Mailscanner + spamassassin + clamav package

Fmstrat

Is there a HOWTO for mailscanner in PFSense? I'm setting up an exchange server behind a PFSense firewall (both virtualized) and would like to use the PFSense VM to filter out some of the garbage before it makes it to the Exchange server. I've used SpamAssassin before, but never MailScanner, and it's been a loooonnnnggg time. :)

I had considered running a separate Untangle VM until I saw this in the packages list.

Thanks!
Ben

marcelloc

The first combat is done in postfix package(more then 80% of spam is killed there).

All mailscanner default options are in gui.

Take a look.

Fmstrat

Thanks. To be a little more clear in my question, what do I need to do from a prerequisit standpoint? Do I need to manually install a new version of perl? Do I need to install the Postfix package first? Or will the mailscanner-dev package do all this for me?

Thanks,
Ben

marcelloc

If you do not have any perl version installed on your box, just install postfix and then mailscanner.

Fmstrat

@marcelloc:

If you do not have any perl version installed on your box, just install postfix and then mailscanner.

Perfect, thanks!

EDIT
Actually, I do have one further question. As this will be much more processor intensive than just routing traffic, what minimum specs would you recommend? I'm currently running it as a single chip single-core VM with 1G ram on an i7-920.
I'm thinking this will be enough, but was considering upping it to a dual core to be safe.

Thanks,
Ben

marcelloc

It only depends on your mail traffic.

I suggest you to read this topic about disc performance for a better setup

http://forum.pfsense.org/index.php/topic,43737.msg226507.html#msg226507

Fmstrat

@marcelloc:

It only depends on your mail traffic.

I suggest you to read this topic about disc performance for a better setup

http://forum.pfsense.org/index.php/topic,43737.msg226507.html#msg226507

Again, thanks. I will probably set up a RAMDisk for cache, since I've got 18GB in there and space for 24GB, should be a-plenty. :)

Thanks,
Ben

Fmstrat

Hi,

One final question. What if I have to run perl-5.12.4? I'm running in a VM and VMware Tools requires it. Can I have both installed?

Thanks,
Ben

marcelloc

Maybe it will not work, perl modules will be installed on 5.12 and mailscanner will look for it on 5.10.

I'm trying to compile mailscanner latest version 4.83 in a vm with perl 5.12.

If you can, wait some time until I finish these tests. Any mailscanner version change needs a full config check(500 options).

If tests go fine, I'll publish package version 0.2

Fmstrat

@marcelloc:

Maybe it will not work, perl modules will be installed on 5.12 and mailscanner will look for it on 5.10.

I'm trying to compile mailscanner latest version 4.83 in a vm with perl 5.12.

If you can, wait some time until I finish these tests. Any mailscanner version change needs a full config check(500 options).

If tests go fine, I'll publish package version 0.2

Sounds good, thanks! I'm going to guess there is no "you must change these settings but can leave everything else default" list anywhere, is there? I've been reading over PostFix/mailscanner documentation but didn't know if there were any reccos.

Thanks again,
Ben

marcelloc

For now, you can check or fill all defaut options. This will generates a very good setup on postfix and mailscanner. Every filed has a default option or a config hint to help.

As these packages are just helpers for sysadmins, I recommend reading postfix and mailscanner official docs/tutorials.

I`m doing this to find usefull options to include in gui.

It will take too long to rewrite postfix/mailscanner docs.

Something sombody can do to help are some tutorials about configuring these services via gui.

Fmstrat

@marcelloc:

Something sombody can do to help are some tutorials about configuring these services via gui.

I would be happy to take this on, I've done a number of tutorials previously. However, since I'm new to PostFix/MailScanner, I may have some questions on specific options to ensure I don't teach others the wrong way to do it :)

Once I get everything set up with the new version, I'll post screenshots of my config if you don't mind, and if it's all good I'll do a video+text/image tutorial.

Thanks,
Ben

marcelloc

I would be happy to take this on, I've done a number of tutorials previously.

Thanks, it will be really usefull.

marcelloc

mailscanner-dev v 4.83.5 pkg 0.1 is out.

I'm working on gui now, to improve external checks (dcc, pyzor, etc..)

you may need to uninstall old package and dependencies by hand. I did not tested upgrades.

Briantist

@Fmstrat:

@marcelloc:

If you do not have any perl version installed on your box, just install postfix and then mailscanner.

Perfect, thanks!

EDIT
Actually, I do have one further question. As this will be much more processor intensive than just routing traffic, what minimum specs would you recommend? I'm currently running it as a single chip single-core VM with 1G ram on an i7-920.
I'm thinking this will be enough, but was considering upping it to a dual core to be safe.

Thanks,
Ben

Keep in mind that it's recommended to give VMs a single processor unless you will absolutely need to add more for specific workloads. Adding extra processors to VMs can actually hurt performance because of the time it takes for the host to schedule two or more cores at once (and because of a few other considerations).

marcelloc

mailscanner-dev v 4.83.5 pkg 0.2 is out.

Many tests and improvements on this version.

upgrade from 0.1 needs first uninstall package and all dependencies.

alex_ipx

Hello,

I am testing your mailscanner package for personal purpose and i have several questions and some ideas.

First about my topology i have one mail server stand alone and a pfsense running on a physical machine with postfix forwarder and mailscanner. Every mail that should end up in mail server, first arrive in pfsense box and mailscanner and clamav should search for spam and virus, then postfix forwarder send forward this message by relaying it to mail server.

For now the simple part its working. Every message that arrive in pfsense box it's send to mail server. But i see no searching from mailscanner. Here is a part of system log:

Dec 21 10:12:47 mx2 postfix/smtpd[20485]: connect from mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/smtpd[20485]: 34E6DEF5FB4: client=mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/cleanup[20858]: 34E6DEF5FB4: message-id=4EF194D9.5030404@domain.ro
Dec 21 10:12:47 mx2 postfix/smtpd[20485]: disconnect from mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: from=alexandru.munteanu@domain.ro, size=1350, nrcpt=1 (queue active)
Dec 21 10:12:47 mx2 postfix/smtp[21058]: 34E6DEF5FB4: to=user@dom2.ro, relay=xxx.xxx.xxx.xxx[yyy.yyy.yyy.yyy]:25, delay=0.09, delays=0.01/0/0.04/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 4A02223BCC)
Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: removed

As you can see, there is no verification by anyone. Usually in linux, there is a part in log where you can see even clamav searching for virus.

here are some commands and output:

ps ax | grep -i mailscanner

55907 ?? Is 0:00.02 MailScanner: master waiting for children, sleeping (perl5.12.4)
56088 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)
56228 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)
56252 ?? S 0:00.11 MailScanner: waiting for messages (perl5.12.4)
56349 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)

Is there a way to se actually that the mail was scanned?

Some ideas for mailscanner interface:

Add a tab for quarantine where administrator could release some important mails that have been marked as spam
Add a mailwatch interface for mailscanner.

Thank you very much /user@dom2.ro /alexandru.munteanu@domain.ro

marcelloc

Go on postfix antispam tab and enable mailscanner integration.

Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.

tojaktoty

How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?

wagonza

OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.