Re: [Qmail-scanner-general]RE: [Qmail-scanner-announce] FYI: Details about upcoming Qmail-Scanner v2

[Jason H. <Jas...@tr...>]

On Mon, Apr 22, 2002 at 03:13:07PM +1000, Adam Goryachev wrote:
> Two things I can think off from the top of my head while going over that
> document. They are more correctly defined as feature requests...
>
> [suggestions of using more generic functions which call SQL DBs/etc in some
> areas deleted]

Sorry, but no.

There's absolutely nothing wrong with the idea, but all evidence I have seen 
from sites wanting such functionality appears to mean:

1> they all want it "a bit different". What's generic for you isn't right
   for others
2> it's confusing the hell out of all the smaller sites who have no need
   of it

I've added a LOT of larger-site functionality to Q-S v2, but stuff such as 
what you're asking for just makes Q-S WAY too complicated.

> Perhaps some kind of simple to implement hook/function call to do custom
> 'things' with the message. ie, log some details about every message etc...

The "new improved" logging in Q-S v2 looks like this at the moment:

Apr 22 21:39:33 kahaware qmail-scanner[16539]:
Clear:SA:0(0.2/5.0):FS:21(30468/29):CS:0() 2.458935 27254
ef...@xp... jh...@ho... attachment_collection
<00052922491700.15117@pluto>  101946837062316539-0:1
101946837062316539-1:254 archive.tar.gz:1912 101946837062316539-2:0
exec:12042 exec.c:540 gifpic.gif:262 101946837062316539-3:0 html.html:157
101946837062316539-4:0 jpegpic.jpg:845 101946837062316539-5:1 perl.pl:203
101946837062316539-6:1 pngpic.png:414 shell.sh:94 101946837062316539-7:0
test.txt:50 101946837062316539-8:1 ziparchive.zip:956 101946837062316539-9:1 

"Clear:SA:0(0.2/5.0):FS:21(30468/29):CS:0()" shows the msg was Cleared (cf.
quarantined/dropped), 0.2/5 SpamAssassin score, consisted of 21 attachments
(msg size: 27254 bytes), which unpacked to 29 files (total size: 30468
bytes); also, it wasn't encrypted (CS:0). Also, envelope hdrs, subject line,
msgid and filenames of attachments along with their individual sizes. 

Also, if the message had 20 recipients, you get 20 log entries. This works
around all sorts of problems - both with the 800 char record limit in syslog
(if using that option), and with stat generators which would otherwise have
to extract out recipients from the one line.

> My thoughts on this are to log bytes and number of messages for each to/from
> domain into a database for billing purposes. Also to log details of each
> message for spam tracking, and finally to record statistics on number of
> messages versus spam and viruses. (I'm not sure if this could simply be done
> as another 'virus scanner', but if using the QS_SKIP_TEXT_MSGS then you would
> still want to call this function....

This is all a post-processing issue for whatever you write to do it :-)

> 
> Ooops, one more feature request... Can we have some kind of function call
> which is given the to/from email addresses to determine which config file is
> used, or to override variable configs itself.

See top comment. I thought a lot about this, but couldn't think of a way
that wouldn't add complexity.

> 
> ie, I have one mail server, on one IP address, but for some customers, I want
> to appear as a different 'company' than others (ie, to support re-sellers etc)
> in the virus report emails etc.

You can do this by double-passing it. i.e. have all mail going into a
standard Qmail server (port 25), then use smtpdomains to redirect all their
mail to different mail servers (can be on the same host!) where the
different Q-S v2 are running:

#/var/qmail/control/smtproutes
resellers.r.us:127.0.0.1:201
customers.r.us:127.0.0.1:202

You also get the advantage that there are no "hangs" seen by the client, as
the standard Qmail server receives them first.

-- 
Cheers

Jason Haar

Information Security Manager
Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417