| 1 |
On 12/03/2011 02:52 PM, Grant wrote: |
| 2 |
> I haven't set up any antivirus measures on my Gentoo systems so I |
| 3 |
> think I should. Is clamav run as a scheduled filesystem scanner on |
| 4 |
> each system and as an email scanner on the mail server all that's |
| 5 |
> necessary? |
| 6 |
|
| 7 |
Nobody (as far as I know?) scans linux filesystems unless there's a |
| 8 |
legal requirement or the files might wind up on a Windows box. |
| 9 |
|
| 10 |
|
| 11 |
> I'm currently greylisting email to prevent spam from getting through. |
| 12 |
> It catches a lot, but more and more gets through. I'm not using any |
| 13 |
> mailfilters now and If I set up a clamav mailfilter I think I may as |
| 14 |
> well set up a spamassassin mailfilter to take the place of |
| 15 |
> greylisting. Is this the best guide for clamav and spamassassin: |
| 16 |
|
| 17 |
SpamAssassin shouldn't take the place of greylisting; they reject |
| 18 |
different stuff. Keep the greylisting unless the delays bother you, but |
| 19 |
use postscreen to do it (see below). |
| 20 |
|
| 21 |
|
| 22 |
> http://www.gentoo.org/doc/en/mailfilter-guide.xml |
| 23 |
> |
| 24 |
> Could I run into any problems with clamav or spamassassin that might |
| 25 |
> make we wish I hadn't implemented them? |
| 26 |
|
| 27 |
Yeah. The first is false positives. The second, related problem is that |
| 28 |
you'll have to manage a quarantine unless you stick amavisd-new in front |
| 29 |
of the postfix queue. |
| 30 |
|
| 31 |
It's in that respect that the tutorial is outdated; otherwise, it looks |
| 32 |
good (I just skimmed it). |
| 33 |
|
| 34 |
There is great benefit to the before-queue setup: mail will never |
| 35 |
disappear. Senders either get a rejection, or the mail is delivered. |
| 36 |
With the after-queue setup, you can no longer reject or else you'll be |
| 37 |
backscattering. So, you either deliver the spam, or you quarantine it |
| 38 |
(very bad if it's a false positive). |
| 39 |
|
| 40 |
The downside is that you use more resources: one amavisd-new per |
| 41 |
connection. However, the addition of postscreen to postfix has largely |
| 42 |
ameliorated this. Since postscreen rejects most of the junk, amavis only |
| 43 |
gets started for smtpd sessions that are likely to succeed. |
| 44 |
|
| 45 |
The easiest way to migrate is through incremental improvement. We used |
| 46 |
to use a system like the one in that guide. I enabled postscreen over |
| 47 |
the course of a week, and retired postgrey, which we had been using for |
| 48 |
greylisting. Once that was working properly, I simply dropped the |
| 49 |
content_filter in favor of smtpd_proxy_filter to move amavis in front of |
| 50 |
the queue. |
Archives