OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Todd Lyons (toddmrball.net)
Date: Mon Jan 14 2002 - 23:03:57 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Tzafrir Cohen wanted us to know:

    >3. At delivery
    > Using procmail or whatever.
    > This is easy to implement if procmail is used (although there are
    > problems of user vs. system settings).

    This the way that amavis integrates into qmail. The end result is it
    looks like this:
    [rootMercury bin]# vdir qmail-lo* qmail-rem*
    lrwxrwxrwx 1 root root 19 Nov 15 13:14 qmail-local -> /usr/sbin/scanmails
    -rwx--x--x 1 root qmail 49956 Jun 29 2001 qmail-local-real
    lrwxrwxrwx 1 root root 19 Nov 15 13:14 qmail-remote -> /usr/sbin/scanmails
    -rwx--x--x 1 root qmail 32084 Jun 29 2001 qmail-remote-real

    And essentially scanmails calls 'qmail-{local|remote}-real $' once it
    passes the checks of the virus scanner.

    The first time I ever saw this was Vincent's implemntation (on the very
    server I'm pasting from) so I can't claim any credit here :) Applaud
    your listadmin, please.

    > Disatvantages:
    > - not scanning outgoing mail
    > - If a message is delivered to multiple users, it will be scanned
    > multiple times (not a big deal with such a simple filter)

    Right on both counts. You oughta see what happens to the load average
    if you have your concurrency set to 90 and you deliver a message to
    about 650 users simultaneously. :-/ I reset the concurrency down to
    default by deleting the concurrency* files after that one.

    -- 
    Blue skies...		Todd
    | Get a bigger hammer!   |  All vendors suck, but different ones  |
    | http://www.mrball.net  |  suck less in different applications.  |
    | http://faq.mrball.net  |                --Andy Walden on NANOG  |
    

    For help, email discuss-helpmandrakesecure.net; to unsubscribe send a message to discuss-unsubscribemandrakesecure.net. To visit MandrakeSecure, go to http://www.mandrakesecure.net/.