<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Dear Greg,<br></div><div><br data-mce-bogus="1"></div><div>Thank you very much for your reply.</div><div><br data-mce-bogus="1"></div><div>I understand the risks involved with whitelisting senders, in our case it would just be an exception for our<br data-mce-bogus="1"></div><div>IT security experts, who regularly get emails containing security exploits, malware samples and other<br data-mce-bogus="1"></div><div>attachments that are otherwise blocked by our email filtering system.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>It's not such a big problem. I can just whitelist their addresses completely (since they are our security experts<br></div><div>it's no problem at all). I was just hoping that it would though be possible to somehow restrict a bit the whitelisting for</div><div>external traffic, so that only a few external addresses are allowed to send mails to them (completely unchecked). </div><div>All the other external mails containing malware/viruses would be kept in the quarantine system and only a notification</div><div>would be sent to them.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Anyway, thank you very much for all your time and great support.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Cheers<br data-mce-bogus="1"></div><div>Jan<br data-mce-bogus="1"></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Gregory Sloop" <gregs@sloop.net><br><b>To: </b>amavis-users@amavis.org<br><b>Sent: </b>Tuesday, January 8, 2019 5:09:47 PM<br><b>Subject: </b>Re: Whitelisting specific sender addresses for specific recipient addresses<br></blockquote></div><div data-marker="__QUOTED_TEXT__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><title>Re: Whitelisting specific sender addresses for specific recipient addresses</title>
<span style=" font-family:'Courier New'; font-size: 9pt;">Jan - <br>
I have a client that needed the essential features you were looking for.<br>
Essentially, allowing through banned attachments based on a sender+recipient pair.<br>
<br>
I'm sure it's possible to extend Amavis to do that - but it really looked as though it was a "feature" that was not looked upon with favor. So, even if I wrote it, it wouldn't get integrated into the code, and would need maintenance as Amavis changed etc - and that would be entirely on my shoulders.<br>
<br>
My approach was to handle it all externally. I have amavis configured to; for all banned files, send a report to a mailbox.<br>
I then pull those report messages from the mailbox and process them.<br>
I pull the details from the report [sender, recipient, sender IP etc]<br>
I then do a lookup in a simple text file and start matching.<br>
<br>
<br>
As I'm sure you're aware, sender addresses are trivially spoofed - and many readers of this list are probably having siezures right this second, at the thought of someone using them as criteria for allowing banned files through. :)<br>
<br>
And they're right - it's not a fool-poof method. But it works for my client well enough.<br>
And we don't *have* to only rely on the sender address, it's a pairing of sender+recipient.<br>
And I can also trust the sender domain or IP address. [Which isn't trivially forged.]<br>
<br>
[I can also control the types of attachments allowed - so really, it's a match of source-ip/domain + sender + recipient + attachment-type.]<br>
<br>
I setup the script to run every few minutes and the system releases any quarantined messages to the original recipients. [So, there's some delay - in our case, a few minutes between runs. But it's pretty minimal.]<br>
<br>
All the other messages stay in quarantine, and are purged via cron once they're 30+d old. That way if something isn't auto-released but we still need, we can manually do so.<br>
<br>
We've been running this for years now, and by and large we're pretty happy. I *think* we've had a case or two recently, where one of those senders was infected with some malware/virus and it sent attachments that were forwarded through to an end user via this system - so it does have its risk. But, IMO, it's far better than the alternatives - No attachments at all, manual release of everything OR allow all attachments all the time. [I'm not the guy who manages the mail system day-to-day - so I should probably verify that it actually happened, rather than saying it did - but in any case it is a possible outcome. In our case, other layers caught those attachments and prevented any harm.]<br>
<br>
-Greg<br>
<br>
<br>
<span style=" color: #800000;"><b>EJ> Hi Dominic,<br>
<br>
EJ> thank you for your quick reply.<br>
<br>
EJ> I've tried your proposal using the<br>
EJ> $per_recip_whitelist_sender_lookup_tables<br>
EJ> but unfortunately it only seems to affect the spam checking. The virus/banned/header<br>
EJ> checks were still active after setting this variable.<br>
<br>
EJ> I've tried using the following configuration:<br>
<br>
EJ> $per_recip_whitelist_sender_lookup_tables = {<br>
EJ> </b></span></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => ['news@foobar.com']<br>
EJ> };<br>
<br>
EJ> Cheers<br>
EJ> Jan<br>
<br>
EJ> ----- Original Message -----<br>
EJ> | From: "Dominic Raferd" <</b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:dominic@timedicer.co.uk" target="_blank">dominic@timedicer.co.uk</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>><br>
EJ> | To: </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:amavis-users@amavis.org" target="_blank">amavis-users@amavis.org</a><br>
<span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>EJ> | Sent: Tuesday, January 8, 2019 9:47:59 AM<br>
EJ> | Subject: Re: Whitelisting specific sender addresses for specific recipient addresses<br>
<br>
EJ> | On Tue, 8 Jan 2019 at 08:37, Engels, Jan <</b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:jan.engels@desy.de" target="_blank">jan.engels@desy.de</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>> wrote:<br>
<br>
|>> Hi everyone,<br>
<br>
|>> I'm currently trying to setup amavisd-new for whitelisting emails **from** a<br>
|>> specific sender address **to** a specific recipient address (under CentOS 7).<br>
|>> By whitelist I mean no virus/banned/header checks and no spam tagging. The<br>
|>> whitelisting should however only apply for specific senders on a per-recipient<br>
|>> basis.<br>
<br>
|>> Using the @score_sender_maps I can easily assign custom spam scores on a<br>
|>> per-recipient basis, as shown in the default amavisd.conf:<br>
<br>
|>> @score_sender_maps = ({ # a by-recipient hash lookup table,<br>
|>> # results from all matching recipient tables are summed<br>
<br>
|>> ## per-recipient personal tables (NOTE: positive: black, negative: white)<br>
|>> # </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'bla-mobile.press@example.com' => 10.0}],<br>
|>> # </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user3@example.com" target="_blank">'user3@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'.ebay.com' => -3.0}],<br>
|>> # </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user4@example.com" target="_blank">'user4@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'cleargreen@cleargreen.com' => -7.0,<br>
|>> # '.cleargreen.com' => -5.0}],<br>
|>> #...<br>
|>> });<br>
<br>
|>> The problem is that using the *_lovers_maps variables does not work using the<br>
|>> same syntax, i.e. I've tried for example:<br>
<br>
|>> @virus_lovers_maps = ({ # a by-recipient hash lookup table,<br>
|>> </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'news@foobar.com' => 1}],<br>
|>> });<br>
<br>
|>> @banned_files_lovers_maps = ({ # a by-recipient hash lookup table,<br>
|>> </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'news@foobar.com' => 1}],<br>
|>> });<br>
<br>
|>> @bad_header_lovers_maps = ({ # a by-recipient hash lookup table,<br>
|>> </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'news@foobar.com' => 1}],<br>
|>> });<br>
<br>
|>> or using the bypass_*checks_maps variables:<br>
<br>
|>> @bypass_virus_checks_maps = ({<br>
|>> </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'news@foobar.com' => 1}],<br>
|>> });<br>
<br>
|>> @bypass_banned_checks_maps = ({<br>
|>> </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'news@foobar.com' => 1}],<br>
|>> });<br>
<br>
|>> @bypass_header_checks_maps = ({<br>
|>> </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:'user1@example.com" target="_blank">'user1@example.com'</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b> => [{'news@foobar.com' => 1}],<br>
|>> });<br>
<br>
|>> and the result in both variants is that **all** emails sent to </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:user1@example.com" target="_blank">user1@example.com</a><br>
<span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>|>> get whitelisted (not only the ones coming from </b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:news@foobar.com" target="_blank">news@foobar.com</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>).<br>
<br>
|>> Is there some way to get the same behaviour using the *_lovers_maps or bypass_*<br>
|>> variables as with the @score_sender_maps variable (i.e on a per-recipient<br>
|>> basis)?<br>
<br>
|>> Any help would be greatly appreciated.<br>
EJ> | <br>
EJ> | I think you want: $per_recip_whitelist_sender_lookup_tables (although<br>
EJ> | it is marked as deprecated)<br><br></b></span></blockquote></div></div></body></html>