1

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders are cleaned often, and the users may clean it also.

I tried adding wildcards into /usr/local/maldetect/ignore_paths as follows but they are not ignored:

/home/*/homes/*/Maildir
/home/?/homes/?/Maildir

Does anyone know how to exclude folders using wildcards, as it would not be practical to add the full path of every users mail directory.

Thanks

1 Answer 1

2

I have found only

/usr/local/maldetect/ignore_inotify
A line spaced file for regexp paths that are excluded from inotify monitoring
Sample ignore entry:
^/home/user$
^/var/tmp/#sql_.*\.MYD$

http://www.rfxn.com/appdocs/README.maldetect

If you monitor files with inotify(flag -m) then it can help you.

Based on this code of maldet:

 if [ "$days" == "all" ]; then
  if [ -z "$setmodsec" ]; then
          eout "{scan} building file list for $spath, this might take awhile..." 1
  fi
  $find $spath $tmpdir_paths -maxdepth $maxdepth -type f -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
 else
  if [ -z "$setmodsec" ]; then
          eout "{scan} building file list for $spath of new/modified files from last $days days, this might take awhile..." 1
  fi
  $find $spath $tmpdir_paths -maxdepth $maxdepth -type f -mtime -$days -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
 fi

I can say that you can use same wildcards as you do usually in grep.

However i have tested it on my version of maldet and it works only if i specified it like this:

/home/.*/homes/.*/Maildir

Try use dots in your path expressions.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .