qmail and clamav solution

[xplatform12]

I had been looking for a good alternative for scanning email with qmail. I found the following article and it worked for me by just following the docs. It uses clamd and qscanq.

So if you have been looking for a way to scan emails for viruses without paying for drweb or some other commercial virus scanning software, check out:


http://www.hostbird.com/beta/index.php?loc=0602-0602

 

[breun]

I think using ART's qmail-scanner package is even easier.

 

[usdcservers]

Originally posted by breun
I think using ART's qmail-scanner package is even easier.

URL to it?

 

[breun]

http://www.atomicrocketturtle.com/

 

[noise98]

qmail-scanner take a lot of ressource.
Using perl to execute is the main problem.

Should try some C solutions.

 

[usdcservers]

Originally posted by noise98
qmail-scanner take a lot of ressource.
Using perl to execute is the main problem.

Should try some C solutions.

If it does use a lot of resources I do not even notice on my server, I have had it installed for 2 days and it has processed thousands of messages with no slow down to the server. Now if SWSoft offered a free version of anti-virus scanning like Ensim and cPanel does there wouldn't be a problem.

 

[noise98]

I used it for couples of months and realise it was the one causing server freeze... It's calling a perl scripts and perl take a lots of ressources.

I changed today for qscanq and worked really better with spamassassin and clamav.

 

[atomicturtle]

For the most part the load is really on spamassassin, which is also written in perl. Regardless of the wrapper (simscan, qscanq, q-s, etc) your bottleneck is going to be there. Especially as you add more tests to the system. The real solution here is to limit inbound connections, and throttle your SMTP server based on load.

As a side note, I've been using qmail-scanner for spam/av scanning since PSA 5.0 on some pretty high volume mail servers (500k+ messages a day). Which I might add has been the free AV/Anti-spam scanner for PSA since then (yum install qmail-scanner)

 

[breun]

The real solution here is to limit inbound connections, and throttle your SMTP server based on load.

Which probably requires some netfilter voodoo?

 

[atomicturtle]

Or you could just use the features in xinetd to do it

 

[breun]

Any pointers to examples/howtos?

 

[atomicturtle]

check out the man page for xinetd.conf

per_source Takes an integer or "UNLIMITED" as an argument. This specifies the maximum instances of this service per source IP address.
This can also be specified in the defaults section.


max_load Takes a floating point value as the load at which the service will stop accepting connections. For example: 2 or 2.5. The ser-
vice will stop accepting connections at this load. This is the one minute load average. This is an OS dependent feature, and
currently only Linux, Solaris, and FreeBSD are supported for this. This feature is only avaliable if xinetd was configured with
the -with-loadavg option.

 

[breun]

I swear I read man xinetd and man xinetd.conf this morning, but I must have been reading with my nose or something. Thanks, I'll try playing with this.

 

[alonso]

qmail-scanner question

I already use 4PSA cleanserver and spamguardian

any pointers on the benefits/problems of using qmail-scanner instead...

can they be used at the same time?

I run plesk 8.1 on rhel4

Thanks

 

[pdreissen]

I'm using http://assp.sourceforge.net/ since a couple of months with very very good results. Very easy to install, with lots of features. This is not a mailserver but a mailproxy, so it needs a working mailserver already to function (qmail or mailenable for ex.)

- Greylisting (Delaying)
- Redlisting / whitelisting / blacklisting
- RBL / UriBl / RWL
- ClamAv support
- Regex filters / Spambombs
- SPF / SRS
- SpamLovers / No processing options
- LDAP Support
- Linux / Win32 support (Win32 needs Active Perl)

Look at the Wiki for more information: http://www.asspsmtp.org/wiki/Welcome

Search for Plesk for Plesk install instructions!

 

[atomicturtle]

I don't recall if spamguardian did anti-virus scanning or not. If it doesnt, then you'd be able to do AV scanning. Otherwise no, its not going to add very much. They'd work together just fine though.

 

[breun]

SpamGuardian is 4PSA's SpamAssassin module, 4PSA CleanServer does the antivirus scanning (F-Prot antivirus I believe). An advantage of qmail-scanner is that it's available for free. A disadvantage is that it doesn't give you a GUI in the Plesk webinterface.

 

[alonso]

Originally posted by atomicturtle
I don't recall if spamguardian did anti-virus scanning or not. If it doesnt, then you'd be able to do AV scanning. Otherwise no, its not going to add very much. They'd work together just fine though.

Thanks for your response... For some reason I was thinking qmail-scanner was a spam filter, sorry for the confusion.

What I am looking for is something to help with spam. Like I mentioned, I already have 4PSA spamguardian, which is a spamassassin implementation, but we still get quite a lot of spam going through.

Looking at all your contributions I came across qgreylist. Is your qgreylist implementation compatible with psa8.1, and, will it work along with spamassassin?

Thanks for the help!

 

[atomicturtle]

Yep, its compatible with PSA, and spamassassin.

 

[KudosDesigns]

per_source Takes an integer or "UNLIMITED" as an argument. This specifies the maximum instances of this service per source IP address.

We really need to throttle our server load, but we have users grumbling about dropped POP3 and IMAP connections to our qmail server.

I am worried that if i was to reduce xinetd to accept less than "UNLIMITED" smtp connections, that these problems would grow ... what is a recommended reduction of UNLIMITED to (200, 300, or what?) and what should i set the load average to ... 2 or 2.5? What exactly does that mean as it doesn't really say in man xinetd.conf?

I notice that there is also an poppassd_psa xinetd file which is limited to 100 connections ... could this be where our dropped connections are coming in?