OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: smtpd_proxy_filter by size

From: C. Vorwerk (list-userbackenhoernchen.de)
Date: Tue Dec 04 2007 - 08:42:51 CST

Noel Jones schrieb:

> I don't think there is a good solution to your goal of scanning mail up
> to some size pre-queue and scan the rest post-queue.
>
I don't know so much about good. There are probably many opinions about
how to implement in a good way. I'd like to hear some.

I talkt to the clamsmtp mailing list. They said, that i might implement
this feature without many changes, just checking the size of the mail
after it recives it.
I will try that the next weeks.

> Running two clamd daemons and routing mail to the second one as a
> post-queue content_filter is the only way I can think of. While
> resource usage probably wouldn't be terrible, it is rather complex and
> awkward. This also requires some bit of glue so postfix can select a
> FILTER based on the size of the message. The SA plugin is one way,
> another way is a policy service that either uses PREPEND to add a
> X-Size: header or just returns a FILTER command itself.
>
> more info here might help:
> http://www.postfix.org/SMTPD_POLICY_README.html
> http://www.postfix.org/addon.html#policy
>

You are probably right about the resources in a large scale. As a
hosting service provider i would not wory about it either even with
onlinescanning 10 Mb mails. But when you are small and need to calculate
sharply about the costs, every Mb of your RAM is wourth a fortune even
it is cheap on the market.
By the way, i don't like the idea to run services twice without any
need. It complicates the configuration.

I will try to patch the clamsmtp with an max size and maybe an min size
option. Alternativly it writes an special trustworthy header with a salt
which can be identified by postix for further mappings.

Maybe you might explain to me why i get the feeling that you don't like
the idea of my configuration. I am open to other / better ideas.

Greets