Mailscanner + spamassassin + clamav package

marcelloc

If you do not have any perl version installed on your box, just install postfix and then mailscanner.

Fmstrat

If you do not have any perl version installed on your box, just install postfix and then mailscanner.

Perfect, thanks!

EDIT
Actually, I do have one further question. As this will be much more processor intensive than just routing traffic, what minimum specs would you recommend? I'm currently running it as a single chip single-core VM with 1G ram on an i7-920.
I'm thinking this will be enough, but was considering upping it to a dual core to be safe.

Thanks,
Ben

marcelloc

It only depends on your mail traffic.

I suggest you to read this topic about disc performance for a better setup

http://forum.pfsense.org/index.php/topic,43737.msg226507.html#msg226507

Fmstrat

@marcelloc:

It only depends on your mail traffic.

I suggest you to read this topic about disc performance for a better setup

http://forum.pfsense.org/index.php/topic,43737.msg226507.html#msg226507

Again, thanks. I will probably set up a RAMDisk for cache, since I've got 18GB in there and space for 24GB, should be a-plenty. :)

Thanks,
Ben

Fmstrat

Hi,

One final question. What if I have to run perl-5.12.4? I'm running in a VM and VMware Tools requires it. Can I have both installed?

Thanks,
Ben

marcelloc

Maybe it will not work, perl modules will be installed on 5.12 and mailscanner will look for it on 5.10.

I'm trying to compile mailscanner latest version 4.83 in a vm with perl 5.12.

If you can, wait some time until I finish these tests. Any mailscanner version change needs a full config check(500 options).

If tests go fine, I'll publish package version 0.2

Fmstrat

@marcelloc:

Maybe it will not work, perl modules will be installed on 5.12 and mailscanner will look for it on 5.10.

I'm trying to compile mailscanner latest version 4.83 in a vm with perl 5.12.

If you can, wait some time until I finish these tests. Any mailscanner version change needs a full config check(500 options).

If tests go fine, I'll publish package version 0.2

Sounds good, thanks! I'm going to guess there is no "you must change these settings but can leave everything else default" list anywhere, is there? I've been reading over PostFix/mailscanner documentation but didn't know if there were any reccos.

Thanks again,
Ben

marcelloc

For now, you can check or fill all defaut options. This will generates a very good setup on postfix and mailscanner. Every filed has a default option or a config hint to help.

As these packages are just helpers for sysadmins, I recommend reading postfix and mailscanner official docs/tutorials.

I`m doing this to find usefull options to include in gui.

It will take too long to rewrite postfix/mailscanner docs.

Something sombody can do to help are some tutorials about configuring these services via gui.

Fmstrat

@marcelloc:

Something sombody can do to help are some tutorials about configuring these services via gui.

I would be happy to take this on, I've done a number of tutorials previously. However, since I'm new to PostFix/MailScanner, I may have some questions on specific options to ensure I don't teach others the wrong way to do it :)

Once I get everything set up with the new version, I'll post screenshots of my config if you don't mind, and if it's all good I'll do a video+text/image tutorial.

Thanks,
Ben

marcelloc

I would be happy to take this on, I've done a number of tutorials previously.

Thanks, it will be really usefull.

marcelloc

mailscanner-dev v 4.83.5 pkg 0.1 is out.

I'm working on gui now, to improve external checks (dcc, pyzor, etc..)

you may need to uninstall old package and dependencies by hand. I did not tested upgrades.

Briantist

@Fmstrat:

@marcelloc:

If you do not have any perl version installed on your box, just install postfix and then mailscanner.

Perfect, thanks!

EDIT
Actually, I do have one further question. As this will be much more processor intensive than just routing traffic, what minimum specs would you recommend? I'm currently running it as a single chip single-core VM with 1G ram on an i7-920.
I'm thinking this will be enough, but was considering upping it to a dual core to be safe.

Thanks,
Ben

Keep in mind that it's recommended to give VMs a single processor unless you will absolutely need to add more for specific workloads. Adding extra processors to VMs can actually hurt performance because of the time it takes for the host to schedule two or more cores at once (and because of a few other considerations).

marcelloc

mailscanner-dev v 4.83.5 pkg 0.2 is out.

Many tests and improvements on this version.

upgrade from 0.1 needs first uninstall package and all dependencies.

alex_ipx

Hello,

I am testing your mailscanner package for personal purpose and i have several questions and some ideas.

First about my topology i have one mail server stand alone and a pfsense running on a physical machine with postfix forwarder and mailscanner. Every mail that should end up in mail server, first arrive in pfsense box and mailscanner and clamav should search for spam and virus, then postfix forwarder send forward this message by relaying it to mail server.

For now the simple part its working. Every message that arrive in pfsense box it's send to mail server. But i see no searching from mailscanner. Here is a part of system log:

Dec 21 10:12:47 mx2 postfix/smtpd[20485]: connect from mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/smtpd[20485]: 34E6DEF5FB4: client=mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/cleanup[20858]: 34E6DEF5FB4: message-id=4EF194D9.5030404@domain.ro
Dec 21 10:12:47 mx2 postfix/smtpd[20485]: disconnect from mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: from=alexandru.munteanu@domain.ro, size=1350, nrcpt=1 (queue active)
Dec 21 10:12:47 mx2 postfix/smtp[21058]: 34E6DEF5FB4: to=user@dom2.ro, relay=xxx.xxx.xxx.xxx[yyy.yyy.yyy.yyy]:25, delay=0.09, delays=0.01/0/0.04/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 4A02223BCC)
Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: removed

As you can see, there is no verification by anyone. Usually in linux, there is a part in log where you can see even clamav searching for virus.

here are some commands and output:

ps ax | grep -i mailscanner

55907 ?? Is 0:00.02 MailScanner: master waiting for children, sleeping (perl5.12.4)
56088 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)
56228 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)
56252 ?? S 0:00.11 MailScanner: waiting for messages (perl5.12.4)
56349 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)

Is there a way to se actually that the mail was scanned?

Some ideas for mailscanner interface:

Add a tab for quarantine where administrator could release some important mails that have been marked as spam
Add a mailwatch interface for mailscanner.

Thank you very much /user@dom2.ro /alexandru.munteanu@domain.ro

marcelloc

Go on postfix antispam tab and enable mailscanner integration.

Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.

tojaktoty

How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?

wagonza

OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.

alex_ipx

@marcelloc:

Go on postfix antispam tab and enable mailscanner integration.

Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.

I have already selected "Third part Antispam Settings > Software > Mailscanner + Spamassassin + clamav" but still doesn't appear in logs that any message it's checked for spam/virus.

I always download last version of i386 pc version, and even if i install postfix forwarder first or mailscanner first, i end up with errors that can't find some files or some errors in different config files etc. Usually i fix them step by step.

Should i try amd64 version? Did you work more at that version then i386?

Thank you very much. And you are doing a great job with this antispam filter, i hope soon it will be full functional.

marcelloc

Do you have this options on your current version?

files.pfsense.org are offline, if you tried installing it today, that's why you found missing files.

mailscanner_integration.png_thumb

marcelloc

@tojaktoty:

How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?

Take a look on features that postfix, mailscanner, spamassassin has to block spam.

Here are some options you can configure:

spf lookup
anti zombie daemon
strong header verification
only process valid exchange recipients
Rbl checks before message body transfer
phishing scan
Bayes,ryzor,pyzor,dcc scans
acls to deny or reject messages based on headers, subject, body, attachments, etc
message content protection(mcp) features to protects company's data
web bugs message scan

OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.

I have no idea about microsoft antispam features. I use a unix server in front of exchange server for about 10 years.