also be aware that you'll get more delays on your emails, since they will be scanned by virustotal (and you'll have to wait for API response), not to mention that everything will be uploaded to their servers (just a consideration).
Currently the way to do this would be to write a custom_check_script which interacts with the virustotal api:
The idea sounds good in general - but as far as I could find out - directly integrating it in PMG could be problematic:
VirusTotal premium services are meant for companies and public sector organizations, not individuals. Popular threat intelligence packages lie in the range $(XX)K-(XXX)K, although we can also work on custom solutions for your use case.if that's 10k - 999k then I'd assume it's out of the price-range for most our users
Aug 4 13:36:35 RZ-PMG postfix/smtpd[1884]: warning: timeout talking to proxy 127.0.0.1:10023
Aug 4 13:36:35 RZ-PMG postfix/smtpd[1884]: proxy-reject: END-OF-MESSAGE: 451 4.3.0 Error: queue file write error; from=<REMOVESD> to=<REMOVED> proto=ESMTP helo=<SOMETARGETSERVER>
Aug 4 13:36:35 RZ-PMG postfix/smtpd[1884]: NOQUEUE: client=unknown[10.255.14.30]the number of pmg-smtp-filter processes is based on the available memory in the system - and is not configurable (short of editing the code):
Never mind... this was just a script bug on our site.
thought it's called GDPR in English (but am not too well versed on these topics ....).
That's the alternative to just use Hashes.... still heavily work in progress while staff is complaining about the don't and does.... ;-)
#!/bin/sh
vt_api_key=***PUT_YOUR_API_KEY_HERE***
max_mail_size=2M
echo "called with $*" 1>&2
if [ "$#" -ne 2 ]; then
echo "usage: $0 APIVERSION QUEUEFILENAME" 1>&2
exit 1
fi
apiver="$1"
shift
if [ "$apiver" != "v1" ]; then
echo "wrong APIVERSION: $apiver" 1>&2
exit 2
fi
queue_file="$1"
echo "v1"
#Extract Mail and Attachments
mkdir -p /tmp$queue_file > /dev/null
cd /tmp$queue_file > /dev/null
munpack -fqt $queue_file > /dev/null
FILES="/tmp$queue_file/*"
rm -f /tmp$queue_file/*.txt > /dev/null
rm -f /tmp$queue_file/*.png > /dev/null
rm -f /tmp$queue_file/*.jpg > /dev/null
rm -f /tmp$queue_file/*.desc > /dev/null
rm -f /tmp$queue_file/part* > /dev/null
if [ -z "$(ls -A /tmp$queue_file/)" ] ; then
logger "VIRUSTOTAL Nothing to do for $queue_file... EXIT"
echo OK
exit
fi
for f in $FILES
do
logger "VIRUSTOTAL Processing $f file..."
# take action on each file. $f store current file name
sha256=$(sha256sum $f)
logger "VIRUSTOTAL Send Hash for File $f"
data=$(curl -s --request GET --url https://www.virustotal.com/api/v3/files/$sha256 --header "x-apikey: $vt_api_key" | jq '.[]' | grep -oP '(?<="malicious": ).*?(?=,)')
choice=$(echo $data)
re='^[0-9]+$'
if ! [ "$choice" = "$re" ] ; then
choice=0
logger "VIRUSTOTAL File $queue_file Malicious Count: $choice - $f"
fi
if ! [ "$choice" = "0" ] ; then
logger "VIRUSTOTAL File $queue_file Malicious Count: $choice - $f"
break
fi
sleep $((RANDOM % 17))
done
rm -fr /tmp$queue_file/
case "$choice" in
0)
echo OK
;;
1)
echo SCORE: 1
;;
2)
echo SCORE: 2
;;
3)
echo SCORE: 3
;;
4)
echo SCORE: 4
;;
5)
echo SCORE: 5
;;
6)
echo SCORE: 6
;;
7)
echo SCORE: 8
;;
*)
echo SCORE: 10
;;
esac
exit 0
Thanks for the script and for sharing that information - and I'd agree that this will probably be beyond most users' budget!
But if someone really needs it... he can now do it.... and for private personal home usage, it is also allowed and the free key should be enough for around 1000 mails with attachment a day.... will upgrade script in the posting, as I made some fine tuning....