bypass spam filters for certain mail addresses

I am looking for a way to bypass virus checks on mail from a certain mail user (actually system mail sent from a process that we have, so we can trust it).

I have been playing with the @bypass spam_checksacl = qw( sysadmin@xxx.com ); entry in /etc/amavisd.conf but this doesn't seem to bypass as I would expect.

Does anyone know if this file might be over riden else where or perhaps if I can bypass in another way?

Cheers

G5 XServe, Mac OS X (10.4.2)

Posted on Aug 10, 2006 8:55 PM

Reply
9 replies

Aug 10, 2006 11:52 PM in response to DylanPenhale

Greetings
there is probably more than one way to skin a cat.
here is a postfix only method however i'm not sure if it will pass all before amavid. so see the snippit from the amavisd.conf below.

main.cf
smtpd_recipient_restrictions = hash:/etc/postfix/spamlovers, .....

create a file call spamlovers
user@example.com OK
biggroup.net OK

that will prevent all subsequent anti-spam checks from being applied to
the listed recipient domains/addresses. in short - they want spam, let
them eat spam.


((snip)) amavisd.conf

# %bypass_virus_checks, @bypass_virus_checks_acl and $bypass_virus_checks_re
# lookup tables:
# (this is mainly a time-saving option, unlike virus_lovers* !)
#
# Similar in concept to %virus_lovers, a hash %bypass_virus_checks,
# access list @bypass_virus_checks_acl and regexp list
$bypass_virus_checks_re
# are used to skip entirely the decoding, unpacking and virus checking,
# but only if ALL recipients match the lookup.
#
# %bypass_virus_checks/@bypass_virus_checks_acl/$bypass_virus_checks_re
# do NOT GUARANTEE the message will NOT be checked for viruses - this may
# still happen when there is more than one recipient for a message, and
# not all of them match these lookup tables. To guarantee virus delivery,
# a recipient must also match %virus_lovers/@virus_lovers_acl lookups
# (but see milter limitations above),

# NOTE: it would not be clever to base virus checks on SENDER address,
# since there are no guarantees that it is genuine. Many viruses
# and spam messages fake sender address. To achieve selective filtering
# based on the source of the mail (e.g. IP address, MTA port number, ...),
# use mechanisms provided by MTA if available.


# Similar to lookup tables controlling virus checking,
# there exist spam scanning and banned names/types control counterparts:
# %spam_lovers, @spam_lovers_acl
# %banned_files_lovers, @banned_files_lovers_acl
# and:
# %bypass_spam_checks/@bypass_spam_checks_acl/$bypass_spam_checks_re
# (but no bypass_banned_checks, as $bypass_decode_parts controls it
already)
# See README.lookups for detailsabout the syntax.

# The following example disables spam checking altogether,
# since it matches any recipient e-mail address (any address
# is a subdomain of the top-level root DNS domain):
# @bypass_spam_checks_acl = qw( . );


# See README.lookups for further detail, and examples below.

# $virus_lovers{lc("postmaster\@$mydomain")} = 1;
# $virus_lovers{lc('postmaster@example.com')} = 1;
# $virus_lovers{lc('abuse@example.com')} = 1;
# $virus_lovers{lc('some.user@')} = 1; # this recipient, regardless of
domain
# $virus_lovers{lc('boss@example.com')} = 0; # never, even if domain matches
# $virus_lovers{lc('example.com')} = 1; # this domain, but not its
subdomains
# $virus_lovers{lc('.example.com')}= 1; # this domain, including its
subdomains
#or:
# @virus_lovers_acl = qw( me@lab.xxx.com !lab.xxx.com .xxx.com yyy.org );
#
# $bypass_virus_checks{lc('some.user2@butnot.example.com')} = 1;
# @bypass_virus_checks_acl = qw( some.ddd !butnot.example.com
.example.com );

# @virus_lovers_acl = qw( postmaster@example.com );
# $virus_lovers_re = new_RE( qr'(helpdesk|postmaster)@example\.com$'i );

# $spam_lovers{lc("postmaster\@$mydomain")} = 1;
# $spam_lovers{lc('postmaster@example.com')} = 1;
# $spam_lovers{lc('abuse@example.com')} = 1;
# @spam_lovers_acl = qw( !.example.com );
# $spam_lovers_re = new_RE( qr'^user@example\.com$'i );


# don't run spam check for these RECIPIENT domains:
# @bypass_spam_checks_acl = qw( d1.com .d2.com a.d3.com );
# or the other way around (bypass check for all BUT these):
# @bypass_spam_checks_acl = qw( !d1.com !.d2.com !a.d3.com . );
# a practical application: don't check outgoing mail for spam:
# @bypass_spam_checks_acl = ( "!.$mydomain", "." );
# (a downside of which is that such mail will not count as ham in SA
bayes db)

I'm sure anyone of these methods will allow the lovers of the blessed spam to fill their hearts content. Hope you have good hard drives 🙂

--j

Aug 11, 2006 12:32 AM in response to pterobyte

Thanks Jeff,

I will try the changes and let you know.

Hi pterobyte,

we do indeed get frequent 99% pegged for the virus scan process when our render farm is busy. We send quite a lot of internal email to our internal newgroups (mailman on the same box). There is no doubt that we are pushing this box regarding mail, hence the need to remove the scanning for internal mails at least for this address, but I wonder if it may be a config error that slows it down as well.

Aug 11, 2006 12:58 AM in response to DylanPenhale

we do indeed get frequent 99% pegged for the virus
scan process when our render farm is busy. We send
quite a lot of internal email to our internal
newgroups (mailman on the same box).

I see.

There is no
doubt that we are pushing this box regarding mail,
hence the need to remove the scanning for internal
mails at least for this address, but I wonder if it
may be a config error that slows it down as well.

Hard to tell without knowing more about it?
What hardware are you using? Number of users? Mail? Other services?

Aug 13, 2006 8:06 PM in response to pterobyte

I tried adding the spamlovers line in main.cf and adding the file but for some reason the mails are still being scanned. It's not the spam filter that is taking up so much CPU really, it is the AV side.

If I send a mail to the mailgroup it's headers say it has been scanned twice, even though the email address of the mailgroup is in the spamlovers file.

This is where things get confussing to me, there are so many config files here and I am not sure which is actually being read. For whitelisting users I use /var/amavis/.spamassassin/user_prefs but the score is adjusted elsewhere.

The box is a Dual 1.5 G4, 1.5 GB ram and running 10.4.4
We have about 50/60 users but it's the system processes that do the damage. We can have hundreds of mails a minute sometimes, and having all of these scanned for viri does have an effect on the response time. On more than one occasion I have got to work to find over 3000 mails in the mail queue which brings the box to a halt.

Perhaps an upgrade would be in order.

Aug 14, 2006 1:08 AM in response to DylanPenhale

I'll let Jeff continue as far as the configuration goes.

The box is a Dual 1.5 G4, 1.5 GB ram and running
10.4.4
We have about 50/60 users but it's the system
processes that do the damage. We can have hundreds of
mails a minute sometimes, and having all of these
scanned for viri does have an effect on the response
time. On more than one occasion I have got to work to
find over 3000 mails in the mail queue which brings
the box to a halt.

Perhaps an upgrade would be in order.


I assume you are running a Mac OS X server standard installation. The default there for Virus scans is to use clamscan, which doesn't perform too well. You may want to look into using clamd (which is the daemonized version of ClamAV) instead. The good news is that clamd is much faster. The bad news is that you'll have to recompile it to make it compatible with launchd

If you want to go down that route, let me know and I'll help you out.

Alex

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

bypass spam filters for certain mail addresses

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.