Mailscanner + spamassassin + clamav package



  • no response means no problems  ;)



  • Is there a HOWTO for mailscanner in PFSense? I'm setting up an exchange server behind a PFSense firewall (both virtualized) and would like to use the PFSense VM to filter out some of the garbage before it makes it to the Exchange server. I've used SpamAssassin before, but never MailScanner, and it's been a loooonnnnggg time. :)

    I had considered running a separate Untangle VM until I saw this in the packages list.

    Thanks!
    Ben



  • The first combat is done in postfix package(more then 80% of spam is killed there).

    All mailscanner default options are in gui.

    Take a look.



  • Thanks. To be a little more clear in my question, what do I need to do from a prerequisit standpoint? Do I need to manually install a new version of perl? Do I need to install the Postfix package first? Or will the mailscanner-dev package do all this for me?

    Thanks,
    Ben



  • If you do not have any perl version installed on your box, just install postfix and then mailscanner.



  • @marcelloc:

    If you do not have any perl version installed on your box, just install postfix and then mailscanner.

    Perfect, thanks!

    EDIT
    Actually, I do have one further question. As this will be much more processor intensive than just routing traffic, what minimum specs would you recommend? I'm currently running it as a single chip single-core VM with 1G ram on an i7-920.
    I'm thinking this will be enough, but was considering upping it to a dual core to be safe.

    Thanks,
    Ben



  • It only depends on your mail traffic.

    I suggest you to read this topic about disc performance for a better setup

    http://forum.pfsense.org/index.php/topic,43737.msg226507.html#msg226507



  • @marcelloc:

    It only depends on your mail traffic.

    I suggest you to read this topic about disc performance for a better setup

    http://forum.pfsense.org/index.php/topic,43737.msg226507.html#msg226507

    Again, thanks. I will probably set up a RAMDisk for cache, since I've got 18GB in there and space for 24GB, should be a-plenty. :)

    Thanks,
    Ben



  • Hi,

    One final question. What if I have to run perl-5.12.4? I'm running in a VM and VMware Tools requires it. Can I have both installed?

    Thanks,
    Ben



  • Maybe it will not work, perl modules will be installed on 5.12 and mailscanner will look for it on 5.10.

    I'm trying to compile mailscanner latest version 4.83 in a vm with perl 5.12.

    If you can, wait some time until I finish these tests. Any mailscanner version change needs a full config check(500 options).

    If tests go fine, I'll publish package version 0.2



  • @marcelloc:

    Maybe it will not work, perl modules will be installed on 5.12 and mailscanner will look for it on 5.10.

    I'm trying to compile mailscanner latest version 4.83 in a vm with perl 5.12.

    If you can, wait some time until I finish these tests. Any mailscanner version change needs a full config check(500 options).

    If tests go fine, I'll publish package version 0.2

    Sounds good, thanks! I'm going to guess there is no "you must change these settings but can leave everything else default" list anywhere, is there? I've been reading over PostFix/mailscanner documentation but didn't know if there were any reccos.

    Thanks again,
    Ben



  • For now, you can check or fill all defaut options. This will generates a very good setup on postfix and mailscanner. Every filed has a default option or a config hint to help.

    As these packages are just helpers for sysadmins, I recommend reading postfix and mailscanner official docs/tutorials.

    I`m doing this to find usefull options to include in gui.

    It will take too long to rewrite postfix/mailscanner docs.

    Something sombody can do to help are some tutorials about configuring these services via gui.



  • @marcelloc:

    Something sombody can do to help are some tutorials about configuring these services via gui.

    I would be happy to take this on, I've done a number of tutorials previously. However, since I'm new to PostFix/MailScanner, I may have some questions on specific options to ensure I don't teach others the wrong way to do it :)

    Once I get everything set up with the new version, I'll post screenshots of my config if you don't mind, and if it's all good I'll do a video+text/image tutorial.

    Thanks,
    Ben



  • I would be happy to take this on, I've done a number of tutorials previously.

    Thanks, it will be really usefull.



  • mailscanner-dev v 4.83.5 pkg 0.1 is out.

    I'm working on gui now, to improve external checks (dcc, pyzor, etc..)

    you may need to uninstall old package and dependencies by hand. I did not tested upgrades.



  • @Fmstrat:

    @marcelloc:

    If you do not have any perl version installed on your box, just install postfix and then mailscanner.

    Perfect, thanks!

    EDIT
    Actually, I do have one further question. As this will be much more processor intensive than just routing traffic, what minimum specs would you recommend? I'm currently running it as a single chip single-core VM with 1G ram on an i7-920.
    I'm thinking this will be enough, but was considering upping it to a dual core to be safe.

    Thanks,
    Ben

    Keep in mind that it's recommended to give VMs a single processor unless you will absolutely need to add more for specific workloads. Adding extra processors to VMs can actually hurt performance because of the time it takes for the host to schedule two or more cores at once (and because of a few other considerations).



  • mailscanner-dev v 4.83.5 pkg 0.2 is out.

    Many tests and improvements on this version.

    upgrade from 0.1 needs first uninstall package and all dependencies.



  • Hello,

    I am testing your mailscanner package for personal purpose and i have several questions and some ideas.

    First about my topology i have one mail server stand alone and a pfsense running on a physical machine with postfix forwarder and mailscanner. Every mail that should end up in mail server, first arrive in pfsense box and mailscanner and clamav should search for spam and virus, then postfix forwarder send forward this message by relaying it to mail server.

    For now the simple part its working. Every message that arrive in pfsense box it's send to mail server. But i see no searching from mailscanner. Here is a part of system log:

    Dec 21 10:12:47 mx2 postfix/smtpd[20485]: connect from mail.domain.ro[xxx.xxx.xxx.xxx]
    Dec 21 10:12:47 mx2 postfix/smtpd[20485]: 34E6DEF5FB4: client=mail.domain.ro[xxx.xxx.xxx.xxx]
    Dec 21 10:12:47 mx2 postfix/cleanup[20858]: 34E6DEF5FB4: message-id=4EF194D9.5030404@domain.ro
    Dec 21 10:12:47 mx2 postfix/smtpd[20485]: disconnect from mail.domain.ro[xxx.xxx.xxx.xxx]
    Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: from=alexandru.munteanu@domain.ro, size=1350, nrcpt=1 (queue active)
    Dec 21 10:12:47 mx2 postfix/smtp[21058]: 34E6DEF5FB4: to=user@dom2.ro, relay=xxx.xxx.xxx.xxx[yyy.yyy.yyy.yyy]:25, delay=0.09, delays=0.01/0/0.04/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 4A02223BCC)
    Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: removed

    As you can see, there is no verification by anyone. Usually in linux, there is a part in log where you can see even clamav searching for virus.

    here are some commands and output:

    ps ax | grep -i mailscanner

    55907  ??  Is    0:00.02 MailScanner: master waiting for children, sleeping (perl5.12.4)
    56088  ??  S      0:00.20 MailScanner: waiting for messages (perl5.12.4)
    56228  ??  S      0:00.20 MailScanner: waiting for messages (perl5.12.4)
    56252  ??  S      0:00.11 MailScanner: waiting for messages (perl5.12.4)
    56349  ??  S      0:00.20 MailScanner: waiting for messages (perl5.12.4)

    Is there a way to se actually that the mail was scanned?

    Some ideas for mailscanner interface:

    Add a tab for quarantine where administrator could release some important mails that have been marked as spam
      Add a mailwatch interface for mailscanner.

    Thank you very much /user@dom2.ro/alexandru.munteanu@domain.ro



  • Go on postfix antispam tab and enable mailscanner integration.

    Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.



  • How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?



  • OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.



  • @marcelloc:

    Go on postfix antispam tab and enable mailscanner integration.

    Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.

    I have already selected "Third part Antispam Settings > Software > Mailscanner + Spamassassin + clamav" but still doesn't appear in logs that any message it's checked for spam/virus.

    I always download last version of i386 pc version, and even if i install postfix forwarder first or mailscanner first, i end up with errors that can't find some files or some errors in different config files etc. Usually i fix them step by step.

    Should i try amd64 version? Did you work more at that version then i386?

    Thank you very much. And you are doing a great job with this antispam filter, i hope soon it will be full functional.



  • Do you have this options on your current version?

    files.pfsense.org are offline, if you tried installing it today, that's why you found missing files.




  • @tojaktoty:

    How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?

    Take a look on features that postfix, mailscanner, spamassassin has to block spam.

    Here are some options you can configure:

    • spf lookup

    • anti zombie daemon

    • strong header verification

    • only process valid exchange recipients

    • Rbl checks before message body transfer

    • phishing scan

    • Bayes,ryzor,pyzor,dcc scans

    • acls to deny or reject messages based on headers, subject, body, attachments, etc

    • message content protection(mcp) features to protects company's data

    • web bugs message scan

    OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.

    I have no idea about microsoft antispam features. I use a unix server in front of exchange server for about 10 years.



  • @marcelloc:

    I have no idea about microsoft antispam features. I use a unix server in front of exchange server for about 10 years.

    likewise, actually close on 15 years now. The reason I mention this is because a fairly large hosted exchange environment required a unix layer to handle the spam as the MS portion was just not cutting it.



  • Hi all,

    version 0.2.1 of mailscanner is out.

    changes:

    • fix service status

    • fix missing dirs in clamav startup script

    • fix bug in mailscanner startup script



  • @marcelloc:

    Hi all,
    version 0.2.1 of mailscanner is out.

    I too am having problems with the current version ( 4.83.5 pkg v0.2),  the GUI does not reflect the newer version you have released,  where might i install this from using pkg?

    thanks,
    greg



  • There is a post from Jimp saying that there is problem on replication to production server.

    The solution is just wait.  :(



  • standing by..

    thanks!
    g



  • Its up again, try to upgrade the package and feedback  ;)



  • Try to load the package and all I get is

    Checking for package installation…
    Downloading http://e-sac.siteseguro.ws/pfsense/8/All/MailScanner-4.83.5.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/MailScanner-4.83.5.tbz.
    of MailScanner-4.83.5 failed!

    Regards

    Andrew



  • @andrew0401:

    Try to load the package and all I get is

    Checking for package installation…
    Downloading http://e-sac.siteseguro.ws/pfsense/8/All/MailScanner-4.83.5.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/MailScanner-4.83.5.tbz.
    of MailScanner-4.83.5 failed!

    Regards

    Andrew

    Hi Andrew,

    Can you try to browse this folder http://e-sac.siteseguro.ws/pfsense/8/All/

    I just reinstalled the package to test and it worked.



  • NO - tried IE & firefox

    Andrew



  • I'll check with my host provider and feedback



  • Unable to resolve e-sac.siteseguro.ws on a dns lookup.

    Regards

    Andrew



  • @andrew0401:

    Unable to resolve e-sac.siteseguro.ws on a dns lookup.

    I've tried access this url from many random web proxies and all listed site content.

    can you try changing you dns server to 8.8.8.8 (google)?



  • I got the page to view



  • We run pfblocker on the firewall - disabled it and the page appears - I wonder which list your site is on?

    Regards

    Andrew



  • Spoke too soon - yes I can see the page - but still unable to install the package - exact same fail message  "unable to download"

    Andrew



  • Tried to download the package manually - Clamd rejected access to the page?

    Andrew