How to configure multiple postfix content filters?

Mike Schleif

unread,

Mar 3, 2016, 2:09:37 PM3/3/16

to

Centos: 7.2.1511 (Core)
postfix: 2.10.1
amavisd-new: 2.10.1

This postfix server was designed to run as follows, which it has done for several months without incident:

Original filter-only:
master.cf:
smtp inet n - n - - smtpd
-o content_filter=filter:dummy

filter unix - n n - 10 pipe
flags=Rq user=filter null_sender=
argv=/var/spool/filter/bin/filter.sh -f ${sender} -- ${recipient}

Now, I'm tasked with retrofitting spamassassin on same host, which works using
following configuration:

Spamassassin-only:
master.cf:
smtp inet n - n - - smtpd
-o content_filter=spamassassin

spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

Our problem is using _both_ spamassassin and filter, preferably in that order.

postfix-users pointed me to: amavisd-new, which I have installed. This works properly, regarding spam & virus.

How need I configure postfix to first call amavisd-new, then use "filter?"

Mike Schleif

unread,

Mar 3, 2016, 2:50:46 PM3/3/16

to

Patrick Ben Koetter

unread,

Mar 3, 2016, 4:40:02 PM3/3/16

to

Mike,

* Mike Schleif <mi...@mdsresource.net>:

> Centos: 7.2.1511 (Core)
> postfix: 2.10.1
> amavisd-new: 2.10.1
>
> This postfix server was designed to run as follows, which it has done for
> several months without incident:
>
> Original filter-only:
> master.cf:
> smtp inet n - n - - smtpd
> -o content_filter=filter:dummy
>
> filter unix - n n - 10 pipe
> flags=Rq user=filter null_sender=
> argv=/var/spool/filter/bin/filter.sh -f ${sender} -- ${recipient}

what is it, that filter.sh does? Is it something amavis can do as well?
I'm asking because maybe we can simplify your setup.

p@rick

>
>
> Now, I'm tasked with retrofitting spamassassin on same host, which works
> using
> following configuration:
>
> Spamassassin-only:
> master.cf:
> smtp inet n - n - - smtpd
> -o content_filter=spamassassin
>
> spamassassin unix - n n - - pipe
> user=spamd argv=/usr/bin/spamc -f -e
> /usr/sbin/sendmail -oi -f ${sender} ${recipient}
>
>
> Our problem is using _both_ spamassassin and filter, preferably in that
> order.
>
> postfix-users pointed me to: amavisd-new, which I have installed. This
> works properly, regarding spam & virus.
>
> How need I configure postfix to first call amavisd-new, then use "filter?"
>

> <http://twitter.com/mikeschleif>

--
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Franziskanerstraße 15, 81669 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

Patrick Ben Koetter

unread,

Mar 3, 2016, 4:51:58 PM3/3/16

to

* Mike Schleif <mi...@mdsresource.net>:
> Centos: 7.2.1511 (Core)
> postfix: 2.10.1
> amavisd-new: 2.10.1
>
> This postfix server was designed to run as follows, which it has done for
> several months without incident:
>
> Original filter-only:
> master.cf:
> smtp inet n - n - - smtpd
> -o content_filter=filter:dummy
>
> filter unix - n n - 10 pipe
> flags=Rq user=filter null_sender=
> argv=/var/spool/filter/bin/filter.sh -f ${sender} -- ${recipient}
>
>

> Now, I'm tasked with retrofitting spamassassin on same host, which works
> using
> following configuration:
>
> Spamassassin-only:
> master.cf:
> smtp inet n - n - - smtpd
> -o content_filter=spamassassin
>
> spamassassin unix - n n - - pipe
> user=spamd argv=/usr/bin/spamc -f -e
> /usr/sbin/sendmail -oi -f ${sender} ${recipient}
>
>
> Our problem is using _both_ spamassassin and filter, preferably in that
> order.

amavis seems a little over if all you need is spamassassin. You might get away
with less, if you hook spamassassin into Postfix via the spamassassin MILTER
program "spamass-milter".

Using spamass-milter you will be able to pre-queue scan messages. Spamassassin
can classify the messages and add a score. Then the message will be accepted,
written to the queue and sent of to your filter.sh script.

In pseudo-code:

smtp inet n - n - - smtpd

-o smtpd_milters=inet:127.0.0.1:20025

-o content_filter=spamassassin

spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

inet:127.0.0.1:20025 would be where the spamass-milter listens for incoming
connections. It would pass on the message via spamc to spamd. The scan result
would be handed back in reverse order.

p@rick

Mike Schleif

unread,

Mar 4, 2016, 9:09:42 AM3/4/16

to

On Thu, Mar 3, 2016 at 3:39 PM, Patrick Ben Koetter <p...@sys4.de> wrote:

Mike,

* Mike Schleif <mi...@mdsresource.net>:

> Original filter-only:
> master.cf:
> smtp inet n - n - - smtpd
> -o content_filter=filter:dummy
>
> filter unix - n n - 10 pipe
> flags=Rq user=filter null_sender=
> argv=/var/spool/filter/bin/filter.sh -f ${sender} -- ${recipient}

what is it, that filter.sh does? Is it something amavis can do as well?
I'm asking because maybe we can simplify your setup.

No.

This server was built to consolidate several legacy servers, primarily to do special header rewrites for a subset of all email received by this company. It is unique code developed to do such rewrites and it does it well.

After several months of doing this task without incident, others decided to retrofit spam & av to this box, which had been done problematically elsewhere.

I think that I have this working; but, I'm totally new to amavis, and I'm no expert on postfix. I want to find the simplest way to chain these processes, set it and forget it ...

Thank you.

Mike Schleif

unread,

Mar 4, 2016, 10:58:36 AM3/4/16

to

I have (4) questions at this point:

1) Can "filter" be run from amavisd?

2) If "filter" can be run from amavisd, should it?

3) Is it best to run "filter" from postfix? If so, how?