Spam Vigilante - Mail Filter Virtual Appliance

[VMTN_Admin]

http://www.vmware.com/vmtn/appliances/directory/255

A mail proxy based on FreeBSD with spam (SpamAssassin) and virus (ClamAV) scanning. Can be used with any existing mail system.

[telackey]

Wich config files must be changed form Spam

Configuration change from D_PASS to D_DISCARD.

I have already changed /usr/local/etc/amavisd.conf ,

restarted the Machine and still it does D_PASS intead

or D_DISCARD

Thanks,

Likely you need to reset $sa_kill_level_deflt. When using D_PASS through setup, it sets the kill level insanely high (1000) on purpose to avoid quarantining spam, as D_PASS alone doesn't do that. Now it has been placed in reverse. It would discard the message but none are good enough (or bad eniugh, depending on one's view) to trigger it.

The default value when using D_DISCARD, at least when configured by setup, is to use the same as $sa_tag2_level_deflt, 6.31.

[telackey]

What to do ? restarting Apache the gives an error on

the below:

/var/log$ apachectl restart

Syntax error on line 3 of

/usr/local/etc/apache2/Includes/spamviewer.conf:

Invalid command 'SSLRequireSSL', perhaps mis-spelled

or defined by a module not included in the server

configuration

I can't answer the first part, but for the second; that is not how Apache needs restarted. FreeBSD treats non-SSL and SSL Apache a bit differently, and they are separately toggled. Anyway, the upshot of that is, one needs to restart it with its rc.d script:

/usr/local/etc/rc.d/apache2.sh \[start|stop|restart]

If you use that one, you won't get that error.

[R_van_Gijn]

Thanks, its an weird error, but does not stop SV scanning, just does not give any info.

On the update part, and for reference to others (just as new to freebsd as me), the following sequence of commands updates your ClamAV, and can be used for some others as well. (but be ware of config issues, so ALWAYS make a snapshot in VMware first.

See http://www.freebsd.org/doc/ for more, look at portsystem chapters.

\# cvsup -L 2 -h cvsup.FreeBSD.org /usr/share/examples/cvsup/ports-supfile

\# cd /usr/ports/sysutils/portupgrade

\# make (Takes a long, long time over >10 hours on my SpamVig. setup, no idea why, and the VM needs memory for this)

\# make install

\# make clean

\# portupgrade (will rebuild pkg database)

\# portupgrade -R clamav (when promted select defaults)

Done, restart, clam AV is now up to date (warning is gone). Maybe this is overkill, but worked so far over here, and clamav is now 0.88.6

[myot]

Yes, but after you have to look on spamviewer problems....

[R_van_Gijn]

Tested the spamviewer application and it works OK, all msg seem te get scanned, and all functionality seems to be working.

(but i only updated clamav, not anything else)

Can you be more specific Myot ?

[myot]

I do a portupgrade for all packages. and after i encountered the problem with "permission denied" on spamviewer (mentionned above and a full pkg_infor).

If you need something more tell me know

[LFE]

small question here:

I ran a SV setup a few days ago, and set it up as smtp server to work with my exchange server. Everything was ok and working fine,

(except for the clamav outdated warning, still got to update that one)

But now I made a new user in exchange, an when I sent mail to SV

It gives a reply " Recipient address rejected: User unknown in relay recipient table"

I looked in /usr/local/etc/postfix/exchange_recipient and saw the new email adress was not added.

After a day waiting I did a new configuration, in the hope SV would rebuild its list, but it did not do the trick.

Is there someway to force the rebuild of the recipients list so that my new users will also be able to recieve mail?

thanx in advance

-edit- Found the sollution

the SV did not auto-update because in the configuration the LDAP server was set as : name instead of name.domain.local.

since I ran the tests searchldap.... at name.domain.local I (wrongfully) concluded that that the connectivity was ok.

Message was edited by:

LFE

[kasala]

OK. I'm a bit slow in the linux world so perhaps someone can help me with this. I've got this working great (awesome product by the way!) but I would like to tell my exchange server to use Spam Vigilante as it's outbound server (which I believe I can do by changing my smarthost in my smtp server on Exchange) but I need spam vigilante to send the mail through my smarthost. If this doesn't make any sense let me know but if someone has some ideas and can walk me through making this happen that would be awesome!

Thanks-Matt

[R_van_Gijn]

Small addition to my quick list for updating clamav.

Myot did have a point, after the update go to "/var/db" and make the directory clamav and it contents writable.

Look in /var/log/clamav for the logs, and after a day or so yoy can see if all is updating as it should.

[R_van_Gijn]

Think you should look into the relay and transport mappings to set this up, tons of docs on that for postfix.

[telackey]

Think you should look into the relay and transport

mappings to set this up, tons of docs on that for

postfix.

Yes, this was just a little tricky to figure out the right settings, as I didn't actually want the possibly multi-valued LDAP, and not-SMTP specific results that Postfix would get back from its query on proxyAddresses, I wanted the original request string, eg, person@place.com. It is not too fancy, but out of context, that may not make too much sense if one doesn't have some background on the workings of Exchange and Postfix both. I won't go into the details, but I have put together the settings I would need, and am looking at that for the future. The relay recipients map would then be real-time.

Edit:

I may have misunderstood the original context of that post. I am talking about recipient maps here. I'll leave me reply though, as it portends some coming updates.

[telackey]

But now I made a new user in exchange, an when I sent

mail to SV

It gives a reply " Recipient address rejected: User

unknown in relay recipient table"

Yes, this is a bit of a problem. Right now, the best way to kick it is to run:

/etc/periodic/daily/474.m-postfix-accounts

It is good to run that directly after making a new account, if it needs to be timely.

I just posted something of what will probably be done in the future as a reply to a different post, that will cause this to be real-time instead of synchronized as it is now, and also fix some limitations that those with very large user bases (>10000) will encounter with the current method.

[telackey]

OK. I'm a bit slow in the linux world so perhaps

someone can help me with this. I've got this working

great (awesome product by the way!) but I would like

to tell my exchange server to use Spam Vigilante as

it's outbound server (which I believe I can do by

changing my smarthost in my smtp server on Exchange)

but I need spam vigilante to send the mail through my

smarthost. If this doesn't make any sense let me

know but if someone has some ideas and can walk me

through making this happen that would be awesome!

Thanks-Matt

Taking in mind I have not done this, all you should need to do is:

1. Back up you conf (just in case) with /usr/local/sbin/backup_conf .

2. Make sure the Exchange can contact the Postfix server over SMTP. There is a 99% chance here you won't need to make any changes, but it is important to check in /usr/local/etc/postfix/main.cf the value of either mynetworks, if you set up the subnets manually during setup, or mynetworks_style if you went with the defaults. Usually you'll have "mynetworks_style = subnet" if you went with the default SMTP setup, and if your Exchange server is on the same subnet, you won't need to make any other changes. If it isn't you'll need to set mynetworks by hand. The comments in main.cf show how to do that.

3. Search for "relayhost" in main.cf and enter a new line like:

relayhost = \[my.smarthost.com]

4. Restart Postfix.

That should be it and you'll be ready to test it. If it works, go ahead and backup your config again.

Hope that helps.

[purduecjs]

If you can just delay the response of your mail

server by a few seconds ( 4-5 seems plenty )

I have been doing that for a long time with Kerio

MailServer 6, and Vamsoft Open Relay Filter for

Exchange. It stops alot of spam, and completely

prevents directory harvesting. I would love to

see

this feature for SV.

This is a very interesting idea, and a technique I

have never heard of before. I am very interested in

it, do you know how this might be done with

Postfix/Amavis?

Did anyone ever figure out how to do this? spamd seems to have built-in options for this, but I'd hate to setup yet another VM just to handle this functionality .... any ideas other than resorting to postgrey? Thanks!!!

[netmavrik]

If you can just delay the response of your

mail

server by a few seconds ( 4-5 seems plenty )

I have been doing that for a long time with

Kerio

MailServer 6, and Vamsoft Open Relay Filter for

Exchange. It stops alot of spam, and completely

prevents directory harvesting. I would love to

see

this feature for SV.

This is a very interesting idea, and a technique I

have never heard of before. I am very interested

in

it, do you know how this might be done with

Postfix/Amavis?

Did anyone ever figure out how to do this? spamd

seems to have built-in options for this, but I'd hate

to setup yet another VM just to handle this

functionality .... any ideas other than resorting to

postgrey? Thanks!!!

Postfix will do this, and much more actually, but only if Amavis/SA are configured to use Content Filter mode, and not the Proxy mode like SV is currently using.

I didn't feel comfortable making the necessary changes to SV to switch to Content Filter mode, so I am now using another setup which does.

Postfix also supports Recipient Address Verification without having to setup LDAP or a file hash. I have found this to be very useful as well.

I won't go into detail about the differences between Content Filter and Proxy Filter, but you should definately research it.

I am in no way bashing Teleaky or SV. Without this appliance, I never would have discovered how powerful FreeBSD and SpamAssassin are.

Thanks again.

[sdaeme]

Is there also a Spam Vigilante virtual machine for VMware ESx 3.

Or how can I convert this virtual machine, vmconverter doesn't work.

Who can make me happy with this.

[telackey]

Is there also a Spam Vigilante virtual machine for

VMware ESx 3.

Or how can I convert this virtual machine,

vmconverter doesn't work.

Who can make me happy with this.

The conversion can't work, because that specific release of FreeBSD has a problem with its SCSI support.

The current plan is to release an SV refresh package sometime in the not very distant future that includes the latest software, patches, etc., and is also installed on all SCSI in order to support ESX.

[sdaeme]

that would be great.

Do you have a time indication when I can expect SV

[telackey]

that would be great.

Do you have a time indication when I can expect SV

I don't want to make a promise of it, but my goal is around the first of the year. In any case "not very long," would fit as an answer.

[myot]

Transcript of session follows.

Out: 220 spam.xxx.tm.fr ESMTP Postfix

In: EHLO mailrelay.mail.easynet.fr

Out: 250-spam.xxx.tm.fr

Out: 250-PIPELINING

Out: 250-SIZE 10240000

Out: 250-VRFY

Out: 250-ETRN

Out: 250-ENHANCEDSTATUSCODES

Out: 250-8BITMIME

Out: 250 DSN

In: MAIL FROM:

Out: 451 4.3.0 Error: queue file write error

In: QUIT

Out: 221 2.0.0 Bye

This problems repeat some times per week. Do you have any idea how to resolve it ?