make amavis save some inspected files

Per-Erik Persson pegpe at kth.se
Tue Mar 29 12:26:20 CEST 2016


At the moment I block files with certain extensions, mostly exe and 
double extensionsins.
Theese emails can later on be inspected and submitted to various 
services for inspections thanks to the extraction and saving of banned 
files.

But what if I want to save the email that I find suspicious for later 
inspection(i.e .js) without rejecting the email.
As far as I know I cannot tell postfix to save an extra copy of an email 
if it contains .js files.

The whole reason for this adventure is that antiviruses don't catch that 
much anymore and the suspicious files has to be sent to a sandbox which 
might take ten minutes to answer and then it cannot be inline.


More information about the amavis-users mailing list