Home » forums » Imported debian.org Mailing Lists » Debian ISP

clamsmtp spampd both @ SMTP time

Tags:

Right now we're running postfix, amavis-new and maia mailguard &
quarantining suspected spam and viruses.

Amavis has been good to us so far, but clamsmtpd and spampd seem
simpler and faster. It would be nice to be configuring SA and
clam directly and to have per user spam settings.

We'd like to move to rejecting ***NOT*** bouncing mail at SMTP
time. Our reasoning is that it is better to reject an important
message so the sender knows to contact you than to silently drop
it to do the floor or the quarantine so the sender thinks you are
ignoring him.

By rejecting after DATA , we will not be sending back scatter to
forged senders

We understand that this means that we will have bursts of traffic
that will require higher CPU / RAM for scanning incoming messages
before connection times out. We're ok with this.

We're running clamsmtp pre-queuing now per the postfix docs

http://www.postfix.org/SMTPD_PROXY_README.html

And this is working OK

It looks like it is possible to chain things:

postfix--->clamsmtp--->spamtpd--->postfix---> delivery

***pre-queueng***, not using content_filter

I am curious about people's experience in production. see:

http://www.irbs.net/internet/postfix/0601/1347.html

--

Bookmark/Search this post with:
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Google
  • Yahoo
  • Technorati
No votes yet
‹ sasl auth with exclusion for a relay host OT: SATA Backplanes drivebays and caddies ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

clamsmtp spampd both @ SMTP time

Submitted by PÁSZTOR György on Mon, 2007-12-03 09:00.

Hi,

"Dan MacNeil" írta 2007-11-30 21:41-kor:
> By rejecting after DATA , we will not be sending back scatter to
> forged senders
Have you already tried spamassasin-milter and clamav-milter packages?
They can say reject after DATA.
If you do a greylisting before DATA (eg. with postgrey), than many zombies
will bounce back from you, and it will relese many cpu time for you;-)

Cheers,
-- -------[ Free Software ISOs - http://www.fsn.hu/?f=download ]------- --
PÁSZTOR György e-mail:
Free Software Network (FSN.HU) phone @work: +36 62 54 6666
URL: http://people.fsn.hu/~pasztor/ cell.: +3620 512 3335

»

clamsmtp spampd both @ SMTP time

Submitted by Dan MacNeil on Mon, 2007-12-03 09:01.

> "Dan MacNeil" írta 2007-11-30 21:41-kor:
>> By rejecting after DATA , we will not be sending back scatter to
>> forged senders

> Have you already tried spamassasin-milter and clamav-milter packages?
> They can say reject after DATA.

PÁSZTOR György wrote:
> If you do a greylisting before DATA (eg. with postgrey), than many zombies
> will bounce back from you, and it will relese many cpu time for you;-)

Yes,

Greylisting is wonderful magic against evil SPAM spirits, I fear
the day somebody ports a RFC compliment MTA to the zombie platform.

btw, we also figure to do DNSBL after greylisting in front of
virus and spamassassin. With spamassassin we figure to reduce
timeouts by turning off the network checks.

So far we've had some timeouts, but checking IP# against whois
suggests that they are people we want to connect with anyway.

Moving to a much, much beefier box should reduce even those timeouts.

--

»

clamsmtp & spampd vs spamassasin-milter & clamav-milter for SMTP

Submitted by Dan MacNeil on Mon, 2007-12-03 09:01.

PÁSZTOR György wrote:
> Have you already tried spamassasin-milter and clamav-milter packages?
> They can say reject after DATA.

What advantages do spamassasin-milter & clamav-milter have over
clamsmtp & spampd ?

I've got the not milter packages working in a testing setup. So
far the only drawback is that the Recieved-From headers just say
localhost ...

--

»

clamsmtp & spampd vs spamassasin-milter & clamav-milter for SMTP

Submitted by PÁSZTOR György on Mon, 2007-12-03 09:01.

Hi!

"Dan MacNeil" írta 2007-12-01 13:43-kor:
> PÁSZTOR György wrote:
> >Have you already tried spamassasin-milter and clamav-milter packages?
> >They can say reject after DATA.
>
> What advantages do spamassasin-milter & clamav-milter have over
> clamsmtp & spampd ?
If a mail contain virus or spam, and clamav or spamassasin can say big
enogh probability for that, than you don't have to accept the mail.

After the end of DATA stream, the MTA will say an 5xx error code, and the
virus/spam will not make extra load on your server/mail queue.

Check this out:
http://www.postfix.org/SMTPD_PROXY_README.html
http://www.postfix.org/MILTER_README.html

Cheers,
-- -------[ Free Software ISOs - http://www.fsn.hu/?f=download ]------- --
PÁSZTOR György e-mail:
Free Software Network (FSN.HU) phone @work: +36 62 54 6666
URL: http://people.fsn.hu/~pasztor/ cell.: +3620 512 3335

»

clamsmtp spampd both @ SMTP time

Submitted by Lars Wilke on Thu, 2007-12-13 11:00.

* Dan MacNeil wrote:
> It looks like it is possible to chain things:
>
> postfix--->clamsmtp--->spamtpd--->postfix---> delivery
>
> I am curious about people's experience in production. see:

i hacked up smtpprox in combination with postfix smtpd_proxy_filter
option this works quite well. But i am doing only spamfiltering right
now. But it would be easy to expand the smtpprox do also add clamav.
Only problem you really have to monitor your mail load. So that you
do not run or set to strict timeouts. Because once in a while spamd
needs a little bit more time :) I guess one should use this feature
with some TCP rate limits to not get DOSed to easily.

cheers
--lars

--

»
Syndicate content