Using clamscan inside /etc/procmailrc

[ Originally I wrote this in June 2, 2004 ]

If for whatever reason you want to use ClamAV with sendmail and cannot use the clamav-milter (like when working with RedHat ES and its stock sendmail), using procmail as your local delivery agent might help. This is a very simple /etc/procmailrc:

# adamo, Thu May 27 16:26:48 EEST 2004

# Set the default path
PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin

# Uncomment this to monitor the recipes
#LOGFILE=/var/log/procmail.log

# NEVER forget the last dash (-) on the follwoing command
:0 Wc: /var/tmp/clamscan.${PPID}.$$.lock
| /usr/local/bin/clamscan --stdout --tempdir=/var/tmp --quiet --mbox -

# Delete emails that contain virii
:0 e: /var/tmp/formail.${PPID}.$$.lock
/dev/null

# Tag emails that contain virii
## :0 eWf: /var/tmp/formail.${PPID}.$$.lock
## | /usr/bin/formail -i "Subject: VIRUS FOUND -- PLEASE DELETE ME"

See also at the ClamAV wiki: ClamAndProcmail.