Re: [gentoo-user] clamav and spamassassin

[Pandu Poluan]

On Dec 4, 2011 5:58 AM, "Michael Orlitzky" <michael@××××××××.com> wrote:
>
> On 12/03/2011 02:52 PM, Grant wrote:
>>
>> I haven't set up any antivirus measures on my Gentoo systems so I
>> think I should.  Is clamav run as a scheduled filesystem scanner on
>> each system and as an email scanner on the mail server all that's
>> necessary?
>
>
> Nobody (as far as I know?) scans linux filesystems unless there's a legal
requirement or the files might wind up on a Windows box.
>
>
>
>> I'm currently greylisting email to prevent spam from getting through.
>> It catches a lot, but more and more gets through.  I'm not using any
>> mailfilters now and If I set up a clamav mailfilter I think I may as
>> well set up a spamassassin mailfilter to take the place of
>> greylisting.  Is this the best guide for clamav and spamassassin:
>
>
> SpamAssassin shouldn't take the place of greylisting; they reject
different stuff. Keep the greylisting unless the delays bother you, but use
postscreen to do it (see below).
>
>
>
>> http://www.gentoo.org/doc/en/mailfilter-guide.xml
>>
>> Could I run into any problems with clamav or spamassassin that might
>> make we wish I hadn't implemented them?
>
>
> Yeah. The first is false positives. The second, related problem is that
you'll have to manage a quarantine unless you stick amavisd-new in front of
the postfix queue.
>
> It's in that respect that the tutorial is outdated; otherwise, it looks
good (I just skimmed it).
>
> There is great benefit to the before-queue setup: mail will never
disappear. Senders either get a rejection, or the mail is delivered. With
the after-queue setup, you can no longer reject or else you'll be
backscattering. So, you either deliver the spam, or you quarantine it (very
bad if it's a false positive).
>
> The downside is that you use more resources: one amavisd-new per
connection. However, the addition of postscreen to postfix has largely
ameliorated this. Since postscreen rejects most of the junk, amavis only
gets started for smtpd sessions that are likely to succeed.
>
> The easiest way to migrate is through incremental improvement. We used to
use a system like the one in that guide. I enabled postscreen over the
course of a week, and retired postgrey, which we had been using for
greylisting. Once that was working properly, I simply dropped the
content_filter in favor of smtpd_proxy_filter to move amavis in front of
the queue.
>

This is new information to me. If you're subscribed to Gentoo-server,
you'll know that I am in the process of setting up a mailfiltering gateway
for my company.

Any resources on this "postscreen" facility? sounds like a very nice thing
to implement.

Rgds,