> >> Paradoxically, a simpler solution in your case is to use a more
> >> complex MTA+amavisd setup, letting MTA separate mail into
> originating
> >> (=locally submitted) and all the rest, and feeding each flow
> >> on a separate amavisd port.
> >>
> >> When code sections in current versions of amavisd need to know
> whether
> >> mail is originating from local users or not, they only consult a
> state
> >> of
> >> a flag $originating. This includes deciding whether mail is
eligible
> > to
> >> DKIM signing or not.
> >>
> >> The $originating flag can be set by a policy bank:
> >> originating => 1
> >> or can be set implicitly by matching a client IP address against
the
> >> @mynetworks list of local networks. See release notes for version
> >> 2.5.0.
> >>
> >> Up to version 2.5.0 the implicit way was the only mechanism
> available,
> >> so @mynetworks needed to be set correctly.
> >>
> >> Starting with 2.5.0 the @mynetworks is mostly just a convenient
> >> legacy mechanism for implicitly setting the $originating flag.
> >> Use it if you only have few local networks and no roaming
> > authenticated
> >> mail submitters, otherwise just set $originating flag explicitly by
> a
> >> port-based policy bank and can forget about @mynetworks.
> >
> > How I have to tell to the MTA to distinguish between local submitted
> > messages and not (I'm using Postfix)?
> >
>
> Great!!! Thanks Mark, I've read your mail carefully and so I ve
solved.
> In
> /etc/amavisd.conf I ve put
>
> $inet_socket_port = [10024,10026];
>
> $interface_policy{'10026'} = 'SENDERBYPASS';
>
> $policy_bank{'SENDERBYPASS'} = {
> originating => 1,
> };
>
> and in /etc/postfix/main.cf I have set:
>
> smtpd_client_restrictions =
> check_client_access
> proxy:mysql:/etc/postfix/mysql-check-client-filter-access.cf
>
> where /etc/postfix/mysql-check-client-filter-access.cf:
>
> user = ***
> password = ***
> hosts = ***
> dbname = ***
> query = <returns 'FILTER smtp-amavis:[127.0.0.1]:10026 if ip is
enabled
> for relaying, the action set in DB otherwise>
One thing that I can do after I have separated traffic originating
inside my network, from the other traffic passing through my mail
gateway, is to stop to analyse that traffic agaist viruses.
Indeed, I then realized that I would like to continue to scan email
originating from my network and destined still to my network.
So I have thought to extend the set of restrictions for client access
so:
smtpd_client_restrictions =
check_client_access
proxy:mysql:/etc/postfix/mysql-check-client-filter-access.cf
-> check_recipient_access
proxy:mysql:/etc/postfix/mysql-relay-filter-domain.cf
After I have modified the query part of 'check_client_access'
restriction as follows:
query = select IF(STRCMP(action,'OK'),action,'DUNNO') from access where
inet_aton(ip) & inet_aton(mask) = inet_aton('%s') & inet_aton(mask)
order by mask DESC limit 0,1;
and set the query part of 'check_recipient_access' restriction as
follows:
query = select if(count(*)>0,'OK','FILTER
smtp-amavis:[127.0.0.1]:10026') from domain where domain='%s' and
active='1'
But I don't have fully verified that this solution could be a correct
one. Could it work? Anyway, has anyone a better solution to my latest
issue?
TIA,
rocsca
------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
