Unable to whitelist clamav signature

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
User avatar
maxxer
Advanced member
Advanced member
Posts: 182
Joined: Fri Oct 04, 2013 2:12 am
Contact:

Unable to whitelist clamav signature

Postby maxxer » Thu Jan 16, 2020 9:17 pm

Hi.
I've added Malwarebytes unofficial signature list to my Zimbra ClamAV. It has some over restrictive rules, like MBL_50076603 which blocks all mails containing a link to Google Drive. So I want to whitelist some of them, like this. The zimbra email notification looks like this:

Code: Select all

A virus was found: MBL_50076603.UNOFFICIAL

Scanner detecting a virus: ClamAV-clamd

Content type: Virus
Internal reference code for the message is 29024-01/7bEOL-_atZZE

So I created /opt/zimbra/data/clamav/db/whitelist.ign2 and added

Code: Select all

MBL_50076603.UNOFFICIAL

in it. Restarted zmclamdctl but unfortunately didn't work, GDrive links still blocked. So I did search and found several articles. Despite official clamv website (and other articles) indicating whitelist.ign2 as designated file name, others here on the forum use local.ign2. So I renamed the file, restarted clamd but gdrive links are still blocked!

As I'm now out of resources, any suggestion is welcome. Thanks


User avatar
maxxer
Advanced member
Advanced member
Posts: 182
Joined: Fri Oct 04, 2013 2:12 am
Contact:

Re: Unable to whitelist clamav signature

Postby maxxer » Fri Jan 17, 2020 8:11 am

Finally solved. The file name appears to be irrelevant, as long as the extension is ign2.

The problem is the rule name: it must be indicated without the .UNOFFICIAL extension (or any other. In some posts I found you need to add .{}).

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 16 guests