Current Document and Section   Other Documents     Documentation     Howtos   User Guide DNS and Domains Gateway Services Guide Release Notes

Howtos - Filtering E-mail With Procmail

	Warning!

This document is either no longer maintained or deprecated.  Use with caution!

[edit] Overview

On occasion, an e-mail virus forges the reply address using our domain (clarkconnect.com). For instance, a virus sends an e-mail to bob@example.com with a (fake) return address of info@clarkconnect.com. If bob@example.com has antivirus enabled, then we (annoyingly) receive an antivirus report. This can sometimes generate hundreds or thousands of unwanted messages!

We use the Procmail software package to filter these unwanted antivirus reports. This Howto is a brief description of how we did it. Keep in mind, Procmail can be used for many other purposes.

[edit] Install Procmail

The first step, of course, is to make sure Procmail is installed! In most versions of ClarkConnect, Procmail is installed by default. If it is not installed, you can use the following commands to install it:

• apt-get update
• apt-get install procmail

[edit] Enable Procmail in Postfix

Once procmail is installed, you need to enable it in the Postfix configuration file - /etc/postfix/main.cf. Look for the mailbox_command parameter and set it to:

mailbox_command = /usr/bin/procmail

Restart Postfix with the command:

/sbin/service postfix restart

At this point, mail is passing through Procmail before getting delivered to an end user's mailbox. Nothing is configured, so you will not see any changes yet!

[edit] Create a Procmail Configuration File

Procmail will check the /etc/procmailrc file for global rules, as well as a .procmailrc in a user's home directory (/home/username/.procmailrc). In our example, we add a global rule to forward any mail with "Symantec Antivirus Report" in the body of the message. All this mail goes to junk@example.com. The /etc/procmailrc looks like:

:0BH:
* Symantec Antivirus Report
! junk@example.com

Procmail can perform all sorts of neat tricks. Follow the links below for more information.

[edit] Links

• Procmail home page

[edit] Advanced Procmail Links

These links demonstrate some of the neat tricks it is capable of doing.

• The E-mail Sanitizer a Procmail-Based Email Attachment Filter
• The SpamBouncer a Procmail-Based Spam Filter
• YAVR -Yet Another antiVirus Recipe a Procmail-Based Virus Scanner