Bypass banned content check from localhost , and bypass incoming badh problem

[weber at zackbummfertig.de]

any idea patrick ?

Am 2013-01-24 15:26, schrieb weber at zackbummfertig.de:
> (internet)---(server -> aviramailgate -> amavis -> postfix (clamav)
> -> dovecot
>
>
> (mails arrive on port 25 and go amavis)
>
> /etc/postfix/master.cf =
>
> smtpd     pass  -       -       n       -       -       smtpd
>         -o content_filter=avira-smtp:[127.0.0.1]:10027
> #       -o content_filter=lmtp-amavis:[127.0.0.1]:10024
>         -o cleanup_service_name=pre-cleanup
>
>
>
> 127.0.0.1:10025 inet    n   -   -   -   - smtpd
>         -o cleanup_service_name=cleanup
>         -o content_filter=dspam-lmtp:unix:/var/run/dspam/dspam.sock
>         -o local_header_rewrite_clients=
>         -o local_recipient_maps=
>         -o mynetworks=127.0.0.0/8
>         -o mynetworks_style=host
>         -o
> 
> receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
>         -o relay_recipient_maps=
>         -o smtp_send_xforward_command=yes
>         -o smtpd_authorized_xforward_hosts=127.0.0.0/8
>         -o smtpd_client_connection_count_limit=0
>         -o smtpd_client_connection_rate_limit=0
>         -o smtpd_client_restrictions=permit_mynetworks,reject
>         -o smtpd_data_restrictions=reject_unauth_pipelining
>         -o smtpd_delay_reject=no
>         -o smtpd_end_of_data_restrictions=
>         -o smtpd_error_sleep_time=0
>         -o smtpd_hard_error_limit=1000
>         -o smtpd_helo_restrictions=
>         -o smtpd_recipient_restrictions=permit_mynetworks,reject
>         -o smtpd_restriction_classes=
>         -o smtpd_sender_restrictions=
>         -o smtpd_soft_error_limit=1001
>         -o strict_rfc821_envelopes=yes
>
>
> 127.0.0.1:10026 inet n  -       n       -       -       smtpd
>         -o content_filter=
>         -o local_header_rewrite_clients=
>         -o local_recipient_maps=
>         -o mynetworks=127.0.0.0/8
>         -o mynetworks_style=host
>         -o
> 
> receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_milters
>         -o relay_recipient_maps=
>         -o smtp_send_xforward_command=yes
>         -o smtpd_authorized_xforward_hosts=127.0.0.0/8
>         -o smtpd_client_connection_count_limit=0
>         -o smtpd_client_connection_rate_limit=0
>         -o smtpd_client_restrictions=permit_mynetworks,reject
>         -o smtpd_data_restrictions=reject_unauth_pipelining
>         -o smtpd_delay_reject=no
>         -o smtpd_end_of_data_restrictions=
>         -o smtpd_error_sleep_time=0
>         -o smtpd_hard_error_limit=1000
>         -o smtpd_helo_restrictions=
>         -o smtpd_recipient_restrictions=permit_mynetworks,reject
>         -o smtpd_restriction_classes=
>         -o smtpd_sender_restrictions=
>         -o smtpd_soft_error_limit=1001
>         -o strict_rfc821_envelopes=yes
>
>
>
>
>
> -------------------------------------------------------------------
>
> /etc/amavisd.conf =
>
> $inet_socket_port = 10024;
>
>
> (i think i dont touched this block:)
> $policy_bank{'MYNETS'} = {   # mail originating from @mynetworks
>   originating => 1,  # is true in MYNETS by default, but let's make
> it explicit
>   os_fingerprint_method => undef,  # don't query p0f for internal 
> clients
>   bypass_banned_checks_maps => [1],
> };
>
>
> # it is up to MTA to re-route mail from authenticated roaming users 
> or
> # from internal hosts to a dedicated TCP port (such as 10026) for 
> filtering
> $interface_policy{'10026'} = 'ORIGINATING';
>
>
> $policy_bank{'ORIGINATING'} = {  # mail supposedly originating from 
> our users
>   originating => 1,  # declare that mail was submitted by our smtp 
> client
>   allow_disclaimers => 1,  # enables disclaimer insertion if 
> available
>   # notify administrator of locally originating malware
>   virus_admin_maps => ["virusalert\@$mydomain"],
>   spam_admin_maps  => ["virusalert\@$mydomain"],
>   warnbadhsender   => 1,
>   # forward to a smtpd service providing DKIM signing service
>
>   #### weber change start
>   forward_method => 'smtp:[127.0.0.1]:10026',
>   ### weber change stop
>
>   # force MTA conversion to 7-bit (e.g. before DKIM signing)
>   smtpd_discard_ehlo_keywords => ['8BITMIME'],
>   bypass_banned_checks => [1],  # allow sending any file names and 
> types
>   final_bad_header_destiny => D_PASS,
>   terminate_dsn_on_notify_success => 0,  # don't remove 
> NOTIFY=SUCCESS option
> };
>
>
> ### weber change start
> $notify_method  = 'smtp:[127.0.0.1]:10026';
> $forward_method = 'smtp:[127.0.0.1]:10025';  # set to undef with 
> milter!
> ### weber change stop
>
>
>
>
>
> Do you need more from my config files?
>
>
> thanks
>
> marko
>
>
>
>
>
>
>
>
>
>
> Am 2013-01-24 15:06, schrieb Patrick Ben Koetter:
>> * weber at zackbummfertig.de <weber at zackbummfertig.de>:
>>> Patrick,
>>> thanks for answering, but it dont work for me.
>>> i still get "Banned content messages" and mail is not sent out...
>>> Do i also have to set something in the master.cf to enable this
>>> policy_bank ORIGINATING ?
>>
>>
>> Please post config that shows how you route messages from Postfix 
>> (?) into
>> amavis and the relevant parts in amavis that route those messages to 
>> the
>> policy bank including its settings.
>>
>> p at rick
>>
>>> marko, from hamburg
>>>
>>> (sorry,hatte vorhin nur auf reply gedrückt)
>>
>> Kein Thema. Hatte ich mir schon gedacht.
>>
>>
>>>
>>> Am 2013-01-24 13:11, schrieb Patrick Ben Koetter:
>>> >* weber at zackbummfertig.de <weber at zackbummfertig.de>:
>>> >>i want my users to be able to send banned content files.
>>> >>
>>> >>my goal is to have a map in amavis where i can set which user is
>>> >>allowed to send banned content.
>>> >>
>>> >> ferdinand at domain.de is allowed to send,
>>> >> ulrike at domain.de is NOT allowed to send,
>>> >>
>>> >>banned content.
>>> >
>>> >
>>> >I recommend you let local users send over submission (587) port
>>> >and create a
>>> >dedicated policy for those senders:
>>> >
>>> >$policy_bank{'ORIGINATING'} = {
>>> >    originating => 1,
>>> >    bypass_spam_checks_maps   => [1],
>>> >    bypass_banned_checks_maps => [1],
>>> >    final_virus_destiny => D_REJECT,
>>> >    final_bad_header_destiny => D_PASS,
>>> >    terminate_dsn_on_notify_success => 0,
>>> >};
>>> >
>>> >p at rick
>>>