cyr_virusscan(8)

1CYR_VIRUSSCAN(8)                  Cyrus IMAP                  CYR_VIRUSSCAN(8)
2
3
4

NAME

6       cyr_virusscan - Cyrus IMAP documentation
7
8       Scan for viruses using configured virus scanner or manage infected mes‐
9       sages using search criteria.
10

SYNOPSIS

12       cyr_virusscan [ -C config-file ] [ -s imap-search-string ] [ -r [ -n] ] [-v] [ mboxpattern1 ... ]
13

DESCRIPTION

15       cyr_virusscan can be used to invoke an  external  virus  scanner  (cur‐
16       rently  only  ClamAV is supported) to scan specified IMAP mailboxes. If
17       no mboxpattern is given, cyr_virusscan works on all mailboxes.
18
19       Alternately, with the -s option, the IMAP SEARCH string will be used as
20       a  specification of messages which are assumed to be infected, and will
21       be treated as such.  The virus scanner is not invoked. Useful  for  re‐
22       moving messages without a distinct signature, such as Phish.
23
24       A table of infected messages will be output.
25
26       To remove infected messages, use the -r flag. Infected messages will be
27       expunged from the user's mailbox.
28
29       With the notify flag, -n, notifications will be appended to  the  inbox
30       of the mailbox owner, containing message digest information for the af‐
31       fected mail.  This flag only works in combination with -r.  The notifi‐
32       cation   message  can  by  customised  by  template,  for  details  see
33       Notifications below.
34
35       cyr_virusscan can be configured to  run  periodically  by  cron(8)  via
36       crontab(5) or your preferred method (i.e. /etc/cron.hourly), or by mas‐
37       ter(8) via the EVENTS{} section in cyrus.conf(5).
38
39       cyr_virusscan reads its configuration options out of the  imapd.conf(5)
40       file unless specified otherwise by -C.
41
42       Note  that Cyrus does not ship with any virus scanners: you need to in‐
43       stall one separately to make use of it with Cyrus.
44

OPTIONS

46       -C config-file
47              Use the specified configuration file config-file rather than the
48              default imapd.conf(5).
49
50       -n     Notify  mailbox  owner of deleted messages via email.  This flag
51              is only operable in combination with -r.
52
53       -r     Remove infected messages.
54
55       -s imap-search-string
56              Rather than scanning for viruses, messages matching  the  search
57              criteria will be treated as infected.
58
59       -v     Produce more verbose output
60

NOTIFICATIONS

62       When  the -n flag is provided, notifications are sent to mailbox owners
63       when infected messages are  removed.   One  notification  is  sent  per
64       owner, containing a digest of each message that was deleted from any of
65       their mailboxes.
66
67       The default notification subject is "Automatically deleted mail", which
68       can   be   overridden   by  setting  virusscan_notification_subject  in
69       imapd.conf(5) to a UTF-8 value.
70
71       Each infected message will be described according to the following tem‐
72       plate:
73
74       The following message was deleted from mailbox '%MAILBOX%'
75       because it was infected with virus '%VIRUS%'
76
77           Message-ID: %MSG_ID%
78           Date: %MSG_DATE%
79           From: %MSG_FROM%
80           Subject: %MSG_SUBJECT%
81           IMAP UID: %MSG_UID%
82
83       To  use  a custom template, create a UTF-8 file containing your desired
84       text and using the same %-delimited substitutions as above, and set the
85       virusscan_notification_template option in imapd.conf(5) to its path.
86
87       The  notification message will be properly MIME-encoded at delivery. Do
88       not pre-encode the template file or the subject!
89
90       When cyr_virusscan starts up,  if  notifications  have  been  requested
91       (with  the  -n flag), a basic sanity check of the template will be per‐
92       formed prior to initialising the antivirus engine.  If it appears  that
93       the  resultant  notifications  would  be undeliverable for some reason,
94       cyr_virusscan will exit immediately with an  error,  rather  than  risk
95       deleting messages without notifying.
96

EXAMPLES

98       cyr_virusscan
99          Scan  all  mailboxes,  printing report on the screen.  Do not remove
100          infected messages.
101
102       cyr_virusscan -r -n user/bovik
103          Scan mailbox user/bovik, removing infected messages and append noti‐
104          fications to Bovik's inbox.
105
106       cyr_virusscan -r -n -s 'SUBJECT "Fedex"' user/bovik
107          Search  mailbox user/bovik for messages which have Fedex in the sub‐
108          ject line, removing them all, and appending notifications to Bovik's
109          inbox.
110

HISTORY

112       Virus scan support was first introduced in Cyrus version 3.0.
113

FILES

115       /etc/imapd.conf
116

AUTHOR

121       The Cyrus Team, Nic Bernstein (Onlight)
122

COPYRIGHT

124       1993-2018, The Cyrus Team
125
126
127
128
1293.2.6                           March 09, 2021                CYR_VIRUSSCAN(8)