In short: amavisd-new is an interface between message transfer agent (MTA) and one or more content checkers: virus scanners, and/or SpamAssasin ( http://www.spamassassin.org/ ).
| Short overview |
Content:
|
http://www.ijs.si/software/amavisd
The suffix 'si' means Slovenia.
amavisd-new is a high-performance interface between mailer (MTA) and content
checkers: virus scanners, and/or SpamAssasin. It is written in Perl for
maintainability, without paying a significant price for speed. It talks to MTA
via (E)SMTP or LMTP, or by using helper programs. Best with Postfix, fine with
dual-sendmail setup and Exim v4, works with sendmail/milter, or with any MTA as
a SMTP relay. 'Howto' for qmail available as well.
Documentation can be found in: /usr/pack/amavisd-20030616p4-ds/docs
On our site the infected messages are kept in /var/spool/amavis
Snapshot: 25.08.2003, 15:00:
A new TAG has been created in the template_tree:
The following sketch depict the interaction between postfix and amavis:
.......................................
: Postfix :
----->smtpd \ :
: -pre-cleanup-\ /local---->
---->pickup / -queue- :
: -cleanup-/ | \smtp----->
: bounces/ ^ v :
: and locally | v :
: forwarded smtpd smtp-amavis :
: messages 10025 | :
...........................|...........
^ |
| v
............|..............................
: | $inet_socket_port=10024 :
: | :
: $forward_method='smtp:127.0.0.1:10025' :
: $notify_method ='smtp:127.0.0.1:10025' :
: :
: amavisd-new :
...........................................
See the configuration file /etc/postfix/master.cf for more info.
Also /etc/postfix/main.cf:
# virus checker content_filter = smtp-amavis:[127.0.0.1]:10024We also use a product from http://www.sophos.com/
In directory /usr/sepp/var/sophos-3.71-wu/ there are files with virus definitions. in a database ( *.vdb files) and updates in *.ide files. This databases are updates each day with a crontab job:
# update sophos virus database 45 6 * * * /usr/pack/sophos-3.71-wu/sophos_update # restart sophie to load virus database 0 7 * * * /etc/init.d/sophie restart >/dev/null 2>&1
See procedure sophos_update in /usr/pack/sophos-3.71-wu.
Attention:
SOPHOS must be upgraded not later then 3 months after the
last one!
Next is pending for October 2003.
The following links have to be updated after the new package has been loaded:
Check from time to time:
--> $ telnet 127.0.0.1 10024
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 [127.0.0.1] ESMTP amavisd-new service ready
--> quit
221 Bye
Connection closed by foreign host.
find $TEMPBASE -type d -name 'amavis-20??????T*' \
-prune -mtime +1 -exec rm -rf {} \;