CYR_VIRUSSCAN(8)

📦
version 3.12.3 · 10 versions
, in ubuntu stonking

✨ CYR_VIRUSSCAN(8) ✨

okay so bestie, welcome to cyr_virusscan — it's the Cyrus IMAP virus-scanning tool and it's literally giving main character energy for keeping your mailboxes clean 💅

🌸 NAME 🌸

cyr_virusscan — Cyrus IMAP documentation, no cap.

Scan for viruses using a configured virus scanner, or manage infected messages using search criteria. It's giving "security guard for your inbox" vibes 🫶

🎀 SYNOPSIS 🎀

cyr_virusscan [ -C config-file ] [ -s imap-search-string ] [ -r [ -n] ] [-v] [ mboxpattern1 ... ]

💖 DESCRIPTION 💖

cyr_virusscan can be used to invoke an external virus scanner (currently only ClamAV is supported, iykyk) to scan specified IMAP mailboxes. If no mboxpattern is given, cyr_virusscan works on all mailboxes. All of them. Every single one. periodt.

Alternately, with the -s option, the IMAP SEARCH string will be used as a specification of messages which are assumed to be infected, and will be treated as such. The virus scanner is not invoked in this mode. Super useful for removing messages without a distinct signature, such as Phish. 🎣

A table of infected messages will be output. You'll literally see the receipts.

To remove infected messages, use the -r flag. Infected messages will be expunged from the user's mailbox. Bye bye bestie 👋

With the notify flag, -n, notifications will be appended to the inbox of the mailbox owner, containing message digest information for the affected mail. This flag only works in combination with -r. The notification message can be customised by template — for details see Notifications below. (Spoiler: it's further down, keep scrolling bestie 😌)

cyr_virusscan can be configured to run periodically by cron(8) via crontab(5) or your preferred method (i.e. /etc/cron.hourly), or by master(8) via the EVENTS{} section in cyrus.conf(5). Set it and forget it, honestly iconic.

cyr_virusscan reads its configuration options out of the imapd.conf(5) file unless specified otherwise by -C.

⚠️ Real talk: note that Cyrus does not ship with any virus scanners — you need to install one separately to make use of it with Cyrus. We can't hand you the scanner, only the vibe. 😭

✨ OPTIONS ✨

  • -C config-file — Use the specified configuration file config-file rather than the default imapd.conf(5). You do you, boo.
  • -n, --notify — Notify mailbox owner of deleted messages via email. This flag is only operable in combination with -r. (No -r, no notification, fr fr.)
  • -r, --remove-infected — Remove infected messages. Scary but slay.
  • -s imap-search-string, --search=imap-search-string — Rather than scanning for viruses, messages matching the search criteria will be treated as infected. The scanner is not invoked — you're just pointing at the messages and being like "yeah, that one." 👀
  • -v, --verbose — Produce more verbose output. Give me all the details, bestie.

🦋 NOTIFICATIONS 🦋

When the -n flag is provided, notifications are sent to mailbox owners when infected messages are removed. One notification is sent per owner, containing a digest of each message that was deleted from any of their mailboxes. One per person, not one per message — collect them all, cute.

The default notification subject is "Automatically deleted mail", which can be overridden by setting virusscan_notification_subject in imapd.conf(5) to a UTF-8 value. Customise away 💖

Each infected message will be described according to the following template:

The following message was deleted from mailbox '%MAILBOX%'
because it was infected with virus '%VIRUS%'

    Message-ID: %MSG_ID%
    Date: %MSG_DATE%
    From: %MSG_FROM%
    Subject: %MSG_SUBJECT%
    IMAP UID: %MSG_UID%

To use a custom template, create a UTF-8 file containing your desired text and using the same %-delimited substitutions as above, and set the virusscan_notification_template option in imapd.conf(5) to its path. Match the placeholders exactly, don't freestyle them.

🚨 Important: the notification message will be properly MIME-encoded at delivery. Do not pre-encode the template file or the subject! Like, don't do it. The tool handles it. Trust. 🙈

When cyr_virusscan starts up, if notifications have been requested (with the -n flag), a basic sanity check of the template will be performed prior to initialising the antivirus engine. If it appears that the resultant notifications would be undeliverable for some reason, cyr_virusscan will exit immediately with an error, rather than risk deleting messages without notifying. Safety first, always — it would literally rather bail than delete your mail silently. 💀

🌈 EXAMPLES 🌈

cyr_virusscan

Scan all mailboxes, printing report on the screen. Do not remove infected messages. The "look but don't touch" era 🎀

cyr_virusscan -r -n user/bovik

Scan mailbox user/bovik, removing infected messages and append notifications to Bovik's inbox. Bye infected mail, hello receipts. 👑

cyr_virusscan -r -n -s 'SUBJECT "Fedex"' user/bovik

Search mailbox user/bovik for messages which have Fedex in the subject line, removing them all, and appending notifications to Bovik's inbox. (Yes, the Fedex thing. We all know the Fedex thing. 🎣)

📜 HISTORY 📜

Virus scan support was first introduced in Cyrus version 3.0. OG behavior, been here since day one.

🍓 FILES 🍓

  • /etc/imapd.conf

💜 SEE ALSO 💜

imapd.conf(5), master(8), ClamAV

👑 AUTHOR 👑

The Cyrus Team, Nic Bernstein (Onlight)

1993–2026, The Cyrus Team

okay that's the whole thing bestie, every flag, every template placeholder, every warning — all of it. go keep those mailboxes clean 🧚✨

version 3.12.3 · Jul 15, 2026 · Cyrus IMAP manual page, rewritten with love and zero skipped details 💖

📦 where this page comes from