1 |
>> I haven't set up any antivirus measures on my Gentoo systems so I |
2 |
>> think I should. Is clamav run as a scheduled filesystem scanner on |
3 |
>> each system and as an email scanner on the mail server all that's |
4 |
>> necessary? |
5 |
> |
6 |
> |
7 |
> Nobody (as far as I know?) scans linux filesystems unless there's a legal |
8 |
> requirement or the files might wind up on a Windows box. |
9 |
|
10 |
Very cool. I found out clamscan and avgfree scan the filesystem so I |
11 |
thought I should set it up, but if it's not necessary I won't bother. |
12 |
All of my mail users are on Gentoo so do I need to bother having |
13 |
clamav scan my incoming mail? |
14 |
|
15 |
>> I'm currently greylisting email to prevent spam from getting through. |
16 |
>> It catches a lot, but more and more gets through. I'm not using any |
17 |
>> mailfilters now and If I set up a clamav mailfilter I think I may as |
18 |
>> well set up a spamassassin mailfilter to take the place of |
19 |
>> greylisting. Is this the best guide for clamav and spamassassin: |
20 |
> |
21 |
> |
22 |
> SpamAssassin shouldn't take the place of greylisting; they reject different |
23 |
> stuff. Keep the greylisting unless the delays bother you, but use postscreen |
24 |
> to do it (see below). |
25 |
|
26 |
I just did some reading on postscreen but it doesn't sound like a |
27 |
greylister. Should I use postscreen in addition to postgrey, or are |
28 |
they substitutes for each other? |
29 |
|
30 |
>> http://www.gentoo.org/doc/en/mailfilter-guide.xml |
31 |
>> |
32 |
>> Could I run into any problems with clamav or spamassassin that might |
33 |
>> make we wish I hadn't implemented them? |
34 |
> |
35 |
> |
36 |
> Yeah. The first is false positives. The second, related problem is that |
37 |
> you'll have to manage a quarantine unless you stick amavisd-new in front of |
38 |
> the postfix queue. |
39 |
|
40 |
Now that sounds like a hassle. Greylisting leaves me with about 50/50 |
41 |
spam/legit mail and maybe incorporating postscreen I'll do even |
42 |
better. Deleting spam in my inbox might be easier than dealing with |
43 |
false positives and managing a quarantine. |
44 |
|
45 |
- Grant |
46 |
|
47 |
|
48 |
> It's in that respect that the tutorial is outdated; otherwise, it looks good |
49 |
> (I just skimmed it). |
50 |
> |
51 |
> There is great benefit to the before-queue setup: mail will never disappear. |
52 |
> Senders either get a rejection, or the mail is delivered. With the |
53 |
> after-queue setup, you can no longer reject or else you'll be |
54 |
> backscattering. So, you either deliver the spam, or you quarantine it (very |
55 |
> bad if it's a false positive). |
56 |
> |
57 |
> The downside is that you use more resources: one amavisd-new per connection. |
58 |
> However, the addition of postscreen to postfix has largely ameliorated this. |
59 |
> Since postscreen rejects most of the junk, amavis only gets started for |
60 |
> smtpd sessions that are likely to succeed. |
61 |
> |
62 |
> The easiest way to migrate is through incremental improvement. We used to |
63 |
> use a system like the one in that guide. I enabled postscreen over the |
64 |
> course of a week, and retired postgrey, which we had been using for |
65 |
> greylisting. Once that was working properly, I simply dropped the |
66 |
> content_filter in favor of smtpd_proxy_filter to move amavis in front of the |
67 |
> queue. |