0

I am running a mailserver with postfix and amavisd-new. I use a clamAV virus scanner (with sanesecurity signatures). So far, everything is working fine.

Now, I want to block emails that have an MS Office attachment (e.g. .doc, .docm, , .xls, ...) that contains suspicious macros to avoid infections of malware like Emotet.

I found this: https://github.com/Cybso/amavis-macro-plugin It is integrated like a virus scanner into amavisd:

['Malicious Macro Detector',
   '/usr/local/bin/mmd.py', "{}",
      [0], qr/VIRUS/, qr/\bVIRUS (.+)\b/m ],

This mmd.py detects any office document as a virus that has suspicious macros. That works.

Now, reality bytes me: I have some users that insist on sending and receiving MS Office files with (suspicious) macros. This leads me to the question:

How can I disable a certain virus scanner (Malicious Macro Detector) in amavisd-new for certain users (recipients and senders)? Other virus scanners (clamAV) should still be enabled for all users.

Alternatively, any other solution to achieve my primary goal, i.e. block malicious macros for all except some users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.