ESVA 1.5.1

[andy_mac]

This is the latest version of my Email Security Virtual Appliance.

http://www.vmware.com/vmtn/appliances/directory/542

If anyone has any idea how to get this onto the VMware torrent tracker, please let me know...

In the meantime it's available by http download from

http://www.global-domination.org/ESVA/15/

FAQs and instructions are also available from the above address. If you have any experiences you would like to share, please do so in this forum.

Andy

[daliusm]

Andy,

Thanks for great job! i set ESVA in 30 min for multiple domains, works fine.

Now question: is it posible to quarantine banned files (i added all possible multimedia filetypes to /etc/MailScaner/filename.rules.conf) ? Sometimes i need to relay multimedia files to recipiens if there are business mails.

Regards,

Dalius

[ebaldwin]

Andy,

AWESOME product. Thanks for taking your time to help me out with my own bone headed mistakes and impatience. Your product works just like it is supposed to right out of the box with only minor config changes needed.

Again, it is an AWESOME product!!!

Ed

[andy_mac]

Hi daliusm,

Good to hear you have it running sucessfully!

There are a couple of issues with what you are wanting to do:

1. The Quarantine feature works just fine, but releasing messages from it is a bit of a nightmare - I recommend you substitute the "store" parameter with "notify forward quarantine@your.domain" and setup a mailbox with that address.

2. Banning filetypes is easy - as you have discovered, quarantining them might take some imagination... I'll have to think about that one!

Andy

[andy_mac]

Cheers Ed,

It's always nice to get messages like that! - Good for the ego!

Andy

[phoenixsecure]

Deleted, found answer

Message was edited by:

phoenixsecure

[brithd]

Webmin isn't a big fan of special characters (@ causes problems and I think spaces do too...)

hth

[brithd]

From the esva 1.5 FAQ page on global-domination.org:

Frequently Asked Questions

I can't see any quarantined messages in the clamav webmin applet

This is due to an incompatibility between the applet and the way that MailScanner stores messages in the quarantine folder. I am working on finding a fix for this. As a workaround I suggest that you change the Spam Actions parameter in /etc/MailScanner/MailScanner.conf to

notify forward spam-mailbox@yourdomain.tld

or

deliver header "X-Spam-Status: Yes"

How does the address verification feature work?

This is a feature of Postfix. In a nutshell, postfix will attempt to verify the recipient addresses in incoming messages against the downstream MTA (Mail Server). You can read more about how this works here.(http://www.postfix.org/ADDRESS_VERIFICATION_README.html)

I can login to the console, but not to the Webmin interface - What's wrong?

This could be due to the fact that Webmin doesn't like special characters in the password (I've had reports of passwords containing @ not working). Try resetting your password using different characters in the console. I'm afraid that I can't do much abou this one as I don't develop the Webmin software - I just bundle it in with ESVA...

My mailserver won't validate any recipient addresses, so ESVA rejects all my mail - how do I fix this?

You can read more about how ESVA validates addresses here. (http://www.postfix.org/ADDRESS_VERIFICATION_README.html)

You have two options:

\- Configure your downstream mail server to allow this functionality

or

\- Tell ESVA not to validate by editing the main.cf file:

-Find the line in main.cf ( https://youresvaserver/postfix/manual.cgi )

\- Remove the reject_unverified_recipient parameter from smtpd_recipient_restrictions

\- save the file

-restart mailscanner (from the commandline on the console or in an ssh session type service MailSacnner restart)

I want ESVA to check mail for multiple domains - Is this possible? How do I set this up?

Absolutely.

You will need to do three things (pretty much the same as for a single domain really):

\- Make sure there is an A and an MX record for each domain pointing at the ESVA public address (hopefully your NAT firewall!!!)

\- Tell ESVA which domains it should relay for in main.cf - e.g. relay_domains = $mydomain, global-domination.eu, global-domination.co.uk

\- Configure your \_internal_ DNS (this is the one that ESVA is configured to reference) with zones matching the relay domains with apropriate A and MX records for the target domains. Don't forget to make sure that your DNS server is configured to forward requests that it can't answer itself!!! (Most MS DNS servers don't need to be told to do this - they will do it automatically, as long as they have a route to the internet)

If this is v1.5.1 (Cragieburn), why does the console think it's v2.5.2 (Temple Basin)?

Ummmm.... because it \_IS_ version 2.5.2, and I had brain-fade when I zipped it up, uploaded it, created the web pages, vmtn forum...

I'm working on a slightly tweaked version now and that will be an upgrade package you will install to 1.5.1/1.5.2. I don't know what the version number will be yet because I haven't finished yet.

[Harv]

Great Appliance, Thanks.

I've configured it to not only accept email for multiple domains as you describe but also deliver to the correct downstream SMTP relay for each domain.

in Postfix using the Transport Mapping to replace relayhost in main.cf

Name+++++++++++++++++Maps To...

somedomain.com+++++++++smtp:192.168.0.100

anotherdomain.co.uk+++++++smtp:\[smtp.anotherdomain.co.uk]

Note the use of [] this stops Postfix doing a proper MX lookup as this will fail as you only want one MX server for the domain, the one running ESVA.

Just looking to do the same type of thing for relay_domain in the main.cf then admin is sorted! as currently I have to add each domain I want to allow relay to this variable.

Message was edited by:

Harv

[Harv]

mailwatch for mailscanner might be the answer to managing quarentined mail.

[andy_mac]

Yes - I am working on that right now for v1.6.

Unfortunately this will make ESVA a bit more of a heavyweight in terms of download size and memory consumption, but will be much better functionally. I'm also adding a few other bits. Once I have a prototype working I'll post some screenshots

-Andy

[johnno72]

just a quick question re dns forward and reverse lookup. how would you setup esva in the following scenario:

sbs server 2003 with 2 nic.

nic 1 : 10.0.0.2 connected to router

nic 2 : 192.168.0.1 connected to internal network

nic 1 dns server 192.168.0.1

dns ?

ip config of esva pointing towards internal or external ip ?

regards

johnno

[andy_mac]

Hi Johnno,

The logical nic to bind vmnet0 to would be nic1

For DNS, the internal DNS would probably be better, assuming that ESVA can contact it from the 10 (DMZ) network - if not it's not the end of the world - you just need to configure main.cf as per the readme - especially the hostame, domain and relayhost (obviously this will be relayhost = \[10.0.0.2] )parameters.

Make sure that ESVA can resolve internet addresses before you redirect the SMTP traffic to ESVA, as it won't be able to validate sending domains, check blacklists etc...

hth

-Andy

[emporio]

Great Appliance,

i installed it yesterday with following "read me file", so far its working perfectly.

in last 18 hours I haven't recieve any spam, not sure if i missed any legimit email, hope not

thx again this is great appliance

[emporio]

I was wondering: does ESVA has reporting feature.

like many emails very rejected in a month or 2 weeks, how much of total emails, than spam vs regular email?

thx

[andy_mac]

There isn't currently any reporting beyond the daily logwatch report that is mailed to root at 4:02 am each day - this has a summary of postfix and mailscanner actions in it - among other useful stuff (if you want this sent to you, modify the aliases file.)

This kind of reporting will be in v 1.6, which I am working on at the moment

-Andy

[andy_mac]

[forward1]

Hi!

I've added/installed webminstats http://webminstats.sourceforge.net/ for reporting.

I haven't done any customization so I don't see how many any e-mails were rejected and/or were spam. I am doing some reading to get more detailed MTA statistics.

Message was edited by:

forward1

All I needed to do was to upgrade mailq module to mailq-0.11.4 and it looks fine now.

[emporio]

I got it thx, couldn't ask for more .

[emporio]

as you can tell...i am linux rookie, newbie ....can you tell me how i can update that module. I've download it, and untar it to temp folder but i am afraid to mess up something?

thx