How to disable outbound virus scanning (amavisd-new, spamassassin)

[Jim Rice]

Can virus scanning be disabled for outbound email?
Is that a "bad thing"?

We send out invoices and mass email campaigns to our customer base,
and there is significant overhead involved with needless scanning.

How do I find out if postfix is configured for outbound scans,
and how do I disable it?

(Postfix 2.2.3, amavisd-new 2.3.2)

master.cf:
amavisd-new unix - - n - 4 smtp

main.cf:
content_filter = amavisd-new:[127.0.0.1]:10024

[Christopher H. Laco]

Post by Jim Rice
Can virus scanning be disabled for outbound email?
Is that a "bad thing"?
We send out invoices and mass email campaigns to our customer base,
and there is significant overhead involved with needless scanning.
How do I find out if postfix is configured for outbound scans,
and how do I disable it?
(Postfix 2.2.3, amavisd-new 2.3.2)
amavisd-new unix - - n - 4 smtp
content_filter = amavisd-new:[127.0.0.1]:10024

"Outbound" is relative. Anything to port 25 is "incoming", be that
internal or external users.

Why not send your outgoing emails using submission port 587. That's how
dkfilter.out happens on most setups.

-=Chris

[Anthony J. Biacco]

Jim,

In your amavisd.conf, you can always set the virus_lovers variable, for
instance, read_hash(\%virus_lovers, '/var/amavis/virus_lovers');
And then in /var/amavis/virus_lovers, or whatever your path to the file is,
put one email address per line of the receivers of invoices or campaigns.
Not exactly the best way to do things, but should work.

Might want to check out this document for a possible better way:
http://www200.pair.com/mecham/spam/bypassing.html

-Tony
----------------------------------------
Anthony J. Biacco
Senior Systems and Network Administrator
Ncohafmuta Enterprises
303-981-4955

-----Original Message-----
Sent: Monday, January 15, 2007 11:20 AM
To: Postfix users
Subject: How to disable outbound virus scanning (amavisd-new,
spamassassin)
Can virus scanning be disabled for outbound email?
Is that a "bad thing"?
We send out invoices and mass email campaigns to our customer base,
and there is significant overhead involved with needless scanning.
How do I find out if postfix is configured for outbound scans,
and how do I disable it?
(Postfix 2.2.3, amavisd-new 2.3.2)
amavisd-new unix - - n - 4 smtp
content_filter = amavisd-new:[127.0.0.1]:10024

[Jim Rice]

Post by Anthony J. Biacco
Jim,
In your amavisd.conf, you can always set the virus_lovers variable, for
instance, read_hash(\%virus_lovers, '/var/amavis/virus_lovers');
And then in /var/amavis/virus_lovers, or whatever your path to the file is,
put one email address per line of the receivers of invoices or campaigns.
Not exactly the best way to do things, but should work.
http://www200.pair.com/mecham/spam/bypassing.html
-Tony

Not very practical. We are talking 10's of thousands of unique
addresses, and campaigns that change on a weekly basis.
Mind you, this is not SPAM. It is only being sent to our customers.
And since we are generating the message, we are fairly confident that it
does not contain a virus. ;-)

That said, it should be relatively easy to send them out without
scanning first.

The messages originate from the mail server itself, not from another
internal client. All addresses are to external domains.

Why should this be so difficult?

[Anthony J. Biacco]

You'd think it'd be relatively easy, but guess it's not.

How about something like this in master.cf

x.x.x.x:25 inet n - n - - smtpd
-o content_filter=
-o smtpd_client_restrictions=permit_mynetworks,reject

Where x.x.x.x is an internal ip. Then when you're sending out your
campaigns, use the SMTP server x.x.x.x instead of Postfix's normal IP.

-Tony
----------------------------------------
Anthony J. Biacco
Senior Systems and Network Administrator
Ncohafmuta Enterprises
303-981-4955

-----Original Message-----
Sent: Monday, January 15, 2007 12:49 PM
To: Anthony J. Biacco
Subject: RE: How to disable outbound virus scanning (amavisd-new,
spamassassin)

Post by Anthony J. Biacco
Jim,
In your amavisd.conf, you can always set the virus_lovers variable,

for

Post by Anthony J. Biacco
instance, read_hash(\%virus_lovers, '/var/amavis/virus_lovers');
And then in /var/amavis/virus_lovers, or whatever your path to the

file is,

Post by Anthony J. Biacco
put one email address per line of the receivers of invoices or

campaigns.

Post by Anthony J. Biacco
Not exactly the best way to do things, but should work.
http://www200.pair.com/mecham/spam/bypassing.html
-Tony

Not very practical. We are talking 10's of thousands of unique
addresses, and campaigns that change on a weekly basis.
Mind you, this is not SPAM. It is only being sent to our customers.
And since we are generating the message, we are fairly confident that it
does not contain a virus. ;-)
That said, it should be relatively easy to send them out without
scanning first.
The messages originate from the mail server itself, not from another
internal client. All addresses are to external domains.
Why should this be so difficult?

[Christopher H. Laco]

Post by Anthony J. Biacco
You'd think it'd be relatively easy, but guess it's not.
How about something like this in master.cf
x.x.x.x:25 inet n - n - - smtpd
-o content_filter=
-o smtpd_client_restrictions=permit_mynetworks,reject
Where x.x.x.x is an internal ip. Then when you're sending out your
campaigns, use the SMTP server x.x.x.x instead of Postfix's normal IP.
-Tony
----------------------------------------
Anthony J. Biacco
Senior Systems and Network Administrator
Ncohafmuta Enterprises
303-981-4955

*cough*submission port 587*cough*.
It's even already in master.cf

[Gary V]

Post by Anthony J. Biacco

Post by Anthony J. Biacco
Jim,
In your amavisd.conf, you can always set the virus_lovers variable, for
instance, read_hash(\%virus_lovers, '/var/amavis/virus_lovers');
And then in /var/amavis/virus_lovers, or whatever your path to the file

is,

Post by Anthony J. Biacco
put one email address per line of the receivers of invoices or

campaigns.

Post by Anthony J. Biacco
Not exactly the best way to do things, but should work.
http://www200.pair.com/mecham/spam/bypassing.html
-Tony

Not very practical. We are talking 10's of thousands of unique
addresses, and campaigns that change on a weekly basis.
Mind you, this is not SPAM. It is only being sent to our customers.
And since we are generating the message, we are fairly confident that it
does not contain a virus. ;-)
That said, it should be relatively easy to send them out without
scanning first.
The messages originate from the mail server itself, not from another
internal client. All addresses are to external domains.
Why should this be so difficult?

You have not told us how you submit this mail to Postfix, SMTP? sendmail?

Gary V

_________________________________________________________________
Communicate instantly! Use your Hotmail address to sign into Windows Live
Messenger now. http://get.live.com/messenger/overview

[Jim Rice]

Post by Gary V
You have not told us how you submit this mail to Postfix, SMTP? sendmail?

Perl module via script...

Mail::Sender

Uses port 25. Not sure if that can be adjusted on the fly (587)?

[Gary V]

Post by Gary V

Post by Gary V
You have not told us how you submit this mail to Postfix, SMTP?

sendmail?
Perl module via script...
Mail::Sender
Uses port 25. Not sure if that can be adjusted on the fly (587)?

Provided the script connects from localhost and delivers to localhost (and
localhost resolves to 127.0.0.1) I would think you could use a form of:
http://www.postfix.org/FILTER_README.html#remote_only

Split:
smtp inet n - n - - smtpd
into:

1.2.3.4:smtp inet n - n - - smtpd
127.0.0.1:smtp inet n - n - - smtpd
-o mynetworks=127.0.0.0/8
-o smtpd_client_restrictions=permit_mynetworks,reject
-o content_filter=

Gary V

_________________________________________________________________
Dave vs. Carl: The Insignificant Championship Series.  Who will win?
http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://davevscarl.spaces.live.com/?icid=T001MSN38C07001

[mouss]

Post by Jim Rice
Can virus scanning be disabled for outbound email?
Is that a "bad thing"?
We send out invoices and mass email campaigns to our customer base,
and there is significant overhead involved with needless scanning.
How do I find out if postfix is configured for outbound scans,
and how do I disable it?
(Postfix 2.2.3, amavisd-new 2.3.2)
amavisd-new unix - - n - 4 smtp
content_filter = amavisd-new:[127.0.0.1]:10024

content_filter =
smtpd_recipient_restrictions =
...
permit_sasl_authenticated
permit_mynetworks
reject_unauth_destination
check_client_access pcre:/etc/postfix/content_filter
...


== content_filter:
/./ FILTER amavisd-new:[127.0.0.1]:10024

make sure no other machine or program can send mail from mynetworks. you
may consider using sasl...

The submission port may be a better idea as most viruses will try port 25.

[Adam C. Mathews]

-----Original Message-----
From: owner-postfix-***@postfix.org
[mailto:owner-postfix-***@postfix.org] On Behalf Of Jim Rice
Sent: Monday, January 15, 2007 1:20 PM
To: Postfix users
Subject: How to disable outbound virus scanning (amavisd-new,
spamassassin)

Can virus scanning be disabled for outbound email?
Is that a "bad thing"?

We send out invoices and mass email campaigns to our customer base,
and there is significant overhead involved with needless scanning.

How do I find out if postfix is configured for outbound scans,
and how do I disable it?

(Postfix 2.2.3, amavisd-new 2.3.2)

master.cf:
amavisd-new unix - - n - 4 smtp

main.cf:
content_filter = amavisd-new:[127.0.0.1]:10024


------------------------------------------------------------------------
-----------------------------------------------------



I'll probably be chastised for providing an amavisd-new fix but I guess
I look for the easy way...

Tell amavisd-new not to scan on mail from your internal address
range(s).

This is what does it for me in my amavisd.conf file. Just add the
proper line for "don't check for virus"... find it in the amavisd-new
docs


@mynetworks = qw( 127.0.0.0/8 [::1] 192.168.10.0/24 192.168.20.0/24);

$policy_bank{'MYNETS'} = { # clients in @mynetworks
bypass_spam_checks_maps => [1], # don't spam-check internal mail
bypass_banned_checks_maps => [1], # don't banned-check internal mail
bypass_header_checks_maps => [1], # don't header-check internal mail

};