<div dir="ltr">Dear MailScanner users:<div><br></div><div>I am officially working on creating a lightweight milter for MailScanner. </div><div><br></div><div>This milter will not provide MTA protocol rejection for postfix, due to the severe performance penalty it would cause. All mail will be intercepted, accepted, and silently dropped from the postfix queue and placed in a MailScanner queue.<br></div><div><br></div><div>I have a working prototype, and it is processing mail! It is in need of heavy refactoring and some bug squashing.</div><div><br></div><div>Currently it attempts to create a postfix formatted queue file (very ugly, who thought up this file format???!!!). I may instead create a new Milter Processor for MailScanner that reduces the overhead of doing this and can read the incoming email in a simple line-by-line format. This may also increase performance overall and reduce all the conversions happening.</div><div><br></div><div>The other side of the coin is what to do when MailScanner is done processing mail. Currently, it generates a postfix queue file and drops it into postfix incoming directory. It should not do this but instead drop the message into postfix using native postfix tools. That will be the next part I tackle as part of the Milter Processor.</div><div><br></div><div>Why am I doing this? I want to place MailScanner back in a good standing with Postfix folks (at least when the milter + postfix method is in use). </div><div><br></div><div>I have no plans of removing the old method but rather provide a more supported path for postfix users.</div><div><br></div><div>Wish me luck. I could be heard across the neighborhood when MailScanner processed an email from the Milter for the first time! :D</div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Sat, Aug 11, 2018 at 9:58 AM David Jones <<a href="mailto:djones@ena.com">djones@ena.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 08/11/2018 08:52 AM, Shawn Iverson wrote:<br>
> David,<br>
> <br>
> I agree that this is true, and part of my lack of motivation to do it. <br>
> One reason I wanted it as an option was to reconcile the ongoing <br>
> conflict with the postfix community and return MailScanner to good <br>
> standing to this community. Weitze has been very stern about <br>
> MailScanner directly tapping the postfix queues.<br>
> <br>
> Perhaps an alternative option would be to create a fast MailScanner <br>
> milter that behaves more like the HOLD queue. Basically just a milter <br>
> that immediately fires back accept to postfix and places all the <br>
> messages in a MailScanner HOLD queue as opposed to a postfix HOLD <br>
> queue. Doing so would maintain speed, simplicity, and be more compliant <br>
> with postfix. The code would also be very simple.<br>
> <br>
> Then, as you say, if you need MTA level functionality for SA, use other <br>
> software and methods.<br>
> <br>
> <br>
<br>
This light MS milter would make a lot of sense based on your goal to get <br>
compliant with Postfix and back "in" with the Postfix community. +1<br>
<br>
> <br>
> On Sat, Aug 11, 2018 at 9:39 AM David Jones <<a href="mailto:djones@ena.com" target="_blank">djones@ena.com</a> <br>
> <mailto:<a href="mailto:djones@ena.com" target="_blank">djones@ena.com</a>>> wrote:<br>
> <br>
> On 08/11/2018 08:15 AM, Shawn Iverson wrote:<br>
> > I have been planning for a MailScanner milter for quite some<br>
> time. I<br>
> > have been specifically studying rpamd's milter source for this<br>
> purpose.<br>
> > Alas, lack of time and lack of money are always an issue, and I<br>
> put a<br>
> > lot of hours in my day job. As Jerry would say, I like to eat<br>
> and have<br>
> > a roof over my head :D<br>
> ><br>
> > If I do find the time to build a milter, performance will<br>
> definitely be<br>
> > impacted. The reason is that postfix will have to keep each session<br>
> > open for the duration of scanning, and each MailScanner child<br>
> would have<br>
> > to issue a callback to postfix after scanning the spam so that<br>
> postfix<br>
> > can responds to the connection appropriately (i.e. reject or<br>
> accept).<br>
> > This will slow down mail processing considerably. If I do this,<br>
> I am<br>
> > going to keep the HOLD queue around, so you would have to choose<br>
> between<br>
> > speed or MTA level rejection functionality.<br>
> ><br>
> ><br>
> ><br>
> <br>
> My gut tells me that this is going to be so slow, that it's not<br>
> going to<br>
> be worth the time to put into it. If you want to reject at MTA time,<br>
> throw in amavis-new or spamd (not rspamd) using the same SpamAsssassin<br>
> rules and Bayes DB to get most of the same features as MailScanner<br>
> during the SMTP conversation. Then the mail that gets through can be<br>
> filtered by MailScanner for it's extra features that make it unique.<br>
> <br>
> I understand there are different local legal requirements around the<br>
> world that if email is accepted at MTA time then it has to be passed on<br>
> to the end user's mailbox. If you are located in one of these<br>
> countries, then this would be more of an issue. But since I am in a<br>
> country that doesn't have this legal requirement, I do block email<br>
> post-MTA by MailScanner.<br>
> <br>
> The majority of my spam is blocked at the MTA level already by highly<br>
> tuned RBLs and postscreen's RBL weighting which is very, very good.<br>
> Only a small percentage of spam that is zero-hour or from compromised<br>
> accounts makes it to MailScanner.<br>
> <br>
> I highly recommend the Invaluement RBL. It's very accurate -- only<br>
> 1 or<br>
> 2 false positives over 5+ the years. This RBL is very cost effective<br>
> and has allowed me to disable all Spamhaus RBL checks in SpamAssassin<br>
> saving thousands of dollars a year. (We have too high a volume to stay<br>
> under the free usage limits of Spamhaus so we were having to pay for<br>
> the<br>
> RBL feed.)<br>
> <br>
> ><br>
> ><br>
> ><br>
> > On Tue, Aug 7, 2018 at 10:52 AM David Jones via MailScanner<br>
> > <<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
> <mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>><br>
> > <mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
> <mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>>>> wrote:<br>
> ><br>
> > On 08/07/2018 05:03 AM, <a href="mailto:info@schroeffu.ch" target="_blank">info@schroeffu.ch</a><br>
> <mailto:<a href="mailto:info@schroeffu.ch" target="_blank">info@schroeffu.ch</a>> <mailto:<a href="mailto:info@schroeffu.ch" target="_blank">info@schroeffu.ch</a><br>
> <mailto:<a href="mailto:info@schroeffu.ch" target="_blank">info@schroeffu.ch</a>>><br>
> > wrote:<br>
> > ><br>
> > > Hi Mailscanner friends,<br>
> > ><br>
> > > is there any progress to make MailScanner usable as a<br>
> postfix milter?<br>
> > > The most biggest problem I have is, SPAM is not possible to<br>
> > reject when<br>
> > > reaching a high score at MTA level. For my understanding,<br>
> connect<br>
> > via<br>
> > > milter instead of queue ^HOLD would be the solution.<br>
> > ><br>
> > > For the next decade we are still using MailScanner instead<br>
> of others<br>
> > > like Rspamd, because MailScanner is like a mail suite for mail<br>
> > security,<br>
> > > but if there will never be the possibility to reject at<br>
> MTA level<br>
> > the<br>
> > > high score spam, we will also change in 1-3 years while<br>
> replacing<br>
> > the OS<br>
> > > beyond.<br>
> > ><br>
> ><br>
> > One of MailScanner's strongest features is it's batch mode<br>
> processing<br>
> > that will allow it to handle a very high volume of mail<br>
> flow. I doubt<br>
> > that MailScanner will ever be changed to run as a milter for this<br>
> > reason.<br>
> ><br>
> > I tried rspamd and found it wasn't as good as the author<br>
> claims so no<br>
> > reason to try to use that as a milter. It also wasn't as<br>
> fast as it<br>
> > claims. I could not send high volumes of mail through it<br>
> like I could<br>
> > with MailScanner.<br>
> ><br>
> > If you want to block high scoring spam at the MTA level, I<br>
> suggest<br>
> > using<br>
> > amavis or spamd with the same SA rulesets as MailScanner. <br>
> This will<br>
> > get<br>
> > you most of the power of MailScanner's blocking at the MTA.<br>
> ><br>
> > <a href="https://wiki.apache.org/spamassassin/IntegratedInMta" rel="noreferrer" target="_blank">https://wiki.apache.org/spamassassin/IntegratedInMta</a><br>
> ><br>
> > If you you use postscreen and postwhite at the Postfix MTA<br>
> level, you<br>
> > can block most of the obvious spam with a tuned list of<br>
> RBLs. See the<br>
> > SA users mailing list over the past year for details on this<br>
> from me<br>
> > and<br>
> > a few others.<br>
> ><br>
> > I suggest setting up a quick test VM with iRedmail to get a good<br>
> > example<br>
> > of how to do TLS and amavis integration well with Postfix.<br>
> ><br>
> > --<br>
> > David Jones<br>
> ><br>
> ><br>
> > --<br>
> > MailScanner mailing list<br>
> > <a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
> <mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>><br>
> > <mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
> <mailto:<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a>>><br>
> > <a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
> ><br>
> ><br>
> ><br>
> > --<br>
> > Shawn Iverson, CETL<br>
> > Director of Technology<br>
> > Rush County Schools<br>
> > 765-932-3901 x1171<br>
> > <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a><br>
> <mailto:<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a>><br>
> <mailto:<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a><br>
> <mailto:<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a>>><br>
> ><br>
> ><br>
> <br>
> -- <br>
> David Jones<br>
> <br>
> <br>
> <br>
> -- <br>
> Shawn Iverson, CETL<br>
> Director of Technology<br>
> Rush County Schools<br>
> 765-932-3901 x1171<br>
> <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a> <mailto:<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a>><br>
> <br>
> <br>
<br>
<br>
-- <br>
David Jones<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Shawn Iverson, CETL<div>Director of Technology</div><div>Rush County Schools</div><div>765-932-3901 x1171</div><div><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" width="96" height="96" style="font-size:12.8px"><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96"></div><div><img src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" style="font-size:12.8px"><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>