1

I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders are cleaned often, and the users may clean it also.

I tried adding wildcards into /usr/local/maldetect/ignore_paths as follows but they are not ignored:

/home/*/homes/*/Maildir
/home/?/homes/?/Maildir

Does anyone know how to exclude folders using wildcards, as it would not be practical to add the full path of every users mail directory.

Thanks

2

I have found only

/usr/local/maldetect/ignore_inotify
A line spaced file for regexp paths that are excluded from inotify monitoring
Sample ignore entry:
^/home/user$
^/var/tmp/#sql_.*\.MYD$

http://www.rfxn.com/appdocs/README.maldetect

If you monitor files with inotify(flag -m) then it can help you.

Based on this code of maldet:

 if [ "$days" == "all" ]; then
  if [ -z "$setmodsec" ]; then
          eout "{scan} building file list for $spath, this might take awhile..." 1
  fi
  $find $spath $tmpdir_paths -maxdepth $maxdepth -type f -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
 else
  if [ -z "$setmodsec" ]; then
          eout "{scan} building file list for $spath of new/modified files from last $days days, this might take awhile..." 1
  fi
  $find $spath $tmpdir_paths -maxdepth $maxdepth -type f -mtime -$days -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
 fi

I can say that you can use same wildcards as you do usually in grep.

However i have tested it on my version of maldet and it works only if i specified it like this:

/home/.*/homes/.*/Maildir

Try use dots in your path expressions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.