Getting ClamAV working with Scalix ( Scalix Bug )

[WizmanG]

I have spent the past few days trying to get ClamAV integration working with scalix and have read the forums here several times trying to debug it. I finally got it working and I wanted to share what I have found with others. I am running a fresh install of CentOS 4.3

1. When I was creating my ALL-ROUTES.VIR file I cut and past the contents verbatim from the manual in the how-to section. It didn't work so I would recommend hand coding it in. Maybe the Scalix team can just include a template file with the install in the future....

2. I had to make sure that the clamav user's primary group was the scalix group.

3. This is where I think there is a bug so beware. (maybe someone else can verify this)
If I put VIRUS-FOUND=0 ACTION=ALLOW as the first rule in the file it will ALWAYS ALLOW the mail to be delivered, virus and all. If it is moved to some other place in the file it works correctly.

Here is my ALL-ROUTES.VIR for reference, it works perfectly now.

VIRUS-UNCLEANED=1 ACTION=DISCARD
VIRUS-FOUND=1 VIRUS-UNCLEANED=0 ACTION=ALLOW NOTIFY="A virus was found in your message. It was successfully cleaned and sent to the recipient. However we highly recommend that you install or update your virus protection software and scan your computer for viruses."
VIRUS-FOUND=0 ACTION=ALLOW

[dkelly]

Is there a reason why you need VIRUS_FOUND=0 ACTION=ALLOW at all ?

Cheers

Dave

[WizmanG]

No.
I got it by scanning the forums here while I was trying to get mine working and happened to find this bug. I wanted to post it so anyone else reading here might benefit from the information.

[dkelly]

I think I've already responded to your general feedback on configuration but I will respond to these individual points.

1. Point taken. We can get this one cleared up.
2. This is documented in section 5.2 of the ClamAV HowTo in the knowledgebase.
3. This isn't documented in any of our HowTos that I know of. You do not need to have this setting as it's implicit, i.e. if no virus is found, the message is allowed.

Cheers

Dave