Table of Contents for

Postfix: The Definitive Guide

As with the simple filtering solution described earlier, you should create a pseudoaccount for your filter. The account shouldn’t have access to other resources on your system. If your filter needs to write files, you should create a directory for that purpose. Your filter should be started as the designated user or configured to become that user after starting. Check your filter’s configuration options. For this example, I’ll assume that you’ve created a user called filter.

Your content filter package should provide you with instructions for installation and configuration. In this example, assume that the filter listens on the loopback interface on port 10025. After processing messages, the filter should pass them back to Postfix on port 10026. You should be able to configure your filter accordingly, or if your filter listens and reinjects on a different port, keep that in mind as you follow the example. If possible, test your filter first to make sure that it operates correctly before trying to connect it to Postfix.

You may encounter "mail loops back to myself” problems when creating additional SMTP components. One solution is to give the additional component a different value for myhostname.

Edit master.cf to add the new components you need. A second smtp component will be used to send messages to your content filter. (See Section 4.5 in Chapter 4 for more information on editing master.cf.) We’ll call this additional smtp entry chkmsg:

chkmsg                unix  -      -      n      -      10      smtp
    -o myhostname=localhost

Later, when you turn on content filtering in main.cf, you’ll tell Postfix to send the message to your filter on port 10025 using this component.

In addition to the extra smtp client, you also need a second smtpd service to receive messages back from the content filter program. The second smtpd instance is configured slightly differently from the normal one because you want Postfix to handle traffic from your filter differently from messages coming from outside. Set options with an entry like the following:

localhost:10026     inet  n      -      n      -      10      smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o mynetworks=127.0.0.0/8
        -o smtpd_helo_restrictions=
        -o smtpd_client_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject

This instance of smtpd is configured to listen on the loopback interface on port 10026. You configure your filter to send the processed messages to this service. There are several options in this example. These override the settings in the main.cf file and are explained below:

After you have made the necessary changes to master.cf, you have to configure Postfix to pass all messages it receives to your content filter. Edit the main.cf file to add a line like the following:

content_filter = chkmsg:[127.0.0.1]:10025

This parameter tells Postfix to pass messages to the content filter via the chkmsg service that you created in master.cf. You also tell it to send the messages to port 10025, which should match what you have configured your content filter program to use. Be sure to reload Postfix to recognize the changes in its configuration files. Once Postfix is reloaded, it will start passing all messages through your content filter for processing.