<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Good morning,</p>
<p><br /></p>
<p>Could perhaps be, that Amavis is not storing the XCLIENT variable LOGIN (<a href="http://www.postfix.org/XCLIENT_README.html">http://www.postfix.org/XCLIENT_README.html</a>) in mail_via_smtp() where should handle LOGIN XCLIENT attribute?.</p>
<p> my(@params) = map<br /> { my($n,$v) = @$_;<br /> # Postfix since version 20060610 uses xtext-encoded (RFC 3461)<br /> # strings in XCLIENT and XFORWARD attribute values, previous<br /> # versions expected plain text with neutered special characters;<br /> # see README_FILES/XFORWARD_README<br /> if (defined $v && $v ne '') {<br /> $v =~ s/[^\041-\176]/?/gs; # isprint<br /> $v =~ s/[<>()\\";\@]/?/gs; # other chars that are special in hdrs<br /> # postfix/src/smtpd/smtpd.c NEUTER_CHARACTERS<br /> $v = xtext_encode($v);<br /> substr($v,255) = '' if length($v) > 255; # chop xtext, not nice<br /> }<br /> !defined $v || $v eq '' || !$xfwd_supp_opt{$n} ? () : ("$n=$v") }<br /> ( ['ADDR',$cl_ip], ['NAME',$msginfo->client_name],<br /> ['PORT',$msginfo->client_port], ['PROTO',$msginfo->client_proto],<br /> ['HELO',$msginfo->client_helo], ['SOURCE',$msginfo->client_source],<br /> ['IDENT',$msginfo->queue_id] );</p>
<p>Perhaps it needs a :</p>
<p>['LOGIN',$msginfo->auth_user] and then through XCLIENT or XFORWARD from Amavis would send back again to Postfix receiving smtpd instance the LOGIN parameter in order for it (origin sasl_username) to be received in the Postfix smtpd receiving instance through XCLIENT?.</p>
<p><br /></p>
<p>What do you think?. Perhaps it has not been considered for some reason?.</p>
<p><br /></p>
<p>Cheers,</p>
<p><br /></p>
<div>---<br />
<table class="scale" border="0" width="560" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td align="left" valign="top">
<table class="scale" border="0" width="440" cellspacing="0" cellpadding="0" align="left">
<tbody>
<tr>
<td class="firmasarenet" style="padding: 0px 0px 0px 0px;" align="left" valign="top">
<div class="imgsarenet" style="margin: 0 0 15px 0;"><img style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 22px; line-height: 22px; color: #e20e30;" src="https://www.sarenet.es/estaticos/LogoSarenetEmails.png" alt="sarenet" /></div>
<div class="titulosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: bold; font-size: 15px; line-height: 17px; color: #222222;"><strong>Egoitz Aurrekoetxea</strong></div>
<div class="dptosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; line-height: 17px; color: #333333;">Dpto. de sistemas</div>
<div class="textosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; line-height: 17px; color: #333333;">944 209 470<br />Parque Tecnológico. Edificio 103<br />48170 Zamudio (Bizkaia)</div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 1.2;"><a id="mailto" style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="mailto:egoitz@sarenet.es"><label id="label_email">egoitz@sarenet.es</label></a></div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 15px;"><a style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="http://www.sarenet.es">www.sarenet.es</a></div>
<br />
<div class="imprimirsarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 10px; color: #a0c361;">Antes de imprimir este correo electrónico piense si es necesario hacerlo.</div>
</td>
</tr>
</tbody>
</table>
<table class="scale" border="0" width="120" cellspacing="0" cellpadding="0" align="right">
<tbody>
<tr>
<td style="font-size: 1px; line-height: 36px;" height="36"> </td>
</tr>
<tr>
<td style="padding: 0px 0px 0px 0px;" align="center" valign="middle"><img style="font-family: Helvetica, Arial, sans-serif; background: #EFEFEF; font-weight: bold; font-size: 14px; text-align: center; color: #999999; width: 118px;" src="https://www.sarenet.es/estaticos/sello-25-sarenet.jpg" alt="25 años" width="118" height="117" /></td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="font-size: 1px; line-height: 30px;" height="30"> </td>
</tr>
</tbody>
</table>
</div>
<p><br /></p>
<p>El 2021-05-20 09:38, Egoitz Aurrekoetxea escribió:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><br />
<table style="background-color: yellow; border: 1px solid red; font-family: Arial; font-size: 12px; font-weight: bold;" width="100%">
<tbody>
<tr>
<td><span style="color: red;">ATENCION:</span> Este correo se ha enviado desde fuera de la organización. No pinche en los enlaces ni abra los adjuntos a no ser que reconozca el remitente y sepa que el contenido es seguro.</td>
</tr>
</tbody>
</table>
<br /> <!-- meta ignored -->
<p>Good morning,</p>
<p><br /></p>
<p>I was trying to implement different policy banks in a testing env, in order to get :</p>
<p><br /></p>
<p>+ Policy bank (<span style="font-size: 8pt;">FROM-THE-REST-OF-THE-INTERNET</span>) -> Incoming external mail (from the Internet in general) to be always tagged with a modified version of Anomy Sanitizer and scanned for cleaning virus and spam.</p>
<p>+ Policy bank (<span style="font-size: 8pt;">COMING-FROM-CUSTOMER-1</span> OR <span style="font-size: 8pt;">COMING-FROM-CUSTOMER-2) -></span> Incoming mail coming from well known ips, to be tagged with Anomy Sanitizer just in case the email goes for a domain that is not one of the domains that go out through that well known ips. For instance, comes from the ips of custoner1.net and goes for customer2.net domain, then tag with Anomy Sanitizer just for that "non customer1.net domain".</p>
<p>+ Policy bank (<span style="font-size: 8pt;">OUTGOING-SIGN</span>) -> Outgoing mail generated by a mua that will have previously be authenticated, to be signed with DKIM and to have a disclaimer set with Altermime. Have created a dedicated port for this policy bank.</p>
<p><br /></p>
<p>I'm sending mail traffic to Amavis, using XCLIENT extension (<a href="http://www.postfix.org/XCLIENT_README.html" target="_blank" rel="noopener noreferrer">http://www.postfix.org/XCLIENT_README.html</a>) and seems that Amavis, is identifying properly (source ip connected to Postfix based and transferred to Amavis with XCLIENT) which policy bank should apply to each mail.It's still not working totally (the maps, the Sanitizer part and so in each policy bank...), because I assume I have entered some config variable incorrectly, perhaps in the hash of the config of the policy bank, but that it's not worrying me at present.</p>
<p><br /></p>
<p>BUT, I have a big problem, that am not able to get solved for just outgoing mail (third commented case). In the Postfix smtpd instance where returns mail handled by Amavisd, I needed to get passed the original SASL user with XCLIENT. The reason of this, is because depending on the sasl authenticated user (in Postfix, prior to Amavis, an authenticated MUA), I need to apply it's corresponding FILTER action in Postfix (yes even it has returned from Amavis and we are in the smtpd where we receive the returning traffic to Postfix by Amavis), in the smtpd instance where Amavis is returning scanned/tagged/signed traffic. I'm not able of receiving that sasl_username with XCLIENT back from Amavis in the smtpd returning instance. Is it possible to do that?. I receive other XCLIENT params, like (in this case) the Postfix ip that feeded Amavisd, but I needed the sasl_username the MUA used.</p>
<p><br /></p>
<p>I know I could tell Postfix to enter a heder in the message with the authenticated user, once a user authenticates, but I prefer not doing it because it could become faked.</p>
<p><br /></p>
<p>I have seen that Amavis has or had the possibility of authenticating to the returning smtpd instance (that could be OK too... in case Amavisd XCLIENT does not pass sasl_username to the returning smtpd instance), but I have seen it commented in the Amavisd code in the mail_via_smtp function. Concretely :</p>
<p><span style="font-size: 8pt;"><em> $auth_capable = 1;</em></span><br /><span style="font-size: 8pt;"><em># my $sasl = Authen::SASL->new(</em></span><br /><span style="font-size: 8pt;"><em># 'callback' => { 'user' => $auth_user, 'authname' => $auth_user,</em></span><br /><span style="font-size: 8pt;"><em># 'pass' => $msginfo->auth_pass });</em></span><br /><span style="font-size: 8pt;"><em># $smtp_handle->auth($sasl) or die "sending AUTH, user=$auth_user\n";#flush</em></span><br /><span style="font-size: 8pt;"><em> do_log(0,"Sorry, AUTH not supported in this version of amavisd!");</em></span><br /><span style="font-size: 8pt;"><em> section_time($which_section);</em></span></p>
<p><br /></p>
<p>So, is it possible, is some manner, to receive in the Postfix instance of smtpd, where you receive the returning back traffic from Amavisd, the sasl_username with which Postfix authenticated the user for allowing to send that email, now coming tagged/signed/whatever from Amavis?.</p>
<p><br /></p>
<p>I do paste the commented created config below in case it could help.</p>
<p><br /></p>
<p>Very thankful for you time :)</p>
<p>Best regards,</p>
<p><br /></p>
<p><span style="font-size: 8pt;">============================================================================================================================================</span></p>
<p><span style="font-size: 8pt;"><em>$interface_policy{'10025'} = 'OUTGOING-SIGN';</em></span></p>
<p><br /><span style="font-size: 8pt;"><em>@client_ipaddr_policy= (</em></span><br /><span style="font-size: 8pt;"><em>[qw(192.168.14.10)] => 'COMING-FROM-CUSTOMER-1', [qw(192.168.14.11)] => 'COMING-FROM-CUSTOMER-2', [qw(192.168.14.12)] => 'COMING-FROM-CUSTOMER-3', [qw(0.0.0.0)] => 'FROM-THE-REST-OF-THE-INTERNET'</em></span><br /><span style="font-size: 8pt;"><em>);</em></span><br /><br /><span style="font-size: 8pt;"><em>$policy_bank{'FROM-THE-REST-OF-THE-INTERNET'} = {</em></span><br /><span style="font-size: 8pt;"><em>forward_method => 'smtp:*:10026',</em></span><br /><span style="font-size: 8pt;"><em>enable_anomy_sanitizer => 1,</em></span><br /><span style="font-size: 8pt;"><em>anomy_sanitizer_args => [ [qw(/usr/local/etc/sanitizer.cfg)] ],</em></span><br /><span style="font-size: 8pt;"><em>defang_spam => 1,</em></span><br /><br /><span style="font-size: 8pt;"><em>defang_maps_by_ccat => [ {'CC_CLEAN' => { '@.' => 'anomy' }, 'CC_SPAM' => { '@.' => 'anomy' }, 'CC_BANNED' => { '@.' => 'anomy' }, 'CC_VIRUS' => { '@.' => 'anomy' } }],</em></span><br /><span style="font-size: 8pt;"><em>};</em></span><br /><br /><span style="font-size: 8pt;"><em>$policy_bank{'COMING-FROM-CUSTOMER-1'} = {</em></span><br /><span style="font-size: 8pt;"><em>forward_method => 'smtp:*:10026',</em></span><br /><span style="font-size: 8pt;"><em>bypass_spam_checks_maps => [ { '@.' } ],</em></span><br /><span style="font-size: 8pt;"><em>bypass_banned_checks_maps => [ { '@.' } ],</em></span><br /><span style="font-size: 8pt;"><em>enable_anomy_sanitizer => 1,</em></span><br /><span style="font-size: 8pt;"><em>anomy_sanitizer_args => [ [qw(/usr/local/etc/sanitizer.cfg)] ],</em></span><br /><span style="font-size: 8pt;"><em>defang_spam => 1,</em></span><br /><br /><span style="font-size: 8pt;"><em>defang_maps_by_ccat => [ {'CC_CLEAN' => { '@.' => 'anomy', '@ramattack.net' => '' }, 'CC_SPAM' => { '@.' => 'anomy', '@ramattack.net' => '' }, 'CC_BANNED' => { '@.' => 'anomy', '@ramattack.net' => '' }, 'CC_VIRUS' => { '@.' => 'anomy', '@ramattack.net' => ''} }],</em></span><br /><br /><span style="font-size: 8pt;"><em>dkim_signature_options_bysender_maps => [ { } ],</em></span><br /><span style="font-size: 8pt;"><em>};</em></span><br /><br /><span style="font-size: 8pt;"><em>$policy_bank{'COMING-FROM-CUSTOMER-2'} = {</em></span><br /><span style="font-size: 8pt;"><em>forward_method => 'smtp:*:10026',</em></span><br /><span style="font-size: 8pt;"><em>bypass_spam_checks_maps => [ { '@.' } ],</em></span><br /><span style="font-size: 8pt;"><em>bypass_banned_checks_maps => [ { '@.' } ],</em></span><br /><br /><span style="font-size: 8pt;"><em>enable_anomy_sanitizer => 1,</em></span><br /><span style="font-size: 8pt;"><em>anomy_sanitizer_args => [ [qw(/usr/local/etc/sanitizer.cfg)] ],</em></span><br /><span style="font-size: 8pt;"><em>defang_spam => 1,</em></span><br /><br /><span style="font-size: 8pt;"><em>defang_maps_by_ccat => [ {'CC_CLEAN' => { '@.' => 'anomy', '@sarenet.es' => '' }, 'CC_SPAM' => { '@.' => 'anomy', '@sarenet.es' => '' }, 'CC_BANNED' => { '@.' => 'anomy', 'sarenet.es' => '' }, 'CC_VIRUS' => { '@.' => 'anomy', '@sarenet.es' => ''} }],</em></span><br /><br /><span style="font-size: 8pt;"><em>dkim_signature_options_bysender_maps => [ { } ],</em></span><br /><span style="font-size: 8pt;"><em>};</em></span><br /><br /><span style="font-size: 8pt;"><em>$policy_bank{'OUTGOING-SIGN'} = {</em></span><br /><span style="font-size: 8pt;"><em>$forward_method = 'smtp:*:10027',</em></span><br /><span style="font-size: 8pt;"><em>bypass_spam_checks_maps => [ { '@.' } ],</em></span><br /><span style="font-size: 8pt;"><em>bypass_banned_checks_maps => [ { '@.' } ],</em></span><br /><span style="font-size: 8pt;"><em>enable_anomy_sanitizer => 0,</em></span><br /><span style="font-size: 8pt;"><em>altermime => '/usr/bin/altermime',</em></span><br /><span style="font-size: 8pt;"><em>altermime_args_disclaimer => [ [qw(--verbose --disclaimer=/etc/firmas_corporativas/disclaimer-_OPTION_.txt --disclaimer-html=/etc/firmas_corporativas/disclaimer-_OPTION_.html)] ],</em></span><br /><span style="font-size: 8pt;"><em>defang_maps_by_ccat => [ { 'CC_CATCHALL' => { '@.' => 'disclaimer' } } ],</em></span><br /><span style="font-size: 8pt;"><em>disclaimer_options_bysender_maps => [ { 'sarenet.es' => 'sarenet.es', 'ramattack.net' => 'ramattack.net' } ],</em></span><br /><span style="font-size: 8pt;"><em>allow_disclaimers => 1,</em></span><br /><span style="font-size: 8pt;"><em>dkim_signature_options_bysender_maps => [ { 'sarenet.es' => {ttl => 21*24*3600, c => 'simple/simple'}, 'ramattack.net' => {ttl => 21*24*3600, c => 'simple/simple'}} ],</em></span><br /><span style="font-size: 8pt;"><em>};</em></span></p>
<p><br /></p>
<p><span style="font-size: 8pt;">============================================================================================================================================</span></p>
<p><br /></p>
<p>--</p>
<div>
<table class="scale" border="0" width="560" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td align="left" valign="top">
<table class="scale" border="0" width="440" cellspacing="0" cellpadding="0" align="left">
<tbody>
<tr>
<td class="firmasarenet" style="padding: 0px 0px 0px 0px;" align="left" valign="top">
<div class="imgsarenet" style="margin: 0 0 15px 0;"><span style="font-size: 22px;"><img style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 22px; line-height: 22px; color: #e20e30;" src="https://www.sarenet.es/estaticos/LogoSarenetEmails.png" alt="sarenet" /></span></div>
<div class="titulosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: bold; font-size: 15px; line-height: 17px; color: #222222;"><strong>Egoitz Aurrekoetxea</strong></div>
<div class="dptosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; line-height: 17px; color: #333333;">Dpto. de sistemas</div>
<div class="textosarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; line-height: 17px; color: #333333;">944 209 470<br />Parque Tecnológico. Edificio 103<br />48170 Zamudio (Bizkaia)</div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 1.2;"><span style="font-size: 12px;"><a id="mailto" style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="mailto:egoitz@sarenet.es"><label id="label_email">egoitz@sarenet.es</label></a></span></div>
<div class="lnksarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 12px; color: #007ac4; line-height: 15px;"><span style="font-size: 12px;"><a style="font-size: 12px; color: #007ac4; text-decoration: underline;" href="http://www.sarenet.es" target="_blank" rel="noopener noreferrer">www.sarenet.es</a></span></div>
<br />
<div class="imprimirsarenet" style="font-family: Helvetica, Arial, sans-serif; font-weight: normal; font-size: 10px; color: #a0c361;">Antes de imprimir este correo electrónico piense si es necesario hacerlo.</div>
</td>
</tr>
</tbody>
</table>
<table class="scale" border="0" width="120" cellspacing="0" cellpadding="0" align="right">
<tbody>
<tr>
<td style="font-size: 1px; line-height: 36px;" height="36"> </td>
</tr>
<tr>
<td style="padding: 0px 0px 0px 0px;" align="center" valign="middle"><span style="font-size: 14px;"><img style="font-family: Helvetica, Arial, sans-serif; background: #EFEFEF; font-weight: bold; font-size: 14px; text-align: center; color: #999999; width: 118px;" src="https://www.sarenet.es/estaticos/sello-25-sarenet.jpg" alt="25 años" width="118" height="117" /></span></td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="font-size: 1px; line-height: 30px;" height="30"> </td>
</tr>
</tbody>
</table>
</div>
</blockquote>
</body></html>