Where to change amavisd listen interface (jump into the AMaViSd queue)?

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Post Reply
syntaxys
Posts: 26
Joined: Sat Sep 13, 2014 12:06 am

Where to change amavisd listen interface (jump into the AMaViSd queue)?

Post by syntaxys »

Hello Forum,
from an external MX running Postfix I would like to connect to the amavis queue in zcs 8.8.15 for spam and virus checking. After delivery the mails should stay in zcs for further handling and delivery to the mailboxes. As I saw, amavisd is bound in zcs on localhost:10024 and I was searching a way to get him listen on i. e. 192.168.y.y for mails coming from 192.168.x.x, injected via a check_policy_service inet:192.168.y.y:10024 or anything similar.

in master.conf.in I only found

Code: Select all

smtp-amavis unix -      -       n       -       %%zimbraAmavisMaxServers%%  smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o smtpd_sasl_auth_enable=no
-o max_use=20
Googling around or searching the forum doesn't give me an answer. What is the best practice for that purpose? Thanks for your help!

Kind regards,
Achim
Last edited by syntaxys on Sat Nov 30, 2019 5:27 am, edited 1 time in total.
User avatar
DualBoot
Elite member
Elite member
Posts: 1326
Joined: Mon Apr 18, 2016 8:18 pm
Location: France - Earth
ZCS/ZD Version: ZCS FLOSS - 8.8.15 Mutli servers
Contact:

Re: Where to change amavisd listen interface?

Post by DualBoot »

Hello,

you can manually tune it into this file /opt/zimbra/conf/amavisd.conf.in

Regards,
syntaxys
Posts: 26
Joined: Sat Sep 13, 2014 12:06 am

Re: Where to change amavisd listen interface?

Post by syntaxys »

So I did following …

On the ZCS host I opened a new transport option by editing the master.cf.in:

Code: Select all

[192.168.184.2]:20024 inet n - n - - smtpd
    -o smtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o smtpd_sasl_auth_enable=no
%%uncomment SERVICE:antispam%%>	-o content_filter=smtp-amavis:[%%zimbraLocalBindAddress%%]:10032
%%uncomment SERVICE:!antispam%%	-o content_filter=smtp:[%%zimbraLocalBindAddress%%]:10025
On the MX gateway host I tried those adjustments in main.cf:

Code: Select all

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    …
    check_policy_service inet:192.168.184.2:20024
The result was:

Code: Select all

Nov 29 10:21:17 hostname postfix/smtpd[28942]: warning: premature end-of-input on 192.168.184.2:20024 while reading input attribute name
Nov 29 10:21:18 hostname postfix/smtpd[28942]: warning: premature end-of-input on 192.168.184.2:20024 while reading input attribute name
Nov 29 10:21:18 hostname postfix/smtpd[28942]: warning: problem talking to server 192.168.184.2:20024: Success
with an additional tempfail respond to the sending MTA.

When I try …

Code: Select all

default_transport = smtp:192.168.184.2:20024
or …

Code: Select all

content-filter = smtp:192.168.184.2:20024
in main.cf on the MX gateway, then nothing is complained but the mails are running directly via lmtp into the mailboxes at the ZCS host:

Code: Select all

Return-Path: <sender@domain.tld>
Received: from a.b.c.d (LHLO mxgateway.domain.tld) (a.b.c.d) by
 zcs.domain.tld with LMTP; Fri, 29 Nov 2019 11:19:56 +0100 (CET)
X-Client-Addr: aaaa:bbbb:cccc:00::11
Sure that's the final purpose but I'd like to check them with amavisd first. It seems that I can't override the transport path which is given from LDAP, the MX gateway uses the same information as the ZCS.
Last edited by syntaxys on Sat Nov 30, 2019 5:37 am, edited 1 time in total.
syntaxys
Posts: 26
Joined: Sat Sep 13, 2014 12:06 am

Re: Where to change amavisd listen interface?

Post by syntaxys »

UPDATE:
In the meantime I tried several ways to inject the mails from the mx gateway into amavis queue at the zcs host but the only way it works, was a lookup table per recipient, i. e.
check_recipient_access hash:/etc/postfix/conf/transport_amavis
recipient@zcs.domain.tld FILTER smtp:[192.168.184.2]:20024


Is there any way to inject the queue by default? If it works, on the zcs host works everything well! I tried different methods on the mx main.cf with no success:
content-filter = smtp:[192.168.184.2]:20024
default_transport = smtp:[192.168.184.2]:20024
relayhost = [192.168.184.2]:20024

wtf?!? :?

Any idea is appreciated, thank you!
User avatar
JDunphy
Outstanding Member
Outstanding Member
Posts: 889
Joined: Fri Sep 12, 2014 11:18 pm
Location: Victoria, BC
ZCS/ZD Version: 9.0.0_P39 NETWORK Edition

Re: Where to change amavisd listen interface?

Post by JDunphy »

Interesting... I was looking at the local case here and the only thing that seems different is the /opt/zimbra/common/conf/tag_as_foreign.re so perhaps you need to add your ip and port so that it can be tagged and to process via amavis.

Wild guess on my part as I am just beginning to look into this.

Jim
syntaxys
Posts: 26
Joined: Sat Sep 13, 2014 12:06 am

Re: Where to change amavisd listen interface (jump into the AMaViSd queue)?

Post by syntaxys »

JDunphy wrote:Interesting... I was looking at the local case here and the only thing that seems different is the /opt/zimbra/common/conf/tag_as_foreign.re so perhaps you need to add your ip and port so that it can be tagged and to process via amavis.

Wild guess on my part as I am just beginning to look into this.

Jim
Thanks! That could be a solution, but on the MX-Gateway host is running a Postfix outside of ZCS because of the easier and faster configuration possibilities. It's just connected to the LDAP of the ZCS host for routing and mailbox information. In such a case it is normal that the MX-Gateway takes the standard route which is set to lmtp:zcs.domain.tld:7025 in each user account.

But I got it fixed! :D
The solution was just a simple transport table which is searched before the regular LDAP table, in main.cf on the MX-Gateway:
transport_maps = pcre:/etc/postfix/conf/transport, proxy:ldap:/etc/postfix/conf/ldap-transport.cf
And there just a wildcard:
/^.*$/ smtp:[192.168.184.2]:20024


Now the incoming mails leave the MX-Gateway per default into the amavisd queue and will be checked for spam and malware before delivering into the mailboxes.

I changed the main subject line of this thread, it was a little misleading. Guess others run into the same problem ...
User avatar
JDunphy
Outstanding Member
Outstanding Member
Posts: 889
Joined: Fri Sep 12, 2014 11:18 pm
Location: Victoria, BC
ZCS/ZD Version: 9.0.0_P39 NETWORK Edition

Re: Where to change amavisd listen interface (jump into the AMaViSd queue)?

Post by JDunphy »

I like that! Thanks for sharing.
Post Reply