clamav-milter.conf(5)

💖 clamav-milter.conf 💖

okay bestie, gather round, because this is the manual page for clamav-milter.conf(5) — aka the config file situation for the Clam AntiVirus milter. no cap, it's shorter than you think and honestly kinda iconic. let's get into it 🦋

---

✨ NAME ✨

clamav-milter.conf — the configuration file for clamav-milter. that's it. that's the name. short, sweet, slays 💅

---

🌸 DESCRIPTION 🌸

clamav-milter.conf contains the configuration options for clamav-milter(8). like, every knob you can turn lives in here. periodt.

---

🎀 FILE FORMAT 🎀

the file is just comments and options-with-arguments, bestie. super simple:

• any line that starts with a hash (#) is straight-up ignored by the parser. it's giving "not my problem" energy 💀
• options and their arguments are case sensitive and look like Option Argument

the arguments come in these flavors:

• BOOL — a Boolean value, so yes/no or true/false or 1/0. pick your fighter.
• STRING — a string with no blank characters in it. none. zero. nope.
• SIZE — a size in bytes. you can use 'M' or 'm' modifiers for megabytes and 'K' or 'k' for kilobytes 🍓
• NUMBER — an unsigned integer. no negatives, we don't do that here.

---

👑 MAIN OPTIONS 👑

• Example — if this option is set, clamav-milter will not run. yes bestie, that's literally what it says 🙈
• MilterSocket STRING — defines the interface we use to talk to sendmail. this option is mandatory! (like, no really, you cannot skip it 🔥) possible formats are:

[[unix|local]:]/path/to/file - to specify a unix domain socket
inet:port@[hostname|ip-address] - to specify an ipv4 socket
inet6:port@[hostname|ip-address] - to specify an ipv6 socket

Default: unset

• MilterSocketGroup STRING — sets the group ownership for the (unix) milter socket. Default: disabled (the primary group of the user running clamd)
• MilterSocketMode STRING — sets the permissions on the (unix) milter socket to the mode you specify. Default: disabled (obey umask)
• FixStaleSocket BOOL — removes the stale socket after an unclean shutdown. tidy queen behavior ✨ Default: yes
• User STRING — run as another user. heads up: clamav-milter must be started by root for this option to actually work. Default: unset (don't drop privileges)
• ReadTimeout NUMBER — waiting for data from clamd will time out after this many seconds. clock's ticking ⏰ Default: 120
• Foreground BOOL — don't fork into the background. stay right here with me. Default: no
• Chroot STRING — chroot to the specified directory. the chrooting happens just after reading the config file and before dropping privileges. Default: unset (don't chroot)
• PidFile STRING — write the daemon's pid to the specified file. Default: disabled
• TemporaryDirectory STRING — optional path to the global temporary directory. Default: system specific (usually /tmp or /var/tmp).

---

🦋 CLAMD OPTIONS 🦋

• ClamdSocket STRING — defines the clamd socket to connect to for scanning. this option is mandatory! syntax goes like this:

ClamdSocket unix:path
ClamdSocket tcp:host:port

the first syntax specifies a local unix socket (it needs an absolute path), e.g.:

ClamdSocket unix:/run/clamav/clamd.sock

the second syntax specifies a tcp local or remote tcp socket: the host can be a hostname or an ip address; the ":port" field is only required for IPv6 addresses, otherwise it defaults to 3310, e.g.:

ClamdSocket tcp:192.168.0.1

this option can be repeated several times with different sockets, or even with the same socket: clamd servers will be selected in a round-robin fashion 🔄 Default: no default

---

🌈 EXCLUSIONS 🌈

• LocalNet STRING — messages originating from these hosts/networks will not be scanned. this option takes a host(name)/mask pair in CIRD notation and can be repeated several times. if "/mask" is omitted, a host is assumed. to specify a locally originated, non-smtp, email, use the keyword "local". Default: unset (scan everything regardless of the origin)
• AllowList STRING — this one specifies a file containing a list of basic POSIX regular expressions. addresses (sent to or from — see below) that match these regexes will not be scanned. optionally, each line can start with the string "From:" or "To:" (note: no whitespace after the colon) indicating whether it's, respectively, the sender or the recipient that is to be allowed. if the field is missing, "To:" is assumed. lines starting with #, : or ! are ignored. Default: unset (no exclusion applied)
• SkipAuthenticated STRING — messages from authenticated SMTP users matching this extended POSIX regular expression (egrep-like) will not be scanned. as an alternative, a file containing a plain (not regex) list of names (one per line) can be specified using the prefix "file:", e.g. SkipAuthenticated file:/etc/good_guys. Note: this is the AUTH login name! Default: unset (no allowing based on SMTP auth)
• MaxFileSize SIZE — messages larger than this value won't be scanned. make sure this value is lower or equal than StreamMaxLength in clamd.conf ⚠️ Default: 100M

---

💅 ACTIONS 💅

this next group of options controls the delivery process under different circumstances. here's the menu of actions you can pick from:

• Accept: the message is accepted for delivery ✅
• Reject: immediately refuse delivery (a 5xx error is returned to the peer)
• Defer: return a temporary failure message (4xx) to the peer
• Blackhole (not available for OnFail): like Accept but the message is sent to oblivion 🕳️
• Quarantine (not available for OnFail): like Accept but the message is quarantined instead of being delivered. NOTE: in Sendmail the quarantine queue can be examined via mailq -qQ. for Postfix this causes the message to be placed on hold.

okay now the actual options:

• OnClean STRING — action to be performed on clean messages (mostly useful for testing 🧪) Default: Accept
• OnInfected STRING — action to be performed on infected messages. Default: Quarantine
• OnFail STRING — action to be performed on error conditions. and bestie, "error conditions" is doing a LOT of heavy lifting here: this includes failure to allocate data structures, no scanners available, network timeouts, unknown scanner replies and the like 😭 Default: Defer
• RejectMsg STRING — this option lets you set a specific rejection reason for infected messages, so it's therefore only useful together with "OnInfected Reject". the string "%v", if present, will be replaced with the virus name. Default: MTA specific
• AddHeader STRING — if this option is set to "Replace" (or "Yes"), an "X-Virus-Scanned" and an "X-Virus-Status" header will be attached to each processed message, possibly replacing existing headers. if it's set to Add, the X-Virus headers are added, possibly on top of the existing ones. note that while "Replace" can potentially break DKIM signatures, "Add" may confuse procmail and similar filters. pick your chaos 🫶 Default: no
• ReportHostname STRING — when AddHeader is in use, this option lets you set the reported hostname. this may be desirable in order to avoid leaking internal names 👀 if unset, the real machine name is used. Default: disabled
• VirusAction STRING — execute a command (possibly searching PATH) when an infected message is found. the following parameters are passed to the invoked program, in this order: virus name, queue id, sender, destination, subject, message id, message date.
  • Note #1: this requires MTA macroes to be available (see LogInfected below).
  • Note #2: the process is invoked in the context of clamav-milter.
  • Note #3: clamav-milter will wait for the process to exit. be quick or fork to avoid unnecessary delays in email delivery. no pressure tho 🔥 Default: disabled

---

⭐ LOGGING OPTIONS ⭐

• LogFile STRING — enable logging to the selected file. Default: no
• LogFileUnlock BOOL — disable a system lock that protects against running clamd with the same configuration file multiple times. Default: no
• LogFileMaxSize SIZE — limit the size of the log file. the logger will be automatically disabled if the file is greater than SIZE. a value of 0 disables the limit. Default: 1M
• LogTime BOOL — log time for each message. timestamps, bestie ⏱️ Default: no
• LogSyslog BOOL — use the system logger (can work together with LogFile). Default: no
• LogFacility STRING — specify the type of syslog messages. please refer to man syslog for facility names. Default: LOG_LOCAL6
• LogVerbose BOOL — enable verbose logging. yap yap yap 🗣️ Default: no
• LogInfected STRING — this option lets you tune what is logged when a message is infected. possible values are Off (the default — nothing is logged), Basic (minimal info logged), Full (verbose info logged). Note: for this to work properly in sendmail, make sure the msg_id, mail_addr, rcpt_addr and i macroes are available in eom. in other words, add a line like:

Milter.macros.eom={msg_id}, {mail_addr}, {rcpt_addr}, i

to your .cf file. alternatively use the macro:

define(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i')

Postfix should be working fine with the default settings. Default: disabled

• LogClean STRING — this option lets you tune what is logged when no threat is found in a scanned message. see LogInfected for possible values and caveats. useful in debugging but drastically increases the log size 😬 Default: disabled
• SupportMultipleRecipients BOOL — this option affects the behaviour of LogInfected, LogClean and VirusAction when a message with multiple recipients is scanned:
  • if SupportMultipleRecipients is off (the default), then one single log entry is generated for the message and, in case the message is determined to be malicious, the command indicated by VirusAction is executed just once. in both cases, only the last recipient is reported.
  • if SupportMultipleRecipients is on, then one line is logged for each recipient and the command indicated by VirusAction is also executed once for each recipient.
  • Note: although it's probably a good idea to enable this option, the default value is currently set to off for legacy reasons. (legacy reasons, the eternal excuse 🙈) Default: no

---

🧚 NOTES 🧚

all options expressing a size are limited to a max of 4GB. values in excess will be reset to the maximum. so don't try it, the cap is capping 💀

---

🍓 FILES 🍓

/etc/clamav/clamav-milter.conf

---

💜 AUTHOR 💜

aCaB <acab@clamav.net>

---

🔥 SEE ALSO 🔥

clamav-milter(8), clamd(8), clamd.conf(5)

---

and that's the whole page, bestie, you ate it up 💖 this one's from ClamAV 1.5.4, dated Feb 25, 2009 — iconic since day one, and honestly? still serving. mwah 💅✨🎀