[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] Mailscanner not getting viruses all the time



At 01:34 PM 2/11/2004, you wrote:
On Wed, 11 Feb 2004, Kim Schulz wrote:

> [snip]
> > How does the Internet know to deliver mail to the primary MX server?
> > By what mechanism does the primary MX forward the mails onto secondary
> > MX? Are you using RBL's at all as part of your primary MX server
> > Sendmail config or through the MailScanner config?

Only the server where the user has a mailbox can receive the email.
The secondary will just queue it unitl the primary will receive it.
 >
> well mailservices normally use the primary MX (Highest Priority). The
> forwarding is handled by sendmail via normal mailertable settings
> (esmtp).
> RBL's are handled by MailScanner, but we have a long list of rejects in
> the sendmail access list (bacically alot of dynamic ip hostnames like
> adsl domains).
>
> > For example, if the Internet delivers your customer domain email with
> > primary MX set as the primary MX record in DNS and the secondary MX as
> > a backup server, then it would be possible for the primary MX to
> > reject the mail connection based on an RBL check but the sending
> > server doesn't give up. It then tries to deliver to the next priority
> > MX server listed by DNS. In your example this would mean the secondary
> > MX then I presume it would miss out the virus checks.
>
> You have a very good point there. I will check up on this right away.
> Do you know if it's possible to forward via sendmail's mailertable if
> the secondary server isn't listed as an MX server?
>
> > I would also check whether your customer is really getting the virus
> > mails or rather just the warning messages generated by MailScanner.
>
> I have and it is both bounces from others mailscanners and viruses
> itself.

 No, I don't think this is correct, as the email has to reach it's
destination on the primary server where the user destined to get the email
is. The secondary doesn't actually recieve the email, it just queue's it.
When it eventually gets to the primary it will go through the mail
scanner.


does that mean I can't have mailscanner AND spamassassin on a separate server to the intended final server?

I'm busy compiling various sources on a 1u server we just bought for MySQL, and I'm looking at ordering another to handle spamassassin and antivirus/mailscanner activities, as these raqs are just underpowered for this kind of work... but I'd always anticipated leaving mailscanner on all the RAQ to do at least a FINAL virus scan, just incase the first server was down, as I expected the mail to by-pass a downed server... anything wrong with this theory?

regards

Greg


Gerald