cyr_virusscan(8)

1CYR_VIRUSSCAN(8)                  Cyrus IMAP                  CYR_VIRUSSCAN(8)
2
3
4

NAME

6       cyr_virusscan - Cyrus IMAP documentation
7
8       Scan for viruses using configured virus scanner or manage infected mes‐
9       sages using search criteria.
10

SYNOPSIS

12          cyr_virusscan [ -C config-file ] [ -s imap-search-string ] [ -r [ -n] ] [-v] [ mboxpattern1 ... ]
13

DESCRIPTION

15       cyr_virusscan can be used to invoke an  external  virus  scanner  (cur‐
16       rently  only  ClamAV is supported) to scan specified IMAP mailboxes. If
17       no mboxpattern is given, cyr_virusscan works on all mailboxes.
18
19       Alternately, with the -s option, the IMAP SEARCH string will be used as
20       a  specification of messages which are assumed to be infected, and will
21       be treated as such.  The virus scanner is not invoked. Useful  for  re‐
22       moving messages without a distinct signature, such as Phish.
23
24       A table of infected messages will be output.
25
26       To remove infected messages, use the -r flag. Infected messages will be
27       expunged from the user's mailbox.
28
29       With the notify flag, -n, notifications will be appended to  the  inbox
30       of the mailbox owner, containing message digest information for the af‐
31       fected mail.  This flag only works in combination with -r.  The notifi‐
32       cation   message  can  by  customised  by  template,  for  details  see
33       Notifications below.
34
35       cyr_virusscan can be configured to  run  periodically  by  cron(8)  via
36       crontab(5) or your preferred method (i.e. /etc/cron.hourly), or by mas‐
37       ter(8) via the EVENTS{} section in cyrus.conf(5).
38
39       cyr_virusscan reads its configuration options out of the  imapd.conf(5)
40       file unless specified otherwise by -C.
41
42       Note  that Cyrus does not ship with any virus scanners: you need to in‐
43       stall one separately to make use of it with Cyrus.
44

OPTIONS

46       -C config-file
47              Use the specified configuration file config-file rather than the
48              default imapd.conf(5).
49
50       -n, --notify
51              Notify  mailbox  owner of deleted messages via email.  This flag
52              is only operable in combination with -r.
53
54       -r, --remove-infected
55              Remove infected messages.
56
57       -s imap-search-string, --search=imap-search-string
58              Rather than scanning for viruses, messages matching  the  search
59              criteria will be treated as infected.
60
61       -v, --verbose
62              Produce more verbose output
63

NOTIFICATIONS

65       When  the -n flag is provided, notifications are sent to mailbox owners
66       when infected messages are  removed.   One  notification  is  sent  per
67       owner, containing a digest of each message that was deleted from any of
68       their mailboxes.
69
70       The default notification subject is "Automatically deleted mail", which
71       can   be   overridden   by  setting  virusscan_notification_subject  in
72       imapd.conf(5) to a UTF-8 value.
73
74       Each infected message will be described according to the following tem‐
75       plate:
76
77          The following message was deleted from mailbox '%MAILBOX%'
78          because it was infected with virus '%VIRUS%'
79
80              Message-ID: %MSG_ID%
81              Date: %MSG_DATE%
82              From: %MSG_FROM%
83              Subject: %MSG_SUBJECT%
84              IMAP UID: %MSG_UID%
85
86       To  use  a custom template, create a UTF-8 file containing your desired
87       text and using the same %-delimited substitutions as above, and set the
88       virusscan_notification_template option in imapd.conf(5) to its path.
89
90       The  notification message will be properly MIME-encoded at delivery. Do
91       not pre-encode the template file or the subject!
92
93       When cyr_virusscan starts up,  if  notifications  have  been  requested
94       (with  the  -n flag), a basic sanity check of the template will be per‐
95       formed prior to initialising the antivirus engine.  If it appears  that
96       the  resultant  notifications  would  be undeliverable for some reason,
97       cyr_virusscan will exit immediately with an  error,  rather  than  risk
98       deleting messages without notifying.
99

EXAMPLES

101          cyr_virusscan
102          Scan  all  mailboxes,  printing report on the screen.  Do not remove
103          infected messages.
104
105          cyr_virusscan -r -n user/bovik
106          Scan mailbox user/bovik, removing infected messages and append noti‐
107          fications to Bovik's inbox.
108
109          cyr_virusscan -r -n -s 'SUBJECT "Fedex"' user/bovik
110          Search  mailbox user/bovik for messages which have Fedex in the sub‐
111          ject line, removing them all, and appending notifications to Bovik's
112          inbox.
113

HISTORY

115       Virus scan support was first introduced in Cyrus version 3.0.
116

FILES

118       /etc/imapd.conf
119

AUTHOR

124       The Cyrus Team, Nic Bernstein (Onlight)
125

COPYRIGHT

127       1993–2023, The Cyrus Team
128
129
130
131
1323.8.1                            Sep 11, 2023                 CYR_VIRUSSCAN(8)