How can I send a mail via the CLI in DMS with a file attached?

[unsubscrieb]

Daily virus scans on my machine trigger an email to send if anything is found with the below command:
docker exec mailserver bash -c "tail /var/log/clamav/clamav-2025-02-09.log -n 12 | mail -a /var/log/clamav/clamav-2025-02-09.log -s 'Malware Found' -r 'clamav-daily' [email protected]"

Using the eicar test file to check everything is working, the email is sending but the log file which should be attached is missing and the path is prepended to the mail body.

Note I have mounted the directory to the container and can tail the log files inside the container.

[polarathene]

You need to provide more context please.

Do I understand this correctly?

• Mail arrives to DMS and detected as having a virus (EICAR)
• You want to scan for malware detection events in the log, so that you can send a notification mail when a virus was caught?

How is the mail being tested with DMS? Is it arriving inbound via port 25 to Postfix? Or are you using Fetchmail/Getmail?

We have two integrations for ClamAV:

• Amavis (default) with SpamAssassin (anti-spam) and ClamAV (anti-virus), both which require separate ENV to enable.
• Rspamd (opt-in) which provides anti-spam and delegates to ClamAV for anti-virus.

SpamAssassin itself is only configured for anti-spam we don't have it setup for ClamAV, nor do we run spamd. Amavis provides no CLI that can be used for spam/virus detection, so if you try with spamassassin-run/ spamc (requires spamd to run) it will only scan spam and not detect viruses. This is relevant if you use Fetchmail/Getmail when mail they retrieve doesn't get to Dovecot through Postfix (and thus Amavis).

Non-issue with rspamc which works correctly, however it doesn't emit exit codes so regardless of spam/virus content, the mail gets headers appended to indicate spam/infection, but is handed over to Dovecot to store. We have Dovecot configured to detect spam headers and migrate that to junk, but it doesn't expect to receive mail with viruses.

Normally most mail would come into DMS through Postfix which uses a content filter for Amavis, or smtpd milter for rspamd. These can reject mail that has viruses, or with Amavis it can quarantine it, in both cases neither should deliver into the intended Dovecot mailbox.

---

When you've clarified if I understood correctly. I can show a minimal reproduction to test a virus mail arriving, and confirm any issues with logs, otherwise if that doesn't reproduce your problem you'll need to figure that out for a proper bug report if it's not a misconfiguration.

[unsubscrieb]

Sorry, will elaborate on the scenario.
Within docker-mailserver the emails are being virus scanned and quarantined correctly with in inbuilt clamav - no issue there.

On the host OS I have a scheduled virus scan, if this detects a virus will run the script using the docker-mailserver container to send an alert email with the scan summary in the email body, and is supposed to attach the .log for the scan that identified the threat (eicar for testing). The host script is sending the email with docker exec mailserver bash -c "tail /var/log/clamav/clamav-2025-02-09.log -n 12 | mail -a /var/log/clamav/clamav-2025-02-09.log -s 'Malware Found' -r 'clamav-daily' [email protected]"

What I am experiencing is that the script can send the email but the .log file isn't getting attached. I've read over the mail documentation and can't see why passing the .log with -a doesn't work. The email received is screenshot above, no attachments, however the path/filename is included in the email body.

[polarathene]

On the host OS I have a scheduled virus scan, if this detects a virus will run the script using the docker-mailserver container to send an alert email

I've read over the mail documentation and can't see why passing the .log with -a doesn't work.

Ah ok, so this was probably like I described in my answer... Your host OS mail probably differs from what mail actually is in DMS. It doesn't look like mail in DMS supports -a the same way as you've read elsewhere. Please consider using swaks like detailed in my answer 👍

[polarathene]

the email is sending but the log file which should be attached is missing and the path is prepended to the mail body.

Oops I misread the issue, sorry about that.

The -a option you provided to mail also appears to be for setting a header, not attaching a file? I am not fond of the mail command myself as from what I've read it varies by system. It's not always the same program. In our case it's an alias to mailx IIRC.

$ mail -h

mail: invalid option -- 'h'
usage: mail [-dEIinv] [-a header] [-b bcc-addr] [-c cc-addr] [-r from-addr] [-s subject] [--] to-addr ...
       mail [-dEIiNnv] -f [name]
       mail [-dEIiNnv] [-u user]

Those then use sendmail I think to send the mail, which for DMS will be a command Postfix provides, and that has some slightly different behaviour than delivering mail through ports 25/587/465.

---

Use swaks

Could you instead try with swaks?

We bundle that into DMS and it should be nicer to use. Here's a quick overview/guide to get you familiar :)

Docs:

• These docs are a little outdated IIRC, but will be common in search results.
• swaks on Github is the official source](https://github.com/jetmore/swaks/blob/develop/doc/base.pod), but sometimes has been known to be rendered on Github broken.
• Should the swaks github docs link be in a broken state, DMS from v15 (which is currently the :edge tag) can run swaks --help to view proper docs rendered in a terminal.

Example - Basic swaks + inline attachment

You provide file attachments via --attach, these will be inline content by default that is encoded into base64:

swaks --server localhost --to [email protected] --attach 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

If you test this in the DMS container you may need PERMIT_DOCKER=container for it to not be rejected by Postfix. It shouldn't be required when you've got valid DNS records for --from (see below), but that may require you to specify --helo mail.example.com to pass a security check enforced on port 25.

• PERMIT_DOCKER=container will allow any process in the container to send mail through Postfix without these extra restrictions, so we generally advise preferring authenticated submission instead, which limits the risk/damage to credential leaks.
• A DMS account (setup email add ...) can send as any sender address (provided you've not set SPOOF_PROTECTION=1), it's not only tied to the mailbox address you assign to it in setup email add, but you could make a separate account regardless just for sending from [email protected].

NOTE: Without --server it will attempt to send to a mailserver of the recipient address (--to), I think it will perform a DNS MX record check - so if your MTA was mail.example.com and example.com had an MX record pointing to that MTA address, that should work without needing --server.

Example - Skipping security checks via authenticated submission

Add the submission port 587 with StartTLS (-tls, or for port 465 implicit TLS is instead -tlsc), and provide account credentials to authenticate:

swaks --server localhost \
  --port 587 -tls \
  --auth PLAIN --auth-user [email protected] --auth-password secret \
  --from [email protected] --to [email protected] \
  --attach 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

If you just use a sender address (--from) without a domain, swaks seems to send that without appending it.

• Since it's mail to yourself and you wouldn't expect a reply that might be ok, but if the mail is leaving your server to another mail server you would want a valid email address for --from.
• Without providing --from, it'll be implicitly [email protected] where example.com is what you set hostname as for the container, and root is the running user of the command.

Swaks does support a config file if you'd rather not have commands run with your credentials in them.

Example - File attachment

Now to attach a file instead of inline content, swaks expects a file path with @ as the prefix:

swaks --server localhost \
  --from [email protected] --to [email protected] \
  --header "Subject: Malware found" \
  --attach-name clamav-log.txt --attach @/var/log/clamav/clamav-2025-02-09.log

That will do a base64 encoded attachment. --attach-name is optional, otherwise it'll use the filename implicitly, so you can probably skip it. If you do use it, it must come before --attach does or swaks doesn't parse it correctly (I think because it can take multiple attachments this way).

There's no dedicated subject arg, so just use --header.

[unsubscrieb]

Thanks, that's done it! Using swaks the email triggers and sends with the log file attached.
I ended up with this command for my use case:

docker exec mailserver bash -c "swaks --server localhost --from clamav@hostname --to [email protected] --header 'Subject: Malware Found' --attach @/path/to/file.log --body '$(tail /path/to/file.log -n 12)'"