Re: traffic flow when using postfix with a content_filter

* Tom Van Overbeke <tom.van.overbeke@pandora.be>
> Hi,
>
> Can someone explain me what the traffic flow is when you use postfix with a
> content filter ?
>
> I installed a commercial virus checker (imss) that is called from postfix
> via the 'content_filter=" keyword in main.cf, like this/
>
> content_filter=imss:localhost:10025

Note that this will scan both incoming and outgoing mail. If you only
want to scan inbound mail (in fact, messages not sent to your
domains), then you can use something like this instead:

smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/recipient_access,
[more stuff]

The contents of recipient_access should be something like this:

your_domain FILTER imss:[127.0.0.1]:10025
your_domain2 FILTER imss:[127.0.0.1]:10025

> So i think the flow is like this:
>
>
> postfix receives the mail on port 25.
> postfix checks if the mail is allowed (smtp client restrictions, helo
> restrictions, etc)
> postfix passes the mail on to the content_filter
> the content_filter does its work also.
> but, is it then the content_filter that opens up an smtp connection, or does
> it send it back to postfix to let it handle it ?

With amavisd-new, its the second option. (amavisd sends the mail back
to postfix, listening at 127.0.0.1:whatever_port, if it decides that the
message should be delivered to one or several recipients.)

(you will have to tell postfix to listen to whatever_port in
/etc/postfix/master.cf, of course)


> I would think it's the latter option, because postfix will need to look up
> the correct route to send the mail to the destination (transportlist, mx
> record, etc), but i'm not sure.
>
>
> Can someone enlighten me ?

Ive only set this up with amavisd-new. If you download it, you will
find that the download includes some documentation on how to set it up
on a postfix server.

Even though you use a different content scanner, I believe that you
will find some answers to your questions from this documentation.


--
Erland Nylend

* Erland Nylend <erland1@online.no>

> Note that this will scan both incoming and outgoing mail. If you only
> want to scan inbound mail (in fact, messages not sent to your
^^^
*remove not*
--
Erland Nylend