why?
disabling clamav-freshclam should work - but I have not tested this - if you disable the service I assume this should work across upgrades
(but cannot promise this since the pre/postinst scripts from the clamav script might change in the future)
consider masking the service
The reason is this thread
https://forum.proxmox.com/threads/b...xlsx-xls-for-some-domains.117645/#post-509196
I will make a summary in that thread when I am finished configuring everything.
In the end I had to spin up a new pmg instance just for this customer and use just clamav to block encrypted xlsx, xls and zip files. I also had to disable scanning of pdf files because they want to be able to receive password protected pdf.
If Arnaud Jacques did not help me by creating signatures for encrypted xls and xlsx files we would lost this customer.
So big shutout for his help and his company. We have been running his signatures and he has always been responsive and helpful if we needed help. He did not need to help me but he did it anyway.
https://www.securiteinfo.com/servic...e-of-zero-day-malwares-for-clamav.shtml?lg=en
This was a security requirement for this customer and if we did not do this they would just leave. I had to spend a lot of time configuring and testing additional pmg server that I will also have to maintain. I am not ready yet to deploy still have some testing to do will try to put it in the production next week. I have tried everything to avoid adding additional pmg instance but it does not seem possible.
I am quite disappointed by how limited you are if you are trying to run one pmg instance for multiple domains with different rules like it's not possible for clamav to run differently for each domain. And also it's very hard to make different rules for how to block and allow at what spam level for different domains.
To me it looks like pmg is build for one domain only if you are running multiple domains you are just stuck with very generic rules and you can't make any specific case for just some domains.
The updated security requirement was blocking password protected .xls and .xlsx and .zip files for their domains (they have a few) and allowing password protected .pdf files. We run a lot of domains on our instance and we can't enable this policy for all domains so configuring additional pmg is the only way to do this.
