From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.comp.sysutils.supervision.general/1133 Path: news.gmane.org!not-for-mail From: "George Georgalis" Newsgroups: gmane.comp.sysutils.supervision.general Subject: Re: problems with QMAILQUEUE and reading stdin Date: Mon, 29 May 2006 16:48:36 -0400 Message-ID: <20060529204836.GA17195@run.galis.org> References: <20060529015814.GA15937@run.galis.org> <1148880181.19941.3.camel@avirat> <1148905142.19941.57.camel@avirat> <20060529133744.GB15937@run.galis.org> <20060529154932.GA7293@run.galis.org> NNTP-Posting-Host: main.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: sea.gmane.org 1148935728 25351 80.91.229.2 (29 May 2006 20:48:48 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Mon, 29 May 2006 20:48:48 +0000 (UTC) Original-X-From: supervision-return-1369-gcsg-supervision=m.gmane.org@list.skarnet.org Mon May 29 22:48:45 2006 Return-path: Envelope-to: gcsg-supervision@gmane.org Original-Received: from antah.skarnet.org ([212.85.147.14]) by ciao.gmane.org with smtp (Exim 4.43) id 1FkofG-0006lQ-TY for gcsg-supervision@gmane.org; Mon, 29 May 2006 22:48:39 +0200 Original-Received: (qmail 23592 invoked by uid 76); 29 May 2006 20:48:59 -0000 Mailing-List: contact supervision-help@list.skarnet.org; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Archive: Original-Received: (qmail 23587 invoked from network); 29 May 2006 20:48:59 -0000 Original-To: supervision@list.skarnet.org Mail-Followup-To: supervision@list.skarnet.org Content-Disposition: inline In-Reply-To: <20060529154932.GA7293@run.galis.org> Xref: news.gmane.org gmane.comp.sysutils.supervision.general:1133 Archived-At: On Mon, May 29, 2006 at 11:49:32AM -0400, George Georgalis wrote: >On Mon, May 29, 2006 at 10:38:19AM -0400, Charlie Brady wrote: >>Add a comment about reading stdin if you really think you need it. > >yeah. that's what I did. I'll post the new ipsvd/QMAILQUEUE >program here after some more light mods and testing. Well here it is, http://galis.org/script/prequeue not yet added to a version control management yet and there is not a lot of mail on this Memorial Day, so testing is incomplete, but this is a rewrite of the program I've been using for active smtp filtering, for the past few years, so it may be okay. Comments welcome and encouraged. I tried or looked at qpsmtpd, simscan, qmail-qfilter and qmail-spp; but for one reason or another stuck with my own script. http://smtpd.develooper.com/ http://www.inter7.com/simscan/ http://untroubled.org/qmail-qfilter/ http://qmail-spp.sourceforge.net I'd really like it if qmail-spp made it easy to make "entire email" filter plugins, that would probably be the best way. Sorry, no doc on entire deployment (that would be a big project), but maybe if you are on this list you can figure it out. Besides the djbdns lookups of RBL lists, I'm using ipsvd (a daemontools replacement) under runsvdir and maintain a peers.cdb to run qmail with clamd and spamassassin; and there is an openbsd spamd front end. http://smarden.org/ipsvd/ http://www.openbsd.org/papers/bsdcan05-spamd/ I have a patch to make spamd more politically correct, but it's not even applied to my own production yet, eventually it will show up somewhere in here http://galis.org/mkinst/patch/ That's about it. Enjoy. Peace. // George #!/bin/sh # # $Id$ # $GeorgalisG: prequeue$ # # This script functions as a QMAILQUEUE program for "in SMTP" (active) # filtering of email. It accepts stdin from qmail-smtpd, and expects # associated environmentals. After it tests with clamav, it then tests # the email with RBLs and spamassassin. Addition or removal of tests is # a simple mod. Rejected messages are saved in a maildir (easy enough # to disable). There may be better way (such as umask and supplementary # groups), but for now I run the various scanners as user qmaild so all # programs have the read/write access they need. # # As root, run this once, to initialize # pq="prequeue" # install -o qmaild -g qmail -m 2770 -d ~qmaild/$pq ~qmaild/$pq/new ~qmaild/$pq/tmp ~qmaild/$pq/cur # # LICENSE: wrote this file. As long as you retain this # notice, you can do anything with it or buy me a beer -- George Georgalis # # exit 31 = permanently refuse # exit 71 = temporarily refuse # # TODO deliver failures, with modified header to, and only to, valid users. set -e # exit on internal error ptr () { # reverse a dotted quad or subnet rev="$(echo "$1" | cut -d\. -f1).$2" ; ip="$(echo "$1" | cut -d\. -f2-)" [ "$ip" = "$1" ] && echo "${rev}" || ptr $ip $rev ;} failforward () { # update ipsvd-instruct(5), cdb regenerated separately umask 002 ; echo "$peerm $opinion" >$peerd/$TCPREMOTEIP echo "$(basename $0): failforward: $opinion" 1>&2 rm "$tmp" ; exit 31 ;} # permanently refuse fail () { # mark the message with failure report and refuse formail -f -b -A "$opinion" <"$tmp" | maildir "$pq" >/dev/null # save in maildir for manual delete rm "$tmp" ; exit 31 ;} # permanently refuse drop () { echo "$(basename $0): deny: $opinion" 1>&2 rm "$tmp" ; exit 31 ;} # permanently refuse warn () { # error, mark the message, save and refuse formail -f -b -A "$opinion" <"$tmp" >"${tmp}-$$" echo "$(basename $0): warn: $opinion" 1>&2 mv "${tmp}-$$" ./ && rm "$tmp" # save for review # should monitor $PWD, or notify when warn is run... exit 71 ;} # temporarily refuse pass () { # mark it and pass to the regular queue formail -f -b -A "$opinion" <"$tmp" | ./bin/qmail-queue ; testexit=$? rm "$tmp" ; exit $testexit ;} # return whatever qmail-queue exits as # somehow qmail-queue gets descriptor 1 from qmail-smtpd.... cd /var/qmail host=$(cat control/me) ptrip=$(ptr ${TCPREMOTEIP}) now="$(date "+%x %r %Z")" pq="prequeue" # a maildir with qmaild write perms peerd="supervise/qmail-smtpd/peers" # prepare to update ipsvd-cdb(8) config peerm='#!/bin/sh\necho "220 smtp port"\necho "250 smtp host"\necho "550' # $pq/tmp is a tmp for this operation, $pq is tmp for this program # $pq is also a maildir for messages rejected by this program tmp="$pq/$(/usr/pkg/bin/safecat $pq/tmp $pq)" || exit 71 # < http://galis.org/ cell:646-331-2027 mailto:george@galis.org