OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
content filter help

From: Ben (benbenjamin.it)
Date: Wed Jun 27 2007 - 05:49:10 CDT


Hi,

I'm having trouble with a content filter (trying to add a disclaimer).
I'm not quite sure I fully understand the routing of emails within
postfix. This is what I have done to get it working, which I'd like to
change:

Setup two smtp processes in my master.conf, one for my internal users
(seeing that I only want outgoing mail to append the disclaimer) and one
on the public IP:

192.168.3.50:smtp inet n - n - - smtpd
  -o content_filter=disclaimer
202.111.222.333:smtp inet n - n - -
smtpd

disclaimer unix - n n - 10 pipe
  flags=Rq user=filter argv=/etc/postfix/disclaimer -f ${sender} --
${recipient}

Now, that works... but I don't like it. I can't disable the disclaimer
for certain outgoing emails. I would like to use header_checks instead
so I can do...
/^From:.*somedomain.com$/ FILTER disclaimer:whatever

But when I do that, I get a mail loop. The disclaimer script basically
modifies the mail then re-injects it back into postfix, which then
checks the headers and sends it back to the disclaimer, then it repeats
until it reaches maximum bounce.

What I would really like is to just have one smtp process and use
header_checks so it will then FILTER to the disclaimer on certain
emails. Well I don't mind having two smtp processes, just as long as I
can have the flexibility of choosing which emails get sent to the
content filter, and which get sent out as is.

What I think I need to do is setup an smtp process with -o
no_header_body_checks that listens on say port 10027 then I can have my
external disclaimer script send it through there and it won't loop.
Thing is, I'm not sure how to do that from a bash script. If that part
is figured out then I can use header_checks and also only have one smtp
process for incoming/outgoing mail, and another one for port 10027 for
re-injection from my disclaimer script. Am I on the right track?