Amavisd-new and rejecting pre-queue ?

Hi,

I was wondering whether it would be possible to have amavisd-new and/or
postfix to reject SPAM, and/or viruses pre-queue ?

I assume the question is whether postfix can be configured in such a way
as to allow REJECT to be sent to the sending client of the SPAM, after
the message has been seen in full? (so that content filters can take
effect). I particuraly don't want to create any backscatter...

If I configure amavisd-new to reject (D_REJECT), postfix will still
consider that a bounce (since it is post-queue AFAIK), and then
backscatter can ensue... If I configure amavisd-new to bounce
(D_BOUNCE), then amavisd-new will generate the bounce message, and
postfix will bounce it back to the sender (backscatter again).

The only way I can stop amavisd-new causing backscatter is to configure
it with D_PASS or D_DISCARD.

I have tried to configure the content_filter on the 'smtp inet'
directive in master.cf (as follows), but that doesn't change the
behaviour, and a bounce is generated in the same way as it is currently
configured (as per postconf -n output below)

smtp inet n - - - - smtpd
-o content_filter = smtp-amavis:[127.0.0.1]:10024

If there is a more "prefered way" of configuring amavisd-new (or any
content_filter for that matter) and postfix, please let me know :)

Thanks in advance,

Damien

P.S. :)

For your reference, here is a log snippet (with just the email addresses
changed) showing the bounce caused by the reject of amavisd. It does
not seem to make any difference whether I use LMTP or SMTP. (in this
example it uses LMTP).

May 26 10:55:34 new postfix/smtpd[12754]: connect from
datalex.cable.nu[203.117.94.152]
May 26 10:55:34 new postfix/smtpd[12754]: 3E6A91004A43:
client=datalex.cable.nu[203.117.94.152], sasl_method=CRAM-MD5,
sasl_username=spamtrap@new.tusker.net
May 26 10:55:34 new postfix/cleanup[12739]: 3E6A91004A43:
message-id=<42953A95.7070906@tusker.org>
May 26 10:55:34 new postfix/qmgr[12732]: 3E6A91004A43:
from=<spamtrap@tusker.org>, size=6071, nrcpt=1 (queue active)
May 26 10:55:34 new postfix/smtpd[12754]: disconnect from
datalex.cable.nu[203.117.94.152]
May 26 10:55:35 new amavis[12626]: (12626-01-4) Not-Delivered,
<spamtrap@tusker.org> -> <spamtrap@new.tusker.net>, quarantine
spam-8bfe9e1b64f2be6b9de473825f26ac32-20050526-105535-12626-01-4,
Message-ID: <42953A95.7070906@tusker.org>, Hits: 6.413
May 26 10:55:35 new postfix/lmtp[12740]: 3E6A91004A43:
to=<spamtrap@new.tusker.net>, relay=127.0.0.1[127.0.0.1], delay=1,
status=bounced (host 127.0.0.1[127.0.0.1] said: 550 5.7.1 Message
content rejected, UBE, id=12626-01-4 (in reply to end
of DATA command))
May 26 10:55:35 new postfix/cleanup[12745]: 6D6331007DB6:
message-id=<20050526025535.6D6331007DB6@mx.new.tusker.net>
May 26 10:55:35 new postfix/qmgr[12732]: 6D6331007DB6: from=<>,
size=7939, nrcpt=1 (queue active)
May 26 10:55:35 new postfix/qmgr[12732]: 3E6A91004A43: removed
May 26 10:55:37 new postfix/smtp[12773]: 6D6331007DB6:
to=<spamtrap@tusker.org>, relay=mail.tusker.net[203.209.194.40],
delay=2, status=sent (250 Ok: queued as 8C52F17E02)
May 26 10:55:37 new postfix/qmgr[12732]: 6D6331007DB6: removed


For your reference, here is my postconf -n output [below this is also my
master.cf entries that are probably relevant].

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/lib/postfix
disable_vrfy_command = yes
fallback_transport = procmail
local_recipient_maps = $virtual_maps, $virtual_mailbox_maps
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
maps_rbl_reject_code = 571
mydestination = mx.new.tusker.net, localhost.tusker.net, localhost
mydomain = mx.new.tusker.net
myhostname = mx.new.tusker.net
mynetworks = 127.0.0.0/8
myorigin = /etc/mailname
parent_domain_matches_subdomains =
recipient_delimiter = +
relay_domains = /usr/share/dtc/etc/postfix_relay_domains
relayhost =
setgid_group = postdrop
smtp_sasl_auth_enable = no
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,
permit_sasl_authenticated, check_helo_access
regexp:/etc/postfix/allow_broken_helo, reject_unauth_pipelining,
permit
smtpd_recipient_restrictions = permit_mynetworks
permit_sasl_authenticated reject_invalid_hostname
reject_non_fqdn_sender reject_non_fqdn_recipient
reject_unknown_sender_domain reject_unknown_recipient_domain
permit_mynetworks reject_unauth_destination
reject_rbl_client sbl-xbl.spamhaus.org reject_rbl_client
list.dsbl.org reject_rbl_client relays.ordb.org permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = /etc/mailname
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions = reject_unauth_pipelining permit
smtpd_tls_auth_only = no
virtual_alias_maps = hash:/usr/share/dtc/etc/postfix_virtual
virtual_gid_maps = static:65534
virtual_mailbox_base = /
virtual_mailbox_domains =
hash:/usr/share/dtc/etc/postfix_virtual_mailbox_domains
virtual_mailbox_maps = hash:/usr/share/dtc/etc/postfix_vmailbox
virtual_minimum_uid = 100
virtual_transport = maildrop
virtual_uid_maps = hash:/usr/share/dtc/etc/postfix_virtual_uid_mapping
new:~# vi /etc/postfix/master.cf
new:~# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/lib/postfix
disable_vrfy_command = yes
fallback_transport = procmail
local_recipient_maps = $virtual_maps, $virtual_mailbox_maps
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
maps_rbl_reject_code = 571
mydestination = mx.new.tusker.net, localhost.tusker.net, localhost
mydomain = mx.new.tusker.net
myhostname = mx.new.tusker.net
mynetworks = 127.0.0.0/8
myorigin = /etc/mailname
parent_domain_matches_subdomains =
recipient_delimiter = +
relay_domains = /usr/share/dtc/etc/postfix_relay_domains
relayhost =
setgid_group = postdrop
smtp_sasl_auth_enable = no
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,
permit_sasl_authenticated, check_helo_access
regexp:/etc/postfix/allow_broken_helo, reject_unauth_pipelining,
permit
smtpd_recipient_restrictions = permit_mynetworks
permit_sasl_authenticated reject_invalid_hostname
reject_non_fqdn_sender reject_non_fqdn_recipient
reject_unknown_sender_domain reject_unknown_recipient_domain
permit_mynetworks reject_unauth_destination
reject_rbl_client sbl-xbl.spamhaus.org reject_rbl_client
list.dsbl.org reject_rbl_client relays.ordb.org permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = /etc/mailname
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions = reject_unauth_pipelining permit
smtpd_tls_auth_only = no
virtual_alias_maps = hash:/usr/share/dtc/etc/postfix_virtual
virtual_gid_maps = static:65534
virtual_mailbox_base = /
virtual_mailbox_domains =
hash:/usr/share/dtc/etc/postfix_virtual_mailbox_domains
virtual_mailbox_maps = hash:/usr/share/dtc/etc/postfix_vmailbox
virtual_minimum_uid = 100
virtual_transport = maildrop
virtual_uid_maps = hash:/usr/share/dtc/etc/postfix_virtual_uid_mapping

---------------------
master.cf entries:

smtp-amavis unix - - n - 2 lmtp
-o lmtp_data_done_timeout=1200
-o lmtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20

127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,rej ect
-o mynetworks=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o
receive_override_options=no_header_body_checks,no_ unknown_recipient_checks

pre-cleanup unix n - - - 0 cleanup
-o virtual_alias_maps=
-o canonical_maps=
-o sender_canonical_maps=
-o recipient_canonical_maps=
-o masquerade_domains=

cleanup unix n - - - 0 cleanup
-o mime_header_checks=
-o nested_header_checks=
-o body_checks=
-o header_checks=

smtp inet n - - - - smtpd
-o cleanup_service_name=pre-cleanup
pickup fifo n - - 60 1 pickup
-o cleanup_service_name=pre-cleanup