# ClamSMTP: Using with Postfix

Postfix supports filtering mail through a filter that acts like an SMTP server. This is how `clamsmtp` was designed. Postfix supports before-queue and after-queue filters. Before-queue filters make a poor choice for anti-virus scanners so this document will describe the latter. For more details on why and how this all works, read the above links on the Postfix site.

Put the following lines in your Postfix `main.cf` file:

    content_filter = scan:127.0.0.1:10025
    receive_override_options = no_address_mappings

The `content_filter` tells Postfix to send all mail through the service called 'scan' on port 10025. We'll set up `clamsmtpd` to listen on this port later.

Next we add the following to the Postfix `master.cf` file:

    # AV scan filter (used by content_filter)
    scan      unix  -       -       n       -       16      smtp
            -o smtp_send_xforward_command=yes
    # For injecting mail back into postfix from the filter
    127.0.0.1:10026 inet  n -       n       -       16      smtpd
            -o content_filter=
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtpd_helo_restrictions=
            -o smtpd_client_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o mynetworks_style=host
            -o smtpd_authorized_xforward_hosts=127.0.0.0/8

Make sure there's no spaces around the equal signs or commas in the text you added. The first 2 lines create the 'scan' service. The rest set up a service for accepting mail back into postfix. All the options prevent a mail loop as well as relax address checking and the like, since that's already been done.

Specify the `OutAddress` option in `clamsmtpd.conf` as `127.0.0.1:10026`. Make sure to run it as the same user as you run `clamd` or they'll have problems accessing each other's temporary files. You can use the `User` option to accomplish that.

Now start up `clamsmtpd` like this.

    # clamsmtpd -f /path/to/clamsmtpd.conf

Make sure `clamd` (the ClamAV daemon) is running, and its listening on the socket you specified. You can set this in `clamav.conf` using the `LocalSocket` or `TCPSocket` directives (only uncomment one). Also make sure the `ScanMail` directive is on.

And that's all there is to it. If something's not working, check mail-queues, logs, etc... If you have trouble with `clamsmtpd` or send me a bug report, be sure to try the debug log mode which can be a valuable aid in figuring things out:

    # clamsmtpd -d 4 -f /path/to/clamsmtpd.conf

[Note: You may have to keep this in mind if you're trying out the above setup in a jail, and change the `smtpd_authorized_xforward_hosts` line accordingly.]

###### Copyright 2002, N. Nielsen [ clamsmtp | home page ]