t33r (edited by MuPp3t33r 2020-06-04 22:17:31)

  • MuPp3t33r
  • Member
  • Offline
  • Registered: 2017-01-17
  • Posts: 149

Re: Virus filter disabled??

tail the mail log and then send a test virus to see what happens to the message.
You don't have to use an actual malicious virus, you can use the EICAR test virus for this

Just put the below text into a message and send it to yourself

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

You should expect to see something similar to this:

Jun  4 16:12:06 mail01 amavis[22207]: (22207-02) Blocked INFECTED (Eicar-Signature) {DiscardedInternal,Quarantined}, ORIGINATING/MYNETS LOCAL [127.0.0.1]:54010 ESMTP/ESMTP <******@*****> -> <******@*****>, (), quarantine: jfTwOTapcljG, Queue-ID: 49d7506bSLzBrK2, Message-ID: <469294fc30f6fa667843a73a2c016d7b@*********>, mail_id: jfTwOTapcljG, b: aWMORXTsZ, Hits: -, size: 657, Subject: "test", From: <****@***********>, User-Agent: Roundcube_Webmail, helo=localhost, 1562 ms

If you see that then for sure it's working

3 Reply by sergiocesar

  • sergiocesar
  • Member
  • Offline
  • Registered: 2014-04-28
  • Posts: 94

Re: Virus filter disabled??

Thank you.
I must be lucky... it did not pass... I feel better now..
I look at the logs as far back as a month and not a single one. smile

cheers