.\" Man page generated from reStructuredText.
.
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "CYR_VIRUSSCAN" "8" "Mar 18, 2024" "3.10.0" "Cyrus IMAP"
.SH NAME
cyr_virusscan \- Cyrus IMAP documentation
.sp
Scan for viruses using configured virus scanner or manage infected messages using search criteria.
.SH SYNOPSIS
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
\fBcyr_virusscan\fP [ \fB\-C\fP \fIconfig\-file\fP ] [ \fB\-s\fP \fIimap\-search\-string\fP ] [ \fB\-r\fP [ \fB\-n\fP] ] [\fB\-v\fP] [ \fImboxpattern1\fP ... ]
.ft P
.fi
.UNINDENT
.UNINDENT
.SH DESCRIPTION
.sp
\fBcyr_virusscan\fP can be used to invoke an external virus scanner (currently
only \fI\%ClamAV\fP is
supported) to scan specified IMAP mailboxes. If no mboxpattern is given,
\fBcyr_virusscan\fP works on all mailboxes.
.sp
Alternately, with the \fB\-s\fP option, the IMAP SEARCH string will be used as a
specification of messages which are \fIassumed\fP to be infected, and will be
treated as such.  The virus scanner is not invoked. Useful for removing messages
without a distinct signature, such as Phish.
.sp
A table of infected messages will be output.
.sp
To remove infected messages, use the \fB\-r\fP flag. Infected messages will be expunged
from the user\(aqs mailbox.
.sp
With the notify flag, \fB\-n\fP, notifications will be appended to the inbox of
the mailbox owner, containing message digest information for the affected mail.
This flag only works in combination with \fB\-r\fP\&.  The notification message
can by customised by template, for details see \fI\%Notifications\fP below.
.sp
\fBcyr_virusscan\fP can be configured to run periodically by cron(8)
via crontab(5) or your preferred method (i.e. /etc/cron.hourly), or by
\fI\%master(8)\fP via the EVENTS{} section in
\fI\%cyrus.conf(5)\fP\&.
.sp
\fBcyr_virusscan\fP reads its configuration options out of the \fI\%imapd.conf(5)\fP file unless specified otherwise by \fB\-C\fP\&.
.sp
Note that Cyrus does not ship with any virus scanners: you need to install
one separately to make use of it with Cyrus.
.SH OPTIONS
.INDENT 0.0
.TP
.B \-C config\-file
Use the specified configuration file \fIconfig\-file\fP rather than the default \fI\%imapd.conf(5)\fP\&.
.UNINDENT
.INDENT 0.0
.TP
.B \-n, \-\-notify
Notify mailbox owner of deleted messages via email.  This flag is
only operable in combination with \fB\-r\fP\&.
.UNINDENT
.INDENT 0.0
.TP
.B \-r, \-\-remove\-infected
Remove infected messages.
.UNINDENT
.INDENT 0.0
.TP
.B \-s imap\-search\-string, \-\-search=imap\-search\-string
Rather than scanning for viruses, messages matching the search
criteria will be treated as infected.
.UNINDENT
.INDENT 0.0
.TP
.B \-v, \-\-verbose
Produce more verbose output
.UNINDENT
.SH NOTIFICATIONS
.sp
When the \fB\-n\fP flag is provided, notifications are sent to mailbox owners
when infected messages are removed.  One notification is sent per owner,
containing a digest of each message that was deleted from any of their
mailboxes.
.sp
The default notification subject is \(dqAutomatically deleted mail\(dq, which
can be overridden by setting \fBvirusscan_notification_subject\fP in
\fI\%imapd.conf(5)\fP to a UTF\-8 value.
.sp
Each infected message will be described according to the following template:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
The following message was deleted from mailbox \(aq%MAILBOX%\(aq
because it was infected with virus \(aq%VIRUS%\(aq

    Message\-ID: %MSG_ID%
    Date: %MSG_DATE%
    From: %MSG_FROM%
    Subject: %MSG_SUBJECT%
    IMAP UID: %MSG_UID%
.ft P
.fi
.UNINDENT
.UNINDENT
.sp
To use a custom template, create a UTF\-8 file containing your desired text
and using the same %\-delimited substitutions as above, and set the
\fBvirusscan_notification_template\fP option in \fI\%imapd.conf(5)\fP to
its path.
.sp
The notification message will be properly MIME\-encoded at delivery. Do not
pre\-encode the template file or the subject!
.sp
When \fBcyr_virusscan\fP starts up, if notifications have been requested (with
the \fB\-n\fP flag), a basic sanity check of the template will be performed
prior to initialising the antivirus engine.  If it appears that the
resultant notifications would be undeliverable for some reason,
\fBcyr_virusscan\fP will exit immediately with an error, rather than risk
deleting messages without notifying.
.SH EXAMPLES
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
\fBcyr_virusscan\fP
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
Scan all mailboxes, printing report on the screen.  Do not
remove infected messages.
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
\fBcyr_virusscan\fP \-r \-n user/bovik
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
Scan mailbox \fIuser/bovik\fP, removing infected messages and append
notifications to Bovik\(aqs inbox.
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
\fBcyr_virusscan\fP \-r \-n \-s \(aqSUBJECT \(dqFedex\(dq\(aq user/bovik
.ft P
.fi
.UNINDENT
.UNINDENT
.INDENT 0.0
.INDENT 3.5
Search mailbox user/bovik for messages which have Fedex in the
subject line, removing them all, and appending notifications to
Bovik\(aqs inbox.
.UNINDENT
.UNINDENT
.SH HISTORY
.sp
Virus scan support was first introduced in Cyrus version 3.0.
.SH FILES
.sp
/etc/imapd.conf
.SH SEE ALSO
.sp
\fI\%imapd.conf(5)\fP, \fI\%master(8)\fP, \fI\%ClamAV\fP
.SH AUTHOR
The Cyrus Team, Nic Bernstein (Onlight)
.SH COPYRIGHT
1993–2024, The Cyrus Team
.\" Generated by docutils manpage writer.
.