Advanced Mail Platform using Postfix: Enterprise Email Administrators, I salute you! (Part 2)
Posted : June 14, 2004 at 7:26 pm [America/Los_Angeles]
Click on the image to see an enlarged view
The more time I spend on Postfix, the more I seem to respect folks who handle email infrastructure in Enterprises. In fact, here’s a little suggestion:
If you know someone who manages email for any-sized (small, medium, big or huge) enterprise, feel free to bow a few times the next time you see them. I sure would.
Anyway, after a week of no Java and loads of Postfix time, here’s where I stand:
- Postfix 2.x (SMTP server) - Installation Complete
- Cyrus SASL over TLS (to support SMTP AUTH) - Installation Complete
- pam_mysql (to support authentication against MySQL database) - Installation Complete
- Courier IMAP/IMAP-SSL, POP3/POP3-SSL (IMAP/POP3 servers) - Installation Complete
- Squirrel Mail (web-based access to mailboxes) - Incomplete
- Mailman (Mailing list manager)
- Amavisd-New (A wrapper software that in turn invokes the Virus and SPAM scanners)
- ClamAV or F-Prot (command-line scanners for viruses) - Incomplete
- SpamAssassin (filtering SPAM) - Incomplete
- MySQL (relational database storing user credentials and even Postfix details) - Installation Complete
- Apache 2.x with PHP (4.3.x) (Web server for hosting Squirrel Mail) - Installation Complete
I have also updated the schematic, highlighting the internals of Postfix in more detail than I had the last time.
I think I am getting to see things a lot clearly.
- Anand
Category: Services and Software
Viewed: 1180 times
7 Comments
Hi Anand,
I’m running quite similar, though little bit simplier setup (no MySQL, no Squirrel and Exim intead of Postfix). One of the problem I still have, and I can see it on your diagramm too is that checking for viruses/spam performed _before_ MTA (postfix, exim) see that mail message, so most non-trivial check usually completed by MTA is too late to do.
For example, email is coming to non-existing user in your domain, if it was seen by MTA first it would have been rejected right away in the same SMTP session and sender would get appropriate error message, but in this configuration that email would (unnecessary) checked for viruses/spam, then delivered to postfix who see that it can’t deliver, generate error message back to sender (fake address most likely) and that message would be sitting in your outgoing queue for quite some time.
Posted by: MaximDim at June 15, 2004 @ 4:46 am
Very good point indeed, Maxim. Must say I did not think of it. Any ideas?
I guess the only way I could see this being done is:
1. Integrate spam and virus checks with the rest of the internals of Postfix thereby enabling its invocation at a somewhat later stage.
2a. Set up a new dummy Postfix SMTPD daemon before the one shown in the schematic. Make sure that the two Postfix instances are configured similarly, preferably sharing configs wherever possible. The first Postfix instance essentially screens the emails into 2 categories - valid emails (local or virtual) and invalid emails. Invalid ones will be bounced off immediately.
2b. All valid ones will get sent to our second SMTP server thanks to an overriding “transport_map” entry. I think transport maps is a pretty neat and powerful concept in Postfix.
It might be a huge overkill for me, but it sure seems like something that might work. Any thoughts?
Posted by: Anand Sharma at June 15, 2004 @ 7:50 am
Hello
I trying to install the rpm pakege of exim4.34 on my server
but it gives the following error
root@server [/]# rpm -ivh exim-3.36-25_cpanel_antivirus.i386.rpm
Preparing… ########################################### [100%]
Segmentation fault (core dumped)
Please help
sam
Posted by: sysadmin at June 25, 2004 @ 6:45 am
Ah, the dreaded Segementation fault, Core dumped problem.
You’ve a few options:
1. Try installing Exim using the source code. I prefer it anyday over installing it using RPM.
2. Pose this question on Exim’s Mailing list
3. Try using tools like strace to see if that tells you where the fault is occuring. Ex: (unix)>strace -o exim-rpm.log rpm -ivh ..
4. Install a different RPM (any RPM) just to make sure that your RPM repository is not corrupted. Once I had this problem and it had something to do with my screwing up the RPM db itself.
Sorry, could not give you any specific help
If I were you I would definitely try installing the software from source. Here’s a blog entry that might help http://indrayam.com/archives/services_and_software/000262.php
HTH
Posted by: Anand Sharma at June 25, 2004 @ 10:05 am
Anand,
How’s progress on this? I have managed to solve “spam check is too late” problem by using latest (4.X) version of Exim which has ACL support and excellent exiscan-acl patch for Exim. Exiscan-acl basically extends Exim’s ACL system by introducing content-scanning rules (MIME, antivirus, spam, etc).
For example, you can write a rult to check (and reject) messages based on attachments:
acl_check_mime: # File extension filtering. deny message = Blacklisted file extension detected condition = ${if match {${lc:$mime_filename}} {N(.exe|.pif|.bat|.scr|.lnk|.com)$N} {1}{0}}or on charset:
# Reject messages that carry chinese character sets. # This is an EXAMPLE. deny message = Sorry, noone speaks chinese here condition = ${if eq{$mime_charset}{gb2312}{1}{0}}or on results from SpamAssassin run on the message:
deny message = This message identified as spam and rejected ($spam_score) spam = mail:true condition = ${if >{$spam_score_int}{80}{1}{0}}The beauty is that all checks happening during SMTP session and if ACL returns “deny” message rejected right away with 550 error. All this with only single instance of Exim running! Very nice to see in the logs
Posted by: Dmitri Maximovich at January 27, 2005 @ 7:26 pm
Excellent, Dmitri!!
Frankly, I did sorta drop the ball on the Postfix install. Ofcourse, that does not mean it’s off my to-do list..;-)
So, let me ask you this: Do you think I should dump Postfix and try Exim? That will be quite a lot of work, since I already have worked a lot on understanding how Postfix works. Anyway, it would be nice to know what you think/recommend.
Needless to say, if you figure out how to do something like this in Postfix, I would luv to know about it.
- Anand
Posted by: Anand Sharma at January 28, 2005 @ 10:21 am
Anand,
I cannot recommend you to switch from Postfix because I never used it and really cannot judge is it better or worse than Exim. I switched to Exim from sendmail many years ago and never looked back
Exim works great for me, especially in combination with gentoo Linux, it does everything I need - secure SMTP, SMTP AUTH, understands IMAP Maildir format for messages delivery and has a human readable config file.
Posted by: Dmitri Maximovich at January 30, 2005 @ 4:22 pm