[Quarantine] Section

In the [Quarantine] section, settings for proper Quarantine operation are specified:

Path = {path to directory}

Path to the Quarantine directory.

Default value:

Path = %var_dir/infected/

FilesMode = {permissions}

Permissions for files that are moved to Quarantine.

 

Default value:

FilesMode = 0660

FilenamesMode = {Std | Tai | Rand48}

Naming convention for files to be moved to Quarantine:

Std – renaming quarantined files with mkstemp command.

%FilenamesPrefix.XXXXXX template is used, where %FilenamesPrefix is the prefix specified in the FilenamesPrefix parameter value and XXXXXX is a combination of random letters and digits;

Tai – renaming quarantined files according to TAI (International Atomic Time).

%sec.%usec.%FilenamesPrefix.XXXXXX template is used;

Rand48 – renaming quarantined files with lrand48 command.

%FilenamesPrefix.XXXXXXXX template is used.

Default value:

FilenamesMode = Std

FilenamesPrefix = {string}

Prefix used to rename files which are moved to Quarantine.

The parameter value must not contain "%", "/" and "_" characters.

Default value:

FilenamesPrefix = maild

AccessByEmail = {logical}

Permission to process requests to receive messages saved to Quarantine via control messages.

Control message must be sent to the email address specified in the FilterMail parameter value (or in Rules) with the special Subject header:

q:relative_path_to_file

where relative_path_to_file is a relative path to the quarantined file (for example, /drweb/drweb.quarantine.puYtWx). Corresponding message is sent in response to such request only if one of its recipients or its sender matches control message sender.

Such control message is automatically generated by MUA of the MailD notification recipient when the corresponding link in the received report is clicked.

Please note that the default value of the OnlyTrustedControlMails parameter of the [Maild] section is Yes, thus control messages must be sent from a protected network (specified in the ProtectedNetworks parameter of the [Maild] section). Otherwise, the control message is ignored.

Default value:

AccessByEmail = Yes

StoredTime = {time}

Period of time to store a message in Quarantine.

When the parameter value is set to 0, this period of time is not limited.

Default value:

StoredTime = 24h

MaxSize = {size in Kbytes}

Maximum total size of messages in Quarantine,  in KB.

If value of this parameter is set to 0, the size is not limited.

For each message, size of the message body is calculated rather than its actual size on the disk.

This parameter affects only the size of internal database and does not affect the DBI storage (if connected).

Default value:

MaxSize = 0

MaxNumber = {numerical value}

Maximum number of messages in Quarantine.

If value of this parameter is set to 0, this number is not limited.

This parameter affects only the number of messages in the internal database and does not affect the DBI storage (if it is connected).

Default value:

MaxNumber = 0

MoveToDBI = {Yes | No}

Moving of quarantined messages from file storage to the DBI storage.

To move messages to the DBI storage, the File::Temp and DBI Perl modules are required.

Default value:

MoveToDBI = No

DBISettings = {string}

DBI storage connection parameters.

Example:

"dbi:Pg:dbname=emails_db"

Database must be created using SQL-ASCII character set.

Requirements to format of the table used for message storing are presented below.

Default value:

DBISettings =

DBIUsername = {text value}

User name to connect to the DBI storage.

Default value:

DBIUsername =

DBIPassword = {text value}

User password to connect to the DBI storage.

Default value:

DBIPassword =

SQLInsertCommand = {string}

An SQL command to add a message to the DBI storage.

Sequence of fields listed in the command must correspond to the format of the table in DBI (see below). Inserted values in the request must be replaced with question marks ("?").

SQL command must contain the following fields:

Message number

Relative path to a file with message. File format is the following: client/plug-in/id.prefix, where client 'def' string, plug-in – name of the plug-in, id – message number in hexadecimal form (in output, the first eight symbols are used), prefix is the prefix depending on values of the following parameters: FilenamesMode и FilenamesPrefix

Time of saving a message to the database

Value of the From: header (enclosed in angle brackets)

List of recipients' addresses. Addresses in the list are separated by commas and enclosed in angle brackets

Message body.

Example:

SQLInsertCommand = "INSERT INTO mail_export(id, filename, put_time, sender, rcpts,body) values (?,?,?,?,?,?)"

Default value:

SQLInsertCommand =

SQLRemoveCommand = {string}

A command to delete messages from the DBI storage.

It is used when time limit for storing messages in Quarantine is specified. The only parameter specified in request is time, all messages older than the specified value are deleted.

The value element in the request must be replaced with a question mark ("?").

Example:

SQLRemoveCommand = "DELETE FROM mail_export WHERE put_time<=?"

Default value:

SQLRemoveCommand =

SQLSelectCommand = {string}

A command used to access messages in the DBI storage (for example, to request a message from Quarantine using control message).

The only parameter used in the request is a relative file name in Quarantine. Value element in request must be replaced with a question mark ("?").

Sequence and types of returned fields are fixed (corresponds to the format of the table used in the storage, see below):

1.id - message number

2.put_time - time of saving message to the database

3.body - message body

4.sender - value of the From: header (enclosed in angle brackets)

5.rcpts - list of recipients' addresses. Addresses in the list are separated by commas and enclosed in angle brackets

6.filename -  relative path to the file with message

Example:

SQLSelectCommand = "SELECT id,put_time,body,sender,rcpts,filename FROM mail_export WHERE filename LIKE ?"

Default value:

SQLSelectCommand =

PulseTime = {time}

Period of time to delete old messages and move messages from the DBI storage.

When the parameter value is set to 0, the program specified in the PathToDrwebQp parameter value is not started.

Default value:

PulseTime = 5m

PathToDrwebQp = {path to file}

Path to the drweb-qp utility.

Default value:

PathToDrwebQp = %bin_dir/drweb-qp

MoveAll = {logical}

Move all incoming messages directly to the /Path_parameter_value/def/backup/ directory and then archive them.

The parameter must be used with MoveToDBI = Yes, otherwise the directory can quickly become full with incoming messages.

Default value:

MoveAll = No

Format of database table used for storing quarantined messages

Table in DBI used for message storing must contain the following fields (order of the fields is not important, but their names and types must be identical to those specified below):

id (number) – Message number (identifier).

filename (string) – Relative path to the file with the message.

put_time (timestamp) – Time of adding the message to the database.

sender (string) – Value of the From: header (enclosed in angle brackets).

rcpts (string) – List of recipients from the message header (TO:, CC:, BCC:). Values are separated by commas and enclosed in angle brackets.

body (string) – Message body.

Please note that "data types" presented in the list, must be replaced with similar data types that are available in the used DBMS (integer, varchar and others).